feat(rest): load table credentials from the LoadCredentials endpoint - #899
Draft
plusplusjiajia wants to merge 3 commits into
Draft
plusplusjiajia wants to merge 3 commits into
plusplusjiajia wants to merge 3 commits into
Conversation
plusplusjiajia
force-pushed
the
feat-rest-load-credentials
branch
from
August 24, 2026 10:40
e65abbc to
eedf884
Compare
plusplusjiajia
force-pushed
the
feat-rest-load-credentials
branch
2 times, most recently
from
September 15, 2026 06:37
0435ab7 to
7ccee12
Compare
…ss installs ResolvingFileIO::FileIOForPath held its mutex across FileIORegistry::Load and the delegate's SetStorageCredentials, so building the first S3 client (which can look up a bucket region) stalled every other operation on the resolver. It now loads without the lock and caches the result only if no credential install happened meanwhile; otherwise it loads again with the new credentials. Delegates retired by an install are torn down outside the lock. Tests now exercise real IO where the old ones stopped short: the multi-prefix DeleteFiles test failed URI parsing before reaching any delegate, and the concurrency test only built input-file wrappers. The replacements write, delete and read through the test object store, and the stress test waits for every worker to run before installing.
plusplusjiajia
force-pushed
the
feat-rest-load-credentials
branch
from
September 26, 2026 05:53
7ccee12 to
c4ddad8
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #898 — until that merges, this PR's diff includes it; the commit to review is the last one.
Adds the plumbing for replacing vended storage credentials, deliberately without any policy:
StorageCredentialRefresher(a callback returning the vended list) and a default-no-opSetCredentialRefresherhook onSupportsStorageCredentials.LoadCredentialsResponseand its parsing.storage-credentialsis required here per the REST spec, unlike LoadTable where it stays optional: reading a malformed response as "no credentials" would look like a refresh that succeeded and dropped them. Parse errors deliberately do not carry the response body — it containsthe credentials themselves.
RestCatalog::MakeCredentialRefresherbuilds the callback from the LoadCredentials endpoint with the table session, capturing the catalog so the session's owner outlives copied FileIOs. Both paths that cannot build one say so in the log, since the consequence only surfaces much later as credentials expiring mid-job.ResolvingFileIOforwards an installed refresher to resolved delegates, rebuilding cached ones on a late install; retired delegates and the outgoing callback destruct outside the lock, per the discipline refactor(io): hand out S3 delegates by shared_ptr and build them off the lock #898 establishes.Nothing invokes the refresher yet; the policy that does arrives in the final PR of this series (#892).
MakeCredentialRefresheritself has no unit test —HttpClientis concrete, with no seam to fake. It was verified end-to-end against a live credential-vending catalog: endpoint advertised, GET succeeding, response parsing, and IO continuing on the replacements.