laskoviymishka commented on code in PR #13879:
URL: https://github.com/apache/iceberg/pull/13879#discussion_r3684866387
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -1051,6 +1051,16 @@ paths:
table. The configuration key "token" is used to pass an access token
to be used as a bearer token
for table requests. Otherwise, a token may be passed using a RFC 8693
token type as a configuration
key. For example, "urn:ietf:params:oauth:token-type:jwt=<JWT-token>".
+
+
+ The response may include a read-restrictions field. A reader that
supports read
Review Comment:
Fair, it's the engine↔catalog contract, and I'm not asking the spec to
gatekeep which engines qualify more specify the preferences :)
The one thing I'd separate out: vended credentials are identity-agnostic by
design, so one identity vending all creds is a complete, coherent use of the
feature - nothing is lost.
Read-restrictions are a per-principal decision, so when the consumer only
carries a single identity, the catalog can only compute one set of restrictions
and they apply uniformly to everyone on that engine. That's still a valid
deployment (uniform masking for a low-trust engine), it just isn't the per-user
access control the name suggests, so the per-principal assumption is doing more
work here than it does for creds.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
