markhoerth opened a new pull request, #14445: URL: https://github.com/apache/gravitino/pull/14445
### What changes were proposed in this pull request? - `IcebergNamespaceOperationExecutor.createNamespace`: with authorization enabled, refuse a namespace level that contains the schema separator with 400 before anything is created. - `IcebergNamespaceOperations.filterListNamespacesResponse`: filter the namespaces as the catalog listed them (using the generic `MetadataAuthzHelper.filterByExpression` overload) instead of rebuilding them from the Gravitino schema name, which split `["x:y"]` into `["x","y"]`. A namespace with such a level that already exists in a catalog keeps sharing its identity with the nested namespace; an administrator should rename or drop it. ### Why are the changes needed? `["x:y"]` and `["x","y"]` were governed as the same Gravitino schema, so creating one gave the creator ownership of the other and of its tables. Fixes #14444 ### Does this PR introduce _any_ user-facing change? Yes. With authorization enabled, creating a namespace whose level contains the schema separator (`:` by default) returns 400. ### How was this patch tested? - `TestIcebergNamespaceOperationExecutor#testCreateNamespaceRefusesSchemaSeparatorInLevelWithAuthorization`: refused with authorization, the nested namespace still accepted, accepted without authorization. - `TestIcebergNamespaceListFilter`: listed namespaces come back unchanged, and filtering still applies. `./gradlew :iceberg:iceberg-rest-server:test -PskipITs` 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Eu6fb9pLfmrSJzGQDVLi1g -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
