j1wonpark opened a new pull request, #7741: URL: https://github.com/apache/kyuubi/pull/7741
### Why are the changes needed? Closes #7740. Also closes #3924. Since #5248 (1.9.0), a scan of an Iceberg metadata table (`t.history`, `t.files`, ...) or `t.changes` produces no privilege object: the 4-part `Table.name()` makes `StringTableExtractor` throw `MatchError`, which `CommandSpec.tables` swallows, so the read is never checked. `t.files` and `t.changes` expose column values. This maps such tables to the data table they are derived from (`BaseMetadataTable.table()`, `SparkChangelogTable.icebergTable`), so `t.history` requires `select` on `db/t/<its columns>`, the same way `VERSION AS OF` is already checked. The name is not split because `cat.a.b.c` is ambiguous with a nested namespace. Two consequences worth noting: - A column-restricted policy on `t` denies its metadata tables. Bounds, partition values and change rows can reveal restricted columns, so this is the safe outcome. - A row-filter policy on `t` now applies to its metadata tables and fails analysis there, since the filter references data columns. Also deny-safe. The existing `CALL rollback_*` tests read `t.snapshots` outside `doAs` and passed only because of this gap; they now run as `admin`. ### How was this patch tested? New test in `IcebergCatalogRangerSparkExtensionSuite` covering `history`, `snapshots`, `files`, `manifests`, `partitions`, `refs` and `changes`: a user with no policy is denied on `db/t/...`, a user with `select` on the table reads them. Fails before the fix. Full suite passes locally. ### Was this patch assisted by generative AI tooling? Assisted-by: Claude Opus 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
