Repository navigation
[core] Reject disabling query auth with dynamic options - #10903
Merged
JingsongLi merged 1 commit intoNov 1, 2026
Merged
JingsongLi merged 1 commit into
JingsongLi merged 1 commit into
Conversation
plusplusjiajia
marked this pull request as ready for review
October 31, 2026 03:17
query-auth.enabled is not an immutable option, so a dynamic option could turn it off: table.copy with query-auth.enabled=false returned a table without row filters and column masks. This was reachable from SQL, for example with Spark's SET spark.paimon.query-auth.enabled=false or a Flink OPTIONS hint, and also disabled the search rejection. Only the Flink search procedures refused the option. copy and copyWithoutTimeTravel now reject a dynamic value that is not true when the table enables query auth. Enabling it dynamically, or passing true, is still allowed. IndexBootstrap reads the primary keys without query auth on purpose. It now uses a new internal FileStoreTable.copyWithoutQueryAuth, which every table that wraps others (fallback, chain and lookup tables) implements like its copy, so their branches are kept.
plusplusjiajia
force-pushed
the
fix/core-reject-disabling-query-auth
branch
from
October 31, 2026 03:28
5e8d142 to
675de23
Compare
This was referenced Oct 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
query-auth.enabledis not an immutable option. A dynamic option could therefore turn it off:table.copy({"query-auth.enabled": "false"})returned a table without the row filters and column masks of the REST catalog, and it also disabled the search rejection. This was reachable from SQL, for example:SET spark.paimon.query-auth.enabled=false, or the same option given as a read option;/*+ OPTIONS('query-auth.enabled'='false') */hint, or the same option set as apaimon.*session option.Only the Flink vector and full-text search procedures refused the option.
copyandcopyWithoutTimeTravelnow reject a dynamic value ofquery-auth.enabledthat is nottruewhen the table enables query auth. Enabling it dynamically, or passingtrue, is still allowed.IndexBootstrapreads the primary keys without query auth on purpose. It now uses a new internalFileStoreTable.copyWithoutQueryAuth, which the tables that wrap others (FallbackReadFileStoreTable,ChainGroupReadTable,ChainTableFileStoreTableand Flink'sLookupFileStoreTable) implement like theircopy, so their branches are kept.Tests
RESTCatalogTest#testQueryAuthCannotBeDisabledDynamically:copyandcopyWithoutTimeTravelrejectfalse,nulland invalid values on a table with a row filter and a mask, and copies withtruestill apply the rules.RESTCatalogTest#testQueryAuthCanBeEnabledDynamically: query auth can still be enabled dynamically on a table without it.IndexBootstrapTest: the bootstrap ignores query auth on tables that enable it, and reads the keys of both branches of a table withscan.fallback-branch.ChainTableFileStoreTableTestandLookupTableTest:copyWithoutQueryAuthkeeps the chain branches and the lookup scan mode.RESTCatalogTestand fallback bootstrap tests fail on master. The related tests pass locally:IndexBootstrapTest,FallbackReadFileStoreTableTest,ChainTableFileStoreTableTest,MockRESTCatalogTestandLookupTableTest, 359 tests.