ump45nose opened a new pull request, #1156:
URL: https://github.com/apache/paimon-rust/pull/1156
### Purpose
Linked issue: close #1154
`s3_config_parse` reads the access key and secret key from `s3.access-key`
and `s3.secret-key` first and falls back to their dotted forms
(`s3.access.key`, `fs.s3a.access.key`, ...), but it reads the session token
only from the dotted `s3.session.token`, and never looks at `s3.session-token`.
When options carry both a hyphenated `s3.*` credential set and an `fs.s3a.*`
one, the parsed config combines the first set's key and secret with the second
set's token, and S3 rejects the request (`403 InvalidAccessKeyId`).
### Brief change log
- Read the session token from `s3.session-token`, and add `s3.session.token`
to `KEY_ALIASES` so the dotted keys (`s3.session.token`, `s3a.session.token`,
`fs.s3a.session.token`) are used only when the hyphenated key is absent, the
same precedence the access key and secret key already have. paimon-java's
`S3FileIO.MIRRORED_CONFIG_KEYS` pairs `fs.s3a.session-token` with
`fs.s3a.session.token` next to the access key and secret key pairs, so this is
the same key name.
### Tests
- `test_s3_config_parse_session_token_follows_access_key_precedence` (the
reproduction from #1154): with both credential sets present, the parsed key,
secret and token all come from the `s3.*-key` / `s3.session-token` set. It
fails on `main` with `left: Some("TOKEN_B")`, `right: Some("TOKEN_A")`.
- `test_s3_config_parse_hadoop_session_token`: `fs.s3a.session.token` alone
is still read.
- The existing `test_s3_config_parse_session_and_role` (dotted
`s3.session.token`) still passes.
### API and Format
No API or storage format change. `s3.session-token` is a newly recognized
option; configurations that set only the dotted keys behave as before.
### Documentation
None needed; the S3 options are not listed in the docs.
### AI assistance
The code, tests and this description were written with AI assistance; the
tests above were run locally. The point worth a reviewer's check is the
precedence: when both forms are set, the hyphenated `s3.session-token` now wins
over every dotted form, as `s3.access-key` and `s3.secret-key` already do in
this crate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
