github-actions[bot] commented on code in PR #67711:
URL: https://github.com/apache/doris/pull/67711#discussion_r3965953367
##########
fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/ExecuteActionCommand.java:
##########
@@ -144,6 +144,23 @@ public Optional<Expression> getWhereCondition() {
return whereCondition;
}
+ private ResultSet executeAuthenticated(ExecuteAction action, ExternalTable
table) throws Exception {
+ try {
+ // Iceberg tables retain filesystem configuration, not the
caller's UGI, so loading the table and
+ // committing its metadata must stay within one catalog
authentication scope.
+ return table.getCatalog().getExecutionAuthenticator().execute(()
-> {
Review Comment:
[P1] Keep the action on the writable table's auth generation
This captures the catalog authenticator before the action resolves its
writable Iceberg table. If an `ALTER CATALOG` resets credentials after this
read, `getWritableIcebergTable()` can lazily initialize generation B, load and
validate a B table under authenticator B, then return here so the metadata
commit runs inside the stale outer `doAs(A)`. A reset just before this read can
also expose the temporary null authenticator instead of letting writable
acquisition reinitialize it. The existing writable-cache fence only compares B
with the catalog's current B; it cannot see this outer A/B splice. Please
execute acquisition plus commit through one generation-bound context (or pass
the expected ops/authenticator into acquisition and retry on mismatch), and
cover the two-authenticator reset interleaving in the command test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
