(gravitino) branch main updated: [#13033] fix(iceberg): Map PostgreSQL JDBC auth failures to ConnectionFailedException (#13034)

[roryqi]

This is an automated email from the ASF dual-hosted git repository.

roryqi pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/main by this push:
     new e7fee4319a [#13033] fix(iceberg): Map PostgreSQL JDBC auth failures to 
ConnectionFailedException (#13034)
e7fee4319a is described below

commit e7fee4319a41a4ad3944edf52e3f90f6e3646f9e
Author: MaSai <30949009+lasdf1...@users.noreply.github.com>
AuthorDate: Thu Sep 10 09:03:35 2026 +0800

    [#13033] fix(iceberg): Map PostgreSQL JDBC auth failures to 
ConnectionFailedException (#13034)
    
    ### What changes were proposed in this pull request?
    
    Classify Iceberg JDBC catalog authorization failures via SQLState class
    `28` (plus MySQL/PostgreSQL message fallbacks), so PostgreSQL
    bad-credential errors become `ConnectionFailedException` like MySQL
    `Access denied`.
    
    ### Why are the changes needed?
    
    Previously only the literal `Access denied` was matched. PostgreSQL
    reports `password authentication failed` / `role ... does not exist`
    (`28P01` / `28000`), so failures escaped as raw `UncheckedSQLException`.
    
    Fix: #13033
    
    ### Does this PR introduce _any_ user-facing change?
    
    - PostgreSQL Iceberg JDBC catalogs with bad credentials now surface
    `ConnectionFailedException` instead of a generic internal error.
    - No new APIs or property keys.
    
    ### How was this patch tested?
    
    ```
    ./gradlew :iceberg:iceberg-common:test --tests 
org.apache.gravitino.iceberg.common.utils.TestIcebergCatalogUtil -PskipITs
    ```
    
    ---------
    
    Co-authored-by: Cursor <cursorag...@cursor.com>
---
 .../iceberg/common/utils/IcebergCatalogUtil.java      | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git 
a/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
 
b/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
index 658786ea15..59b8ce8104 100644
--- 
a/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
+++ 
b/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
@@ -76,6 +76,15 @@ public class IcebergCatalogUtil {
    */
   private static final String ICEBERG_TYPE_COLUMN = "iceberg_type";
 
+  /**
+   * SQLSTATE {@code 28000}: MySQL error 1045 (Access denied), H2 wrong 
user/password, and
+   * PostgreSQL {@code invalid_authorization_specification} (for example 
unknown role).
+   */
+  private static final String SQLSTATE_INVALID_AUTHORIZATION = "28000";
+
+  /** SQLSTATE {@code 28P01}: PostgreSQL {@code invalid_password}. */
+  private static final String SQLSTATE_INVALID_PASSWORD = "28P01";
+
   private static final String GCS_CLOUD_PLATFORM_SCOPE =
       "https://www.googleapis.com/auth/cloud-platform";;
 
@@ -201,10 +210,12 @@ public class IcebergCatalogUtil {
       jdbcCatalog.initialize(icebergCatalogName, properties);
     } catch (UncheckedSQLException e) {
       Throwable cause = e.getCause();
-      if (cause instanceof SQLException
-          && cause.getMessage() != null
-          && cause.getMessage().contains("Access denied")) {
-        throw new ConnectionFailedException(e, e.getMessage());
+      if (cause instanceof SQLException) {
+        String sqlState = ((SQLException) cause).getSQLState();
+        if (SQLSTATE_INVALID_AUTHORIZATION.equals(sqlState)
+            || SQLSTATE_INVALID_PASSWORD.equals(sqlState)) {
+          throw new ConnectionFailedException(e, e.getMessage());
+        }
       }
       if (!isConcurrentViewMigrationConflict(e)) {
         throw e;