fix(auth): Fail closed on query-auth tables outside the read boundary - #691
Merged
Merged
Conversation
plusplusjiajia
force-pushed
the
query-auth-write-gate
branch
2 times, most recently
from
August 7, 2026 13:52
7ac60a2 to
8019cbc
Compare
plusplusjiajia
marked this pull request as ready for review
August 7, 2026 14:59
plusplusjiajia
force-pushed
the
query-auth-write-gate
branch
from
August 14, 2026 15:56
8019cbc to
078c131
Compare
plusplusjiajia
changed the title
plusplusjiajia
changed the title
jerry-024
added a commit
to jerry-024/paimon-rust
that referenced
this pull request
Aug 17, 2026
* main: perf(vindex): size native batches by active indexes (apache#709) fix(data-evolution): require row tracking and row IDs (apache#718) feat(go): add table write bindings (apache#658) fix(scan): preserve Data Evolution file order in row-id groups (apache#717) fix(file_index): align file index format with Java V1 (apache#719) fix: configure OpenDAL writer chunk size (apache#713) fix(python): release GIL during catalog I/O (apache#716) feat(write): add fixed-bucket write primitives for postpone tables (apache#659) feat: rust examples for creating and querying Paimon tables (apache#648) fix(table): reject row ranges for format tables at read construction (apache#700) perf(arrow): prune IN predicates with row-group stats (apache#705) feat(io): support in-memory local cache (apache#710) fix(dlf): refresh expiring credentials (apache#714) fix(datafusion): normalize index_type in global index procedures (apache#715) fix(auth): fail closed on query-auth tables outside the read boundary (apache#691) # Conflicts: # crates/paimon/src/table/vector_search_builder.rs # crates/paimon/src/vindex/reader.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
CoreOptions::ensure_read_authorized()refuses aquery-auth.enabledtable because this client cannot enforce the server's row filter or column masking. It sits on the read boundary, so paths that readwithout crossing it are never gated: rewrites, index builds and drops, bucket assignment, commits, and partition listing.
Table::partition_stats()is the clearest case — public, reaching Python, returning thepartition values and column stats the DataFusion
$partitionstable already refuses to serve.Brief change log
The gate is added at each entry point, at the narrowest one that still has the table. Two placements are worth a look:
TableWrite::newrather thanDynamicBucketAssigner, which gets only aFileIOand a location. It refuses every write, not just dynamic-bucket ones — the commit is blocked anyway, so failing at open avoidswriting files that can never be committed.
list_partitions_from_file_systemrather than its three callers, since it is publicly re-exported and$partitionsretries it directly when the catalog call fails.Left ungated on purpose:
TableCommit::abort, which deletes only the files the caller just wrote, and path-based readers likeManifest::read, which have no table options to consult.