yuqi1129 opened a new pull request, #14639: URL: https://github.com/apache/gravitino/pull/14639
### What changes were proposed in this pull request? - Require both USE_SECRETS and INCLUDE_CREDENTIAL_SECRETS (or metalake ownership), in addition to metadata access, for catalog-level credential vending. Leave fileset path authorization unchanged. - Reject JDBC URLs containing credential parameters or inline user information, including encoded parameter names. Mask legacy credential-bearing URLs on the property read path; log class-loader property names without values. - Return a client error for unsupported credential object types, preserve the requested object name, and map credential refusals to 403. ### Why are the changes needed? Catalog-level credentials are authorized as metadata reads, so a principal with USE_CATALOG can recover the source account's password and bypass table-level grants. JDBC URL passwords bypass key-based property masking and appear in catalog responses and class-loader diagnostics. Unsupported credential object types also return an internal error instead of a client error. Fixes #14638 ### Does this PR introduce _any_ user-facing change? Catalog credential users must receive the explicit secret privileges. The returned credentials still carry the entire source account's permissions. Existing catalog configurations with URL credentials must be migrated to credential properties/secret references; loading or using them can fail until migration. URL masking is defensive protection for legacy properties that reach the read path. No new privilege, dependency, or store migration is introduced. ### How was this patch tested? 225 cases passed with zero failures/errors/skips: common URL validation (53), JDBC common module tests with Docker enabled (134), core masking/class-loader tests (33), and REST credential operations (5). Tests cover both required privilege checks, fileset compatibility, encoded/native URL forms, value-free errors/logs, legacy URL masking, and unsupported object errors. Scoped Spotless and git diff checks passed. No deployed multi-user engine/server end-to-end test was run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
