nevzheng opened a new issue, #14243:
URL: https://github.com/apache/gravitino/issues/14243
### Version
main branch
### Describe what's wrong
`POST /v1/{prefix}/namespaces/{namespace}/tables/{table}`
(`IcebergTableOperations#updateTable`) always uses
the modify-table expression on the table. A commit that carries
`AssertTableDoesNotExist` (the commit
step of a staged create, used by Spark CTAS and RTAS) creates a new table,
and
`IcebergTableHookDispatcher` treats it as a create and sets the caller as
owner.
This gives two wrong results:
- A user with `CREATE_TABLE` on the schema cannot finish a CTAS. The staging
step passes, but the commit
is checked as `MODIFY_TABLE` on a table that does not exist yet and gets
403.
- A user with schema-level `MODIFY_TABLE` and no `CREATE_TABLE` can create a
table with a single commit
and becomes its owner.
The docs say creating a table needs `CREATE_TABLE`
(`docs/security/access-control.md`), and the
`createTable` endpoint already checks that.
### Error message and/or stacktrace
For the CREATE-only user, the commit returns 403 `ForbiddenException` naming
the `updateTable` operation
and the modify-table expression.
### How to reproduce
1. Enable authorization and serve an Iceberg catalog through the Iceberg
REST server.
2. User `u1` has `USE_CATALOG`, `USE_SCHEMA` and `CREATE_TABLE` on `s1`.
User `u2` has `USE_CATALOG`,
`USE_SCHEMA` and `MODIFY_TABLE` on `s1`, without `CREATE_TABLE`.
3. As `u1` in Spark: `CREATE TABLE c.s1.t1 USING iceberg AS SELECT 1 AS id`.
4. As `u2`: an update-table commit on `s1.t2` with the `assert-create`
requirement and the create updates.
Expected: step 3 succeeds and `u1` owns `t1`; step 4 returns 403.
Actual: step 3 fails at the commit with 403; step 4 creates `t2`, owned by
`u2`.
### Additional context
Proposed fix: authorize an update-table request that carries
`AssertTableDoesNotExist` with the
create-table expression on the schema, the same predicate the hook uses. A
create commit against an
existing table fails in Iceberg, so this opens no modify path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
