plusplusjiajia commented on code in PR #447:
URL: https://github.com/apache/paimon-rust/pull/447#discussion_r3522410710
##########
crates/paimon/src/table/table_read.rs:
##########
@@ -72,8 +72,20 @@ impl<'a> TableRead<'a> {
/// Returns an [`ArrowRecordBatchStream`].
pub fn to_arrow(&self, data_splits: &[DataSplit]) ->
crate::Result<ArrowRecordBatchStream> {
- let has_primary_keys = !self.table.schema.primary_keys().is_empty();
let core_options = CoreOptions::new(self.table.schema.options());
+ // Fail closed: this client can't yet enforce query-auth row filtering
/ column masking,
+ // so refuse to read rather than return unfiltered data. Guarding this
single data exit
+ // (not the `ReadBuilder`) makes the check non-bypassable.
+ if core_options.query_auth_enabled() {
Review Comment:
@QuakeWang Good catch. Added the same Unsupported guard at scan planning
(plan() / plan_with_trace()), gated on !scan_all_files so only reads are
blocked (writes/compaction stay allowed).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
