JingsongLi commented on code in PR #447:
URL: https://github.com/apache/paimon-rust/pull/447#discussion_r3523406307
##########
crates/integrations/datafusion/tests/system_tables.rs:
##########
@@ -72,6 +72,41 @@ async fn run_sql(ctx: &SQLContext, sql: &str) ->
Vec<RecordBatch> {
.unwrap_or_else(|e| panic!("Failed to execute `{sql}`: {e}"))
}
+// Error text of `sql`, whether it surfaces at planning or execution.
+async fn query_error(ctx: &SQLContext, sql: &str) -> String {
+ match ctx.sql(sql).await {
+ Err(e) => e.to_string(),
+ Ok(df) => df
+ .collect()
+ .await
+ .expect_err(&format!("`{sql}` must fail"))
+ .to_string(),
+ }
+}
+
+#[tokio::test]
+async fn test_query_auth_table_fails_closed() {
+ let (ctx, _catalog, _tmp) = create_context().await;
+ run_sql(
+ &ctx,
+ "CREATE TABLE paimon.default.qa (id INT) WITH ('query-auth.enabled' =
'true')",
+ )
Review Comment:
This new integration test currently fails on the first query. Running
`CARGO_TARGET_DIR=/tmp/paimon-rust-shared-target cargo test -p
paimon-datafusion test_query_auth_table_fails_closed --test system_tables`
returns `[]` for `SELECT * FROM paimon.default.qa` instead of an error
containing `query-auth.enabled`, so the DataFusion base-table read path is
still not fail-closed for a `query-auth.enabled` table. Please enforce the
guard at the DataFusion provider/catalog boundary (or otherwise make this
public SQL path hit the core guard) and keep this test passing; as written, the
PR still allows this read to succeed silently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
