sachinnn99 opened a new pull request, #16046: URL: https://github.com/apache/iceberg/pull/16046
## Summary - When `token-exchange-enabled=false`, both `refreshToken()` and `refreshExpiredToken()` passed `ImmutableMap.of()` to `fetchToken()` instead of the stored `optionalOAuthParams` (audience, resource). This caused refreshed tokens to silently lose audience/resource scoping, leading to 401/403 errors or overly broad permissions. - Fixed by passing `optionalOAuthParams` in both non-exchange code paths (lines 193 and 566 of `OAuth2Util.java`). - Added tests for both the expired-token and current-token refresh paths verifying that audience and resource are included in the token request form data. Closes #16022 ## Test plan - [x] `./gradlew :iceberg-core:test --tests TestOAuth2Util` passes - [ ] CI passes -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
