JingsongLi opened a new pull request, #1169: URL: https://github.com/apache/paimon-rust/pull/1169
## Purpose PyPaimon already supports row-level operations on query-authorized tables when the REST server grants unrestricted access. Native mutations still rejected every table with `query-auth.enabled=true`, even with that whole-table grant. Support the same operations in Rust core without changing the public mutation APIs or adding Python binding-specific authorization logic. ## Changes - Authorize row-ID, grouped/incremental, predicate/callable, upsert, delete, shard and MERGE targets with an unrestricted whole-table grant (`select=None`). MERGE table sources keep their independent grants. - Share the private `authorize_all_files` path. Reject row filters, column masks, denied requests and grants bound to another table/schema/session before reading target rows, evaluating callbacks or staging files. Empty targets and empty row-ID input still require authorization. - Allow `_ROW_ID` only for internal mutation readers carrying the matching live whole-table grant. Public system-column read restrictions remain enforced. - Preserve live grants and deletion vectors when splitting data-evolution file groups. Physical original-column rewrites preserve all row-ID slots instead of filtering deleted rows and shifting the replacement column. The whole-table authorization scope follows the current Java query-authorization contract and PyPaimon's existing `plan_all_files` behavior. Ordinary writes continue to require no SELECT grant; publication is authorized separately by REST. ## Verification - Full core unit suite: 4272 passed, 6 ignored. - Final authorization mutation suite: 7 passed, exercising 11 mutation variants, unrestricted/denied/filtered/masked grants, empty targets, handle/session boundaries, public `_ROW_ID` rejection and deletion-vector position preservation. - Rust 1.98.0 core Clippy (`--lib --tests -- -D warnings`): passed. - Rust 1.98.0 Python binding Clippy (`--all-targets -- -D warnings`): passed. - `cargo +1.98.0 fmt --all -- --check` and `git diff --check`: passed. No Python extension was rebuilt or installed locally. The companion PyPaimon PR keeps Native CI on Rust main and will need this PR merged before its new Native integration cases can pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
