plusplusjiajia opened a new pull request, #1077: URL: https://github.com/apache/paimon-rust/pull/1077
### Purpose #513 applies the server's row filter but still refuses users with column masks. This applies column masking on read so those users can read too. ### Brief change log The grant also carries the masks, parsed as Java does: a mask on an unknown column, one that reads another masked column, or one that changes the column type or can make a NOT NULL column null fails closed, and a mask on a system column is inert. A `CAST` mask is accepted only where Arrow and Java convert alike. Planning keeps caller conjuncts on masked columns out of pruning, bucket pruning included, and refuses a filter on a masked partition key, as Java does. `to_arrow` masks after filtering on stored values, applies the caller's conjuncts on masked columns to the masked values, and projects back. BLOB inputs to masks are resolved after row authorization. Masked values are not decoded as descriptors again, and a NULL mask does not open the original payload. Caller predicates and output resolution use the masked values. ### Tests Unit tests for every mask transform and each refused mask, and mock-server tests reading masked rows, a filter on a masked column, a masked bucket key, a masked partition key, and a primary-key table. BLOB and BLOB-view tests cover NULL and field-reference masks, payload predicates, projection and limits. DataFusion queries verify that `WHERE` and aggregates see the masked values. ### API and Format No API or format change. ### Documentation The Query Authorization section in `docs/src/sql.md` covers masks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
