lasdf1234 opened a new pull request, #12381:
URL: https://github.com/apache/gravitino/pull/12381
### What changes were proposed in this pull request?
> **Depends on #12366** (create-time `secretBindings` / `secretReferences`).
Please review the tip commit for alter-only changes until #12366 lands; this
branch will be rebased onto `main` afterward.
- Add alter `@type`s `setSecretBinding` / `setSecretReference` for catalog,
schema, and fileset updates (API changes, DTOs, OpenAPI, Java/Python clients).
- Introduce `SecretAlterHelper` to write secrets and rewrite secret ops into
`setProperty(URN)` before applying entity updates.
- On `removeProperty`, best-effort `deleteSecret` when the current value is
a write-through URN owned by this entity; external-ref URNs only remove the
property.
- `setProperty` rejects masked placeholder `******` and raw secret URN
strings; when the current value is already a secret URN, rewrite secret
material in-place.
### Why are the changes needed?
Entity alter needs the typed secret update contract from the design doc
(ยง5.9.4), stacked on create-time `secretBindings` / `secretReferences`.
Fix: #12297
### Does this PR introduce _any_ user-facing change?
- Yes. Catalog / schema / fileset alter `updates` gain optional `@type`
values `setSecretBinding` and `setSecretReference`.
- `setSecretBinding`: `{ "@type": "setSecretBinding", "property": "...",
"provider": "...", "plaintext": "..." }`
- `setSecretReference`: `{ "@type": "setSecretReference", "property": "...",
"provider": "...", "attributes": { ... } }`
### How was this patch tested?
- Unit tests: `TestSecretAlterHelper`, `TestSecretManager`,
`TestRequestJsonSerDe`
- OpenAPI validation via `:docs:build`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
