[plusplusjiajia]

Purpose

The Ray Data Evolution merge_into did not check query auth before merging, unlike the local and native merge and the other update paths, which require full access to the table (_authorize_update).

• Matched updates and deletes were refused later. But a merge with only WHEN NOT MATCHED read the target keys through the filtered and masked read, so keys hidden by the row filter, or masked on the ON column, looked unmatched and were inserted again as duplicates.
• A source given as a table name was read through its own filtered and masked read, so masked values were written into the target as real data.

merge_into now requires full access to the target, and to a source given as a table name, before anything is read or written, as the local merge does.

Tests

• test_insert_only_merge_authorizes_target_before_source: an insert-only merge into a target that is denied, row filtered or masked on the ON key, with and without existing rows, is refused before the source, the snapshot or any assignment is read, and no files are written.
• test_merge_authorizes_named_source_separately: a row filtered or masked source table is refused after the target is authorized, and nothing is written.
• test_merge_with_full_source_and_target_grants: with full access to both tables the merge still updates and inserts.
• The 10 new test cases fail on master. The related tests pass locally: 89 passed in ray_data_evolution_merge_into_test.py, and 223 passed in native_authorized_update_test.py, table_merge_into_test.py and table_query_auth_test.py. flake8 is clean.