Fix view grants on federated catalogs#5096
Open
ayushtkn wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes granting/revoking privileges on views in federated (passthrough) catalogs by aligning synthetic entity post-creation validation with the caller-requested table-like subtypes, preventing correctly-created ICEBERG_VIEW leaves from being rejected.
Changes:
- Update
createSyntheticTableLikeEntitiesvalidation to accept any resolved leaf subtype included in the caller’s requestedsubTypeslist (instead of hard-codingICEBERG_TABLE). - Add a passthrough-facade regression test covering view privilege grants that require synthetic table-like entity creation.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisAdminService.java | Fixes subtype validation for synthetic table-like entities in federated catalogs to support views. |
| runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceTest.java | Adds regression coverage for granting privileges on views via passthrough facade when synthetic creation is required. |
Comments suppressed due to low confidence (1)
runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisAdminService.java:2358
- The exception message still says "table entity" even though this code path now legitimately handles views (and other table-like subtypes). This can be confusing when troubleshooting failed grants on views in federated catalogs; consider making the message subtype-agnostic (e.g., "table-like entity").
&& subTypes.contains(leafEntity.getSubType())
&& Objects.equals(leafEntity.getName(), identifier.name()))) {
throw new RuntimeException(
String.format(
"Failed to create or find table entity '%s' in federated catalog '%s'",
jbonofre
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Granting or revoking a privilege on a view in a federated (passthrough) catalog always failed with Failed to create or find table entity '' in federated catalog '', while the same operation on a table worked fine.
The cause is in
PolarisAdminService.createSyntheticTableLikeEntities: it synthesizes the entity with the caller's intendedsubtypeviaselectEntitySubType(subTypes)(which isICEBERG_VIEWfor aview), but the post-creation validation of the re-resolved leaf was hard-coded to accept onlyICEBERG_TABLE, so a correctly-created view leaf failed the check and the method threw.This changes that check to
subTypes.contains(leafEntity.getSubType()), validating against thesubtypesthe caller actually requested and consistent with how the synthetic entity was created.Checklist
CHANGELOG.md(if needed)site/content/in-dev/unreleased(if needed)