yashmayya opened a new pull request, #19418:
URL: https://github.com/apache/pinot/pull/19418
When row-level-security filters are present,
`ServerPlanRequestUtils.compileLeafStage` replaces the whole query-options
map on the `PinotQuery`:
```java
if (MapUtils.isNotEmpty(rowFilters)) {
pinotQuery.setQueryOptions(rowFilters);
}
```
By that point `ServerPlanRequestVisitor.visitAggregate` has already written
`serverReturnFinalResult` or
`serverReturnFinalResultKeyUnpartitioned` into those options. Those two
flags live only on the `PinotQuery` —
`updateQueryOptions` later merges in the op-chain metadata, which restores
the broker-supplied options but not these.
So on an RLS-protected table both flags are silently dropped.
Neither hint leaves an aggregate stage above the leaf that could finalize
anything, so the leaf emits raw
intermediates into columns typed for final values. A `DISTINCTCOUNT` under
`is_partitioned_by_group_by_keys` on an
RLS-filtered table fails with:
```
class it.unimi.dsi.fastutil.ints.IntOpenHashSet cannot be cast to class
java.lang.Number
```
`is_leaf_return_final_result` fails the same way. Aggregates whose
intermediate and final types coincide (`SUM`,
`COUNT`) are unaffected, which is why this went unnoticed.
## Fix
Merge the row filters into the existing options instead of replacing them.
RLS keys are prefixed with
`CommonConstants.RLS_FILTERS`, so they cannot collide with anything already
there. The `null` branch copies the map
rather than aliasing it, since `updateQueryOptions` mutates it and it
belongs to the caller.
## Testing
New regression test in `QueryRunnerTest`, verified to fail before the fix
and pass after. `QueryRunnerTestBase` gains
an overload for passing request metadata the broker stamps outside the SQL
text — `SET rlsFilters-b=...` is not a
route, since the key does not parse and is rejected outright in REJECT
validation mode.
`pinot-query-runtime` (4593 tests) and `RowLevelSecurityIntegrationTest`
both pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
