JingsongLi commented on code in PR #758:
URL: https://github.com/apache/paimon-rust/pull/758#discussion_r3930394409
##########
crates/paimon/src/table/mod.rs:
##########
@@ -322,6 +328,108 @@ impl Table {
}
}
+ /// The live counterpart of [`CoreOptions::ensure_read_authorized`], which
+ /// reads the schema this handle was loaded with.
+ pub(crate) async fn ensure_read_authorized_live(&self, path: &str) ->
Result<()> {
+ let local = CoreOptions::new(self.schema.options());
+ local.ensure_type_paimon_served(&self.identifier.full_name())?;
+ if self.server_query_auth_enabled().await? {
+ return Err(query_auth::unsupported(&format!(
+ "{path} reads index files directly and cannot apply a row
filter or column masking"
+ )));
+ }
+ Ok(())
+ }
+
+ /// Whether the server says this table is `query-auth.enabled` right now:
the
+ /// handle's schema is a snapshot, and a cached `false` would skip the
check.
+ pub(crate) async fn server_query_auth_enabled(&self) -> Result<bool> {
+ let local =
CoreOptions::new(self.schema.options()).query_auth_enabled();
+ let Some(rest_env) = &self.rest_env else {
+ return Ok(local);
+ };
+ // Only ever strengthens: the name can be re-created over this handle's
+ // files, so the answer may be about a different table.
+ if local {
+ return Ok(true);
+ }
+ match rest_env.current_table().await?.schema.as_ref() {
Review Comment:
[P1] Check the live branch schema, not the base-table name
For a table obtained through `copy_with_branch`, `self.schema` and the
managers point at the branch, but `rest_env.current_table()` still queries the
base identifier stored when the original handle was loaded. If the branch
handle cached `query-auth.enabled=false`, the branch is later changed to
restricted auth, and the base schema remains false, this method returns false;
`authorize_read(false)` then exits before its `branch_reference` refusal and
the scan reads the branch without an auth exchange. The current branch tests
only start with a locally true option, so they do not cover this stale-false
case. Please query `branch_identifier(self.branch())` for live state (or
conservatively refuse REST branch handles) and add a branch-specific toggle
regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
