JingsongLi commented on code in PR #758:
URL: https://github.com/apache/paimon-rust/pull/758#discussion_r3930390747
##########
crates/paimon/src/table/mod.rs:
##########
@@ -322,6 +328,108 @@ impl Table {
}
}
+ /// The live counterpart of [`CoreOptions::ensure_read_authorized`], which
+ /// reads the schema this handle was loaded with.
+ pub(crate) async fn ensure_read_authorized_live(&self, path: &str) ->
Result<()> {
+ let local = CoreOptions::new(self.schema.options());
+ local.ensure_type_paimon_served(&self.identifier.full_name())?;
+ if self.server_query_auth_enabled().await? {
+ return Err(query_auth::unsupported(&format!(
+ "{path} reads index files directly and cannot apply a row
filter or column masking"
+ )));
+ }
+ Ok(())
+ }
+
+ /// Whether the server says this table is `query-auth.enabled` right now:
the
+ /// handle's schema is a snapshot, and a cached `false` would skip the
check.
+ pub(crate) async fn server_query_auth_enabled(&self) -> Result<bool> {
+ let local =
CoreOptions::new(self.schema.options()).query_auth_enabled();
+ let Some(rest_env) = &self.rest_env else {
+ return Ok(local);
+ };
+ // Only ever strengthens: the name can be re-created over this handle's
+ // files, so the answer may be about a different table.
+ if local {
+ return Ok(true);
+ }
+ match rest_env.current_table().await?.schema.as_ref() {
Review Comment:
[P1] Do not trust a disabled answer from a replacement table
When the cached schema is `false`, this accepts the current name’s schema
without checking that it still has `rest_env`’s UUID. A stale handle can
therefore miss the very transition this helper is meant to catch: load table A
with auth disabled, enable restricted query auth for A, then drop/re-create the
name as table B with auth disabled. `current_table()` now reports B’s `false`,
`ensure_read_authorized_live` succeeds, and direct vector/full-text/index paths
read A’s still-reachable files through the stale handle without any auth
exchange. The comment says the live answer only strengthens, but a `false` from
a different UUID does not constrain A at all. Please validate the UUID before
accepting a live `false` (schema freshness can remain a separate policy) and
add a stale-false/recreated-table regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
