choksi2212 opened a new pull request, #1158:
URL: https://github.com/apache/paimon-rust/pull/1158
Linked issue: close #1154
### Purpose
`s3_config_parse` mirrors the Hadoop-style aliases of the access key and
secret key onto their canonical hyphenated options (`s3.access-key`,
`s3.secret-key`), but the session token was left out: the canonical
`s3.session-token` option was silently ignored and only the dotted
`s3.session.token` (or `fs.s3a.session.token`) form was read.
When both forms are present with different values -- e.g. REST-vended
credentials together with older Hadoop-style options -- the parsed config mixes
credentials from the two sets (`AK_A + SK_A + TOKEN_B` instead of a consistent
tuple), which surfaces as S3 `403 / InvalidAccessKeyId` errors.
### Brief change log
* Added `("s3.session.token", "s3.session-token")` to `KEY_ALIASES`,
completing the mirror of Java Paimon's `S3FileIO.MIRRORED_CONFIG_KEYS` (which
includes the `fs.s3a.session-token` / `fs.s3a.session.token` pair alongside the
access key and secret key pairs).
* `s3_config_parse` now reads the canonical `s3.session-token` option, with
the same precedence as `s3.access-key` / `s3.secret-key`: the hyphenated option
wins when present, and the dotted aliases (including `fs.s3a.session.token`)
keep working when it is absent.
### Tests
* `test_s3_config_parse_session_token_alias_precedence` -- regression test
adapted from the issue's reproduction (both key sets present -> `AK_A + SK_A +
TOKEN_A`). On current `main` it fails exactly as reported (`left:
Some("TOKEN_B"), right: Some("TOKEN_A")`); it passes with this change.
* `test_s3_config_parse_session_token_hadoop_alias` --
`fs.s3a.session.token` alone still parses (dotted fallback preserved).
* The existing `test_s3_config_parse_session_and_role` (dotted
`s3.session.token`) continues to pass.
Local verification against `main` @ `4a947ec` (Rust stable, per
`rust-toolchain.toml`):
```
cargo test -p paimon --no-default-features --features
storage-s3,storage-fs,storage-memory --lib
test result: ok. 4257 passed; 0 failed; 6 ignored; finished in 328.79s
```
`cargo fmt --all -- --check` is clean, and `cargo clippy` reports no
findings for the touched file.
### API and Format
No API or storage-format changes: config key parsing only. No new option is
introduced -- `s3.session-token` follows the same hyphenated naming as
`s3.access-key` / `s3.secret-key` and matches the key pair that Java Paimon
already mirrors; it simply parses now.
### Documentation
No documentation change required: the session token now behaves like the
access key and secret key, which is what the issue's expected-behavior section
describes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
