nevzheng opened a new issue, #14259: URL: https://github.com/apache/gravitino/issues/14259
### Version main branch ### Describe what's wrong `RESTService` installs the Iceberg REST hook dispatchers (`IcebergTableHookDispatcher`, `IcebergViewHookDispatcher`, `IcebergNamespaceHookDispatcher`) only when `authorizationContext.isAuthorizationEnabled()`. Those hooks also do the entity bookkeeping: they delete the Gravitino entity on drop and move it on rename. With authorization off, Gravitino entities for Iceberg REST tables still exist, because any load through the Gravitino REST API imports them. But a drop or rename through Iceberg REST no longer touches them. The Gravitino REST API deletes the entity whether authorization is on or off. Core import then treats a leftover entity, matched by name, as already imported (`TableOperationDispatcher` keeps its id when the table has no stored Gravitino id). So: - **A recreated table inherits the old entity.** Its id, tags, policies and statistics come back. - **Turning authorization on later** also brings back the old owner and role grants. ### Error message and/or stacktrace None. ### How to reproduce 1. Run the Iceberg REST server in auxiliary mode with `gravitino.authorization.enable=false`. 2. Load `c.s1.t1` through the Gravitino REST API (this imports it) and attach a tag. 3. Drop `t1` through Iceberg REST, then create a new `t1` through Iceberg REST. 4. Load `c.s1.t1` through the Gravitino REST API. Expected: a new entity with no tag. Actual: the old entity id and the tag. ### Additional context Proposed fix: install the hooks whenever an entity store exists (auxiliary mode), and keep the create-time import and owner steps behind authorization. Create-time import has to stay gated: with a static config provider the Iceberg REST catalog may have no Gravitino catalog, and an unguarded import would break creates that work today. The standalone Iceberg REST server has no entity store, so it is not affected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
