roryqi opened a new issue, #13980:
URL: https://github.com/apache/gravitino/issues/13980
### Version
main branch
### Describe what's wrong
An authenticated caller can submit scan or commit metrics for a table
without permission to read it. The Iceberg REST metrics endpoint lacks a table
authorization expression, and the interceptor allows methods without that
annotation to proceed.
### Error message and/or stacktrace
N/A
### How to reproduce
1. Enable authorization and configure a JDBC metrics store.
2. As a user without access to a table, POST a metrics report to
`/v1/{prefix}/namespaces/{namespace}/tables/{table}/metrics`.
3. Observe that the request can be accepted and the report stored.
Expected: the request is denied.
### Additional context
The endpoint should require table read access and reject reports for
nonexistent tables or a different table.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
