plusplusjiajia opened a new pull request, #10018: URL: https://github.com/apache/paimon/pull/10018
### Purpose pypaimon applies the row filter and the column masks that `authTableQuery` returns. When a rule could not be matched to a column by name, the masking reader skipped it and returned the column untransformed: - a mask whose target was renamed in a later schema; - a mask on a `ROW` column where the query projects a sub-field, since `read_type()` flattens `s.a` into a field named `s_a` — projecting a sub-field was enough to bypass the mask at will; - a mask whose transform reads another masked column, which transforms see raw. Java fails closed on all three. This ports `validateAgainstSchema`, `validateReadableWithoutRename` and `validateReadType`, called where Java calls them, plus two things the port needed: **Binding needs both schemas.** Identity comes from the latest one, which is what the rules name, so a re-added column or a name moved between columns refuses rather than masking unrelated data. The type comes from the schema the split was written under, so a column widened since then still reads. **Some names cannot be bound at all.** `_ROW_ID`, `_SEQUENCE_NUMBER` and `_VALUE_KIND` may each be the synthetic field or a physical column, and a rename makes the two indistinguishable, so any rule naming one is refused. A physical column carrying such a name therefore cannot carry a rule — a loud refusal rather than a silent skip. Discovery also had to match execution: `_resolve_transform_input` reads any dict input as a column, while the collector only counted one carrying both `name` and `index`, so an indexless reference escaped every check. Both the scan and the reader now run the same validation, so a split reaching a reader unplanned is held to the same rules. ### Tests `TestReaderAppliesTheRules` drives a real `TableRead` with only storage stubbed and asserts the returned values, so a reader that is constructed but masks nothing fails. Each original situation has a case, as do the schema-history ones. Reverting any check fails the suite, including omitting the snapshot schema, swapping the two schemas, restoring the name exemption, and reverting the collector. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
