JingsongLi opened a new pull request, #8630: URL: https://github.com/apache/paimon/pull/8630
## What changed - Add the opt-in REST Catalog option `read-via.enabled`, disabled by default. - Add a `$via_` identifier protocol such as `my_table$via_db_view.my_view`. - Propagate the outermost Paimon Catalog View while Spark resolves referenced tables, including nested views, CTEs, joins, and subqueries. - Propagate the same authorization root when BlobView/BlobRef resolution loads referenced tables and obtains their FileIO. - Keep real table identifiers separate from read authorization context so commits, rollback, schema changes, and other mutations never inherit view permissions. - Isolate catalog cache entries by target and authorization root, while invalidating all variants with the real table. ## Why Spark Catalog View expansion and BlobView resolution load referenced tables independently. Those loads previously lost the authorized entry point, so a REST service could only evaluate direct permission on the referenced table. With this option enabled, read-related REST requests carry the outermost view or downstream table as explicit authorization context. The marker is context only. The REST service must still validate the principal, entry-point permission, and dependency between the entry point and target table. ## User impact Existing behavior is unchanged by default. When `read-via.enabled=true`, metadata loads, snapshot loads, query authorization, and data-token requests for referenced tables use the marked identifier. Write and metadata-changing operations continue to use the real identifier. ## Validation - `RESTReadViaTest`: 8 tests passed. - Focused API/Core regression: 173 tests passed, including the full `MockRESTCatalogTest` suite. - BlobView end-to-end regression: 2 tests passed. - `PaimonReadViaTest`: 3 Spark 3 tests passed. - Affected modules compiled successfully with Spotless, Checkstyle, and Enforcer enabled. - `git diff --check` passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
