Revanth14 commented on code in PR #2163:
URL: https://github.com/apache/iceberg-go/pull/2163#discussion_r4238805406
##########
catalog/rest/vended_creds.go:
##########
@@ -432,14 +432,26 @@ func (p *prefixScopedIO) propertiesForLocation(name
string) iceberg.Properties {
props := make(iceberg.Properties, len(p.baseProps))
maps.Copy(props, p.baseProps)
if credentialIndex >= 0 {
- credentialConfig := p.credentials[credentialIndex].Config
- clearOverriddenCredentialProperties(props, credentialConfig)
- maps.Copy(props, credentialConfig)
+ mergeVendedCredentials(props,
p.credentials[credentialIndex].Config)
}
return props
}
+// mergeVendedCredentials applies a matched storage credential over config,
+// first dropping any inherited property that the credential is meant to
+// replace. Every site that merges vended credentials must go through here:
+// merging with maps.Copy alone leaves stale higher-precedence credentials in
+// place, which then shadow the freshly vended ones.
+func mergeVendedCredentials(config, credentialConfig iceberg.Properties) {
Review Comment:
Done. Both sides now share `internal/adlsauth`, and
`TestClearTokenShadowingCredentialsSelectsToken` pins it by running the cleared
props through the real Azure factory and asserting the `Bearer` header. The
presence vs nonempty note is on `mergeVendedCredentials`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
