adutra commented on code in PR #16394:
URL: https://github.com/apache/iceberg/pull/16394#discussion_r3316979399
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2019,6 +2058,50 @@ components:
explode: false
example: "vended-credentials,remote-signing"
+ client-capabilities:
+ name: X-Iceberg-Client-Capabilities
+ in: header
+ description: >
+ This header is a forward-compatibility hint, not a security mechanism.
+ Clients can trivially spoof its value; servers MUST NOT base trust or
+ authorization decisions on it.
+
+
+ Optional signal from the client declaring the set of capabilities that
+ the client SDK supports, as a comma-separated list. This header is
+ sent on every request. The server may use this information to tailor
+ its responses.
+
+
+ Defined capability values:
+
+ - `vended-credentials`: The client supports receiving and using
+ storage credentials vended by the catalog server.
+
+ - `remote-signing`: The client supports delegating request signing
+ to a remote signing service provided by the catalog server.
+
+ - `scan-planning`: The client supports server-side scan planning.
+
+
+ Clients SHOULD include all capabilities they support. Servers MUST
+ treat this header as optional and SHALL NOT reject the request if it
is absent.
+
+
+ Client SDKs that support this header SHOULD set it statically and
+ include it on every request. Clients that do not yet support this
+ header statically MAY configure it via client side headers.
+ required: false
+ schema:
+ type: string
+ enum:
+ - vended-credentials
+ - remote-signing
+ - scan-planning
Review Comment:
This isn't defining a comma-separated list of enum constants, it's defining
a single enum constant. You should instead declare an array:
```suggestion
schema:
type: array
items:
type: string
enum:
- vended-credentials
- remote-signing
- scan-planning
style: simple
explode: false
example: "vended-credentials,remote-signing,scan-planning"
```
Which makes me realize that the `data-access` schema right above is probably
wrong since day 1 😆 I will provide a PR to fix it.
##########
core/src/main/java/org/apache/iceberg/rest/HTTPClient.java:
##########
@@ -548,6 +551,7 @@ public Builder withAuthSession(AuthSession session) {
public HTTPClient build() {
withHeader(CLIENT_VERSION_HEADER, IcebergBuild.fullVersion());
withHeader(CLIENT_GIT_COMMIT_SHORT_HEADER,
IcebergBuild.gitCommitShortId());
+ withHeader(CLIENT_CAPABILITIES_HEADER, ClientCapability.HEADER_VALUE);
Review Comment:
This header will be included in ALL requests, including those sent to the
token endpoint, FYI.
Not a big deal per se, but the PR description explicitly calls out that the
header is "excluded from /v1/oauth/tokens" – that is not accurate.
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -2019,6 +2058,50 @@ components:
explode: false
example: "vended-credentials,remote-signing"
+ client-capabilities:
+ name: X-Iceberg-Client-Capabilities
+ in: header
+ description: >
+ This header is a forward-compatibility hint, not a security mechanism.
+ Clients can trivially spoof its value; servers MUST NOT base trust or
+ authorization decisions on it.
+
+
+ Optional signal from the client declaring the set of capabilities that
+ the client SDK supports, as a comma-separated list. This header is
+ sent on every request. The server may use this information to tailor
+ its responses.
+
+
+ Defined capability values:
+
+ - `vended-credentials`: The client supports receiving and using
+ storage credentials vended by the catalog server.
+
+ - `remote-signing`: The client supports delegating request signing
+ to a remote signing service provided by the catalog server.
+
+ - `scan-planning`: The client supports server-side scan planning.
Review Comment:
+1 from me as well to versioned capabilities.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
