Conversation
Preserve legacy lock operations and generated client signatures while tracking cleanup lock ownership and table generation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Allow authorized table admins to create and directly unlock matching cleanup locks without an additional SYSTEM_ADMIN requirement. Keep task-one lock identity guards and legacy behavior unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep TIER3_AUTO_CLEANUP as optional lock metadata and add opt-in per-client SYSTEM_ACTION header propagation. Defer lock enforcement, guarded unlock, and owner/generation checks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Normalize omitted and null reasons while preserving unknown-request rejection. Add compatibility coverage and authenticated generated-client HTTP integration tests without changing lock enforcement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Opt the scheduler metadata client into system actions only for snapshots expiration, preserving unflagged defaults and authentication. Enable the matching catalog property only in the local SE recipe and cover CLI, HTTP header isolation, and recipe propagation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Return HTTP 423 only for cleanup lock access denials so catalog load, refresh, and tableExists retain the reason and recovery guidance. Preserve legacy and malformed 400 behavior, generic 404 handling, authorization ordering, and lifecycle controls. Cover REST reads and writes, error-body preservation, and real catalog and exception-mapping regressions across both Java and Spark runtime variants. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use SYSTEM_ONLY with SYSTEM/USER action-type declarations, and apply LEGACY defaults only to active locks. Cover serialization and client/server compatibility without changing enforcement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Preserve owner and generation guards, metadata-only status, and active-only legacy defaults while adopting SYSTEM_ONLY and action-type declarations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Merge the guarded lifecycle update, evaluate SYSTEM and USER declarations after authorization, and preserve SYSTEM_ONLY denial propagation and generic unlock guidance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Merge the generic lock enforcement update and record nullable actionType strings without validation, coercion, or authorization claims. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Merge the generic lock and audit updates. Keep the SE-only scheduler opt-in while emitting the SYSTEM action type and configuring the independent Spark catalog path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
yeilho
changed the title
Omit the header for ordinary requests and reject unsupported explicit values. Remove the unused USER constant and the requested catalog comments. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Forward-merge the updated client contract and reject explicit USER values only at the existing post-authorization SYSTEM_ONLY access check. Preserve raw declarations for auditing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Opt snapshot expiration into
SYSTEMaction declarations on both independent request paths.Changes
Keep the SE-only
--systemActionscheduler flag and emitX-OpenHouse-Action-Type: SYSTEMfor its prelaunch metadata discovery. Separately configurespark.sql.catalog.openhouse.action-type=SYSTEMfor the SE Spark catalog. Preserve unflagged defaults, client isolation, inherited Spark settings, authentication, and table-owner impersonation; leave other job types unflagged. Document both paths in the existingSETUP.md.Testing Done
34 targeted scheduler/client cases passed across both app variants.
The final-stack clean build on
91e25a8creran all 341 tasks: 2,502 tests passed, with 10 pre-existing disabled cases and no failures or errors. Both Java variants and both complete Spark integration pipelines are included.The exact CI Docker/Python CRUD integration also passed locally:
docker compose -p oh-pr726-local -f infra/recipes/docker-compose/oh-only/docker-compose.yml up -d --build, thenpython scripts/python/integration_test.py ./tables-test-fixtures/tables-test-fixtures-iceberg-1.2/src/main/resources/dummy.tokenreportedAll tests passed successfully. Both services were healthy; the test containers/network were removed afterward. Lock-specific behavior is covered by the Gradle service and generated-SDK/HTTP tests.Additional Information
Stack 4/4; depends on #739. Targets
main, so the draft includes unmerged predecessors. Review only this increment.Both declaration paths must be configured before applying
SYSTEM_ONLYlocks. Neither grants ACL permissions or bypasses legacy locks. Other maintenance-job enablement and production activation are separate.Generated with GitHub Copilot CLI.