[#12560] feat(lance): Add table read and list authorization for Lance REST - #12694
Merged
Merged
Conversation
Code Coverage Report
Files
|
yuqi1129
force-pushed
the
feat/12560-lance-table-read-authz
branch
from
August 30, 2026 12:28
a58ab7b to
eb31a03
Compare
… Lance REST Authorize describe-table and table-exists, and filter list-table results before the page is cut so pagination stays consistent with what the caller may see. A Lance identifier carries its depth rather than its kind, so the interceptor now resolves a three-level identifier to a table and every table expression is guarded on the addressed entity type: an identifier of the wrong depth matches no branch and is denied instead of being authorized against another entity. The accepted depth is bounded per resource rather than globally, because a namespace operation stops at a schema: a table identifier sent to one is not a namespace at all, so it is rejected before any expression sees it. Bounding it globally would have let CAN_ACCESS_METADATA, which expands to a branch per entity type, authorize such a request against the table it names. Table-exists additionally accepts PROBE_TABLE_LIKE, the privilege that means exactly this, and CREATE_TABLE, because clients probe for a table immediately before creating it. The endpoint answers with an empty 200 or a 404, so existence is the only thing either privilege reveals. Describe stays restricted to read privileges, so a probe never exposes table properties. Claude-Session: https://claude.ai/code/session_01EPJduJLZAREBg1bKxybe1e
yuqi1129
force-pushed
the
feat/12560-lance-table-read-authz
branch
from
August 30, 2026 12:31
eb31a03 to
6a9ce71
Compare
yuqi1129
marked this pull request as ready for review
August 30, 2026 12:32
Contributor
Author
|
@roryqi |
roryqi
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Authorizes the read-only Lance REST table operations.
describe-tablerequires the standard load-table privileges.table-existsadditionally acceptsCREATE_TABLE, because clients probe for a table immediately before creating it;describe-tabledeliberately does not, so a probe privilege never exposes a table's schema, properties, or storage options.list-tablesis authorized on the addressed schema, and the tables the caller may not see are removed before the page is cut, so pagination stays consistent with what the caller is allowed to see. This adds afilterTableshook toLanceMetadataFilter, implemented againstFILTER_TABLE_AUTHORIZATION_EXPRESSION— which carries the parent-scope short-circuit and deny precedence used by the rest of Gravitino.Credential vending stays out of scope.
Fix: #12560
Why are the changes needed?
The Lance REST table surface was still unauthorized after #12558 and #12559 covered the namespace surface.
Does this PR introduce any user-facing change?
Yes. With authorization enabled,
describe-tableandtable-existsare now authorized and return 403 when denied, andlist-tablesreturns only the tables the caller may see. A table the caller may not read is reported as forbidden whether or not it exists, so the endpoints cannot be used to probe for existence.How was this patch tested?
TestLanceMetadataAuthorizationMethodInterceptor: new tests forSELECT_TABLE/MODIFY_TABLEreads, theCREATE_TABLEprobe that must not read, deny precedence, and identifiers of the wrong depth.TestGravitinoLanceNamespaceListFiltering: a new test proving tables are filtered before pagination, using a hidden table that sorts first.LanceTableAuthorizationIT: four tests covering table read privileges, the probe-but-not-read distinction, indistinguishable inaccessible and missing tables, and filtered pagination../gradlew :lance:lance-rest-server:build :lance:lance-common:build— 180 tests, all passing.