[viethqb]

Summary

egret's embedded Iceberg REST catalog authorizes each request against catalog.catalog_grants in a guard in front of Lakekeeper. Several write routes were authorized by their path alone, or as catalog-root operations, without reading the body that names the tables they change. As a result, a role with any write grant in a warehouse could:

• rename a table it cannot read onto a name it holds a grant on, and then read it (measured: rename 204, then read 200);
• commit to any table through transactions/commit (measured: a property set on a table the role could not write);
• commit to a table other than the one in the path through a single-table commit, because of Lakekeeper's "Spark branch" identifier fallback (measured: 200);
• reach a differently-cased table: grants were compared byte for byte, while Lakekeeper compares names case-insensitively, so a grant on sales.Secret reached sales.secret;
• drop child namespaces it holds no grant on with a recursive namespace drop (measured: corp.fin.ledger deleted with a grant on corp only).

This PR makes the guard read those bodies and decide on the tables they actually change.

Spec: docs/en/specs/2026-10-27-catalog-rename-authorizes-source-design.md (D1–D14, related defects in §7, live check and gate recorded).

No migration. No API shape change.

Changes (egret-bin guard, egret-catalog-engine mount)

• Rename (tables/rename, views/rename). The source needs what a drop needs: a write or manage grant covering the source table. The destination needs what a create needs: a catalog grant, or a namespace grant on the destination namespace. A table grant on the destination name is not enough.
• Multi-table commit (transactions/commit). Every table in table-changes needs what a single-table update needs. One uncovered table refuses the whole commit, which matches Lakekeeper's all-or-nothing commit.
• Single-table commit (POST …/tables/{t}). The guard authorizes the table Lakekeeper will actually commit to: the body's identifier if present, otherwise the path's table (D11). Spark branch commits keep working. View commits load by path and are pinned by a test.
• Name matching (D12). The guard compares names with Lakekeeper's own case-insensitive ICU collation, through Postgres, and only for pairs that are not already byte-equal. Path segments are decoded the way Lakekeeper decodes them. No Unicode normal form plus case fold reproduces that collation: NFKC plus casefold would fail open on ß/ss, and NFC misses width forms and invisible characters.
• Recursive namespace drop (D13) needs a catalog-level write or manage grant.
• Signer routes (D14). Every signer route is refused with 403 ("remote signing is not used by egret"). The storage profile also keeps remote signing off, and tests pin that, because this flag is the only protection Lakekeeper offers there.
• Buffering.
  • The guard authenticates first and only then buffers the body of these routes (rename 1 MiB, commits 16 MiB).
  • It re-injects the exact bytes for the view hold, the fix(catalog): classifications follow a renamed table or column #757 table hook and Lakekeeper.
  • A declared Content-Length over the cap gets 413 without reading the body; a streamed body that crosses the cap also gets 413.
  • Every other request streams through unread.
• Errors. Every refusal from the guard or the mount uses Iceberg's JSON error model ({"error":{"message","type","code"}}), so clients such as pyiceberg raise a typed error.
• Messages. A refusal names the side that failed and echoes only names the caller sent, so it does not reveal whether a table exists.

Decisions

The user decided (2026-10-27) to fix F-A as its own PR, ahead of the KI-308/309 package, and to close the whole class of guard holes found on the way here. Controller defaults D1–D14 are in the spec, each with its reason.

Test plan

Full local gate on 167cf529 (the last commit, a381fc1b, is docs only), against the real test DB with no DB skips:

check	result
cargo fmt --check, clippy over the workspace with -D warnings, just test-shipping-resolution	pass
just test-ranger-gates	pass
cargo test --workspace --no-fail-fast	pass, 0 DB skips, except: sql_starrocks_live (7 tests) needs a live StarRocks, as on earlier PRs; and one known table_hook_db timing test (the 5 s plugin wait) failed under a load average of 20–36 and passed 3/3 alone
Frontend gen:api	no diff
Lint, tsc -b, build, all 10 test:bundle*	pass
vitest	8496/8500 under load; the 4 failing files pass when rerun alone. This PR changes no frontend file

New tests are in crates/egret-bin/src/catalog_guard_body_tests.rs, run through mount_catalog_engine: the real guard, the view hold and the table hook, in front of Lakekeeper's real router.

• Red first: every refusal test was seen failing on the code before its fix.
• Mutation: the new branches were mutation-checked, 20 mutants in total, all killed.
• Agreement test: the_guard_decides_names_the_way_lakekeeper_resolves_them. The guard allows exactly when Lakekeeper's router finds the table.
• Pins:
  • a Trino-shaped commit body passes;
  • a Spark branch commit is authorized by the table it commits to;
  • an unauthenticated body is not read: 0 bytes are pulled from the stream.

Live check

Ran twice on an own stack, not the shared demo stack, with a Trino 483 engine provisioned by egret, curl and pyiceberg 0.12. The second run was on the final code.

• Trino keeps working.

  • CREATE, INSERT, UPDATE, DELETE, ADD/RENAME COLUMN, table and view rename, CTAS, DROP TABLE and DROP VIEW all succeeded.
  • Trino sends only per-table commits, with no identifier in the body; it never sends transactions/commit.
  • A commit took 84–164 ms, about the same as before.

• A restricted catalog client:

  • a rename of an unreadable table gets 403, and the table is unchanged;
  • a rename into a name it holds only a table grant on gets 403;
  • a multi-table commit touching an unwritable table gets 403, and nothing is committed;
  • a single-table commit whose body names another table gets 403;
  • with a grant on sales.Secret, secret, SECRET and se%63ret pass, and an ungranted table gets 403;
  • a recursive drop with a namespace grant gets 403, and nothing is dropped;
  • the signer gets 403;
  • malformed bodies get 400;
  • authorized renames and commits succeed.

  pyiceberg raises a clean ForbiddenError.

• Unauthenticated oversized request: 401 in 3–7 ms. An authenticated one over the cap gets 413 in 5–12 ms, without reading the body.

• fix(catalog): classifications follow a renamed table or column #757: a classified table and a classified column renamed through Trino still move their classification.

Follow-ups (not in this PR)

• F4, HIGH, its own package next: a read-only grant can obtain vended S3 credentials that write and delete. Lakekeeper picks the credential scope from its authorizer, and in egret that is AllowAllAuthorizer.
• Low-severity guard gaps:
  • creating a namespace and listing namespaces are allowed for any write grant;
  • no body-read timeout: a client that declares a body and sends nothing holds the connection (memory stays capped).
• /config advertises its uri without the port behind the edge on a non-default port, which breaks pyiceberg there (likely X-Forwarded-Host; not confirmed).
• Then: the KI-308/309 package (grants, rules and catalog grants follow a table rename). Its spec and plan are written.

Documentation

Platform docs (egret-data/docs) follow in a separate docs PR: what a rename, a commit and a recursive drop require, and the case-insensitive grant matching.

Checklist

• Linked to an issue
• Tests added or updated (or not applicable)
• Docs updated in egret-data/docs for any user-visible feature, UI, API or config change (separate PR after merge)
• Commit messages follow Conventional Commits
• No secrets, tokens or real data added

🤖 Generated with Claude Code