QuakeWang commented on code in PR #447:
URL: https://github.com/apache/paimon-rust/pull/447#discussion_r3522378274
##########
crates/paimon/src/table/table_read.rs:
##########
@@ -72,8 +72,20 @@ impl<'a> TableRead<'a> {
/// Returns an [`ArrowRecordBatchStream`].
pub fn to_arrow(&self, data_splits: &[DataSplit]) ->
crate::Result<ArrowRecordBatchStream> {
- let has_primary_keys = !self.table.schema.primary_keys().is_empty();
let core_options = CoreOptions::new(self.table.schema.options());
+ // Fail closed: this client can't yet enforce query-auth row filtering
/ column masking,
+ // so refuse to read rather than return unfiltered data. Guarding this
single data exit
+ // (not the `ReadBuilder`) makes the check non-bypassable.
+ if core_options.query_auth_enabled() {
Review Comment:
This guards row materialization, but scan planning still succeeds for a
`query-auth.enabled` table. `TableScan::plan()` / `plan_with_trace()` can still
expose splits, file metadata, row counts, and stats before `to_arrow()` is
reached, and DataFusion also plans eagerly. To make this truly fail closed,
please add the same `Unsupported` guard at the scan planning boundary as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
