plusplusjiajia opened a new pull request, #10903:
URL: https://github.com/apache/paimon/pull/10903
### Purpose
`query-auth.enabled` is not an immutable option. A dynamic option could
therefore turn it off: `table.copy({"query-auth.enabled": "false"})` returned a
table without the row filters and column masks of the REST catalog, and it also
disabled the search rejection. This was reachable from SQL, for example:
- Spark `SET spark.paimon.query-auth.enabled=false`, or the same option
given as a read option;
- a Flink `/*+ OPTIONS('query-auth.enabled'='false') */` hint, or the same
option set as a `paimon.*` session option.
Only the Flink vector and full-text search procedures refused the option.
`copy` and `copyWithoutTimeTravel` now reject a dynamic value of
`query-auth.enabled` that is not `true` when the table enables query auth.
Enabling it dynamically, or passing `true`, is still allowed.
`IndexBootstrap` reads the primary keys without query auth on purpose. It
now uses a new internal `FileStoreTable.copyWithoutQueryAuth`, which the tables
that wrap others (`FallbackReadFileStoreTable`, `ChainGroupReadTable`,
`ChainTableFileStoreTable` and Flink's `LookupFileStoreTable`) implement like
their `copy`, so their branches are kept.
### Tests
- `RESTCatalogTest#testQueryAuthCannotBeDisabledDynamically`: `copy` and
`copyWithoutTimeTravel` reject `false`, `null` and invalid values on a table
with a row filter and a mask, and copies with `true` still apply the rules.
- `RESTCatalogTest#testQueryAuthCanBeEnabledDynamically`: query auth can
still be enabled dynamically on a table without it.
- `IndexBootstrapTest`: the bootstrap ignores query auth on tables that
enable it, and reads the keys of both branches of a table with
`scan.fallback-branch`.
- `ChainTableFileStoreTableTest` and `LookupTableTest`:
`copyWithoutQueryAuth` keeps the chain branches and the lookup scan mode.
- The new `RESTCatalogTest` and fallback bootstrap tests fail on master. The
related tests pass locally: `IndexBootstrapTest`,
`FallbackReadFileStoreTableTest`, `ChainTableFileStoreTableTest`,
`MockRESTCatalogTest` and `LookupTableTest`, 359 tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
