feat(rest): request storage access delegation via header#12
Open
smaheshwar-pltr wants to merge 3 commits into
Open
feat(rest): request storage access delegation via header#12smaheshwar-pltr wants to merge 3 commits into
smaheshwar-pltr wants to merge 3 commits into
Conversation
smaheshwar-pltr
commented
Jun 27, 2026
| /// request, asking the server to delegate storage access for loaded tables | ||
| /// (use "vended-credentials" to request vended storage credentials). Unset by | ||
| /// default; an explicit "header." override of the same header takes precedence. | ||
| inline static Entry<std::string> kAccessDelegation{"access-delegation", ""}; |
Owner
Author
There was a problem hiding this comment.
I'm confused by this. I'd have thought this PR would just involved setting vended-credentials everywhere. Especially because, like PyIceberg and iceberg-rust, that's the only delegation mode iceberg-cpp even supports. What's the reason for this stuff I'm seeing here?
smaheshwar-pltr
force-pushed
the
rest-access-delegation-header
branch
from
June 27, 2026 23:03
8135a67 to
d100f3b
Compare
Send "X-Iceberg-Access-Delegation: vended-credentials" on every REST request by default, matching PyIceberg (session.headers.setdefault) and the only delegation mode iceberg-cpp supports. emplace() preserves an explicit "header.X-Iceberg-Access-Delegation" override. Without requesting delegation, a spec-compliant REST server will not vend storage credentials. Adds ExtractHeaders unit tests for the default header, header.* prefix stripping, and the explicit override. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
smaheshwar-pltr
force-pushed
the
rest-access-delegation-header
branch
from
June 27, 2026 23:20
d100f3b to
0f83157
Compare
smaheshwar-pltr
commented
Jun 27, 2026
| return StringUtils::ToUpper(header.first) == canonical; | ||
| }); | ||
| if (!set_by_caller) { | ||
| headers.emplace(kHeaderAccessDelegation, kAccessDelegationVendedCredentials); |
Owner
Author
There was a problem hiding this comment.
Sending this by default mirrors PyIceberg, which sets the access-delegation header on the session for every request and only ever uses vended-credentials:
- https://github.com/apache/iceberg-python/blob/01a86f987d1924ca3246a2b985b78890ec0c0fbd/pyiceberg/catalog/rest/__init__.py#L881
- https://github.com/apache/iceberg-python/blob/01a86f987d1924ca3246a2b985b78890ec0c0fbd/pyiceberg/catalog/rest/__init__.py#L235
The Java REST client does not send this header; engines like Trino set it via a header.* catalog property.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Send
X-Iceberg-Access-Delegation: vended-credentialson every REST request by default. An explicitheader.X-Iceberg-Access-Delegation(matched case-insensitively) overrides it.Why
The REST catalog already applies vended storage credentials returned in load responses, but never requests them. Per the spec a compliant server only delegates storage access when the client asks via this header, so the credential-vending path is otherwise never exercised.
This matches PyIceberg, which sets the header on the session for every request and only ever uses
vended-credentials(the sole delegation mode this client supports):Notes
header.*property.)Tests
ExtractHeaders: header sent by default,header.*prefix stripping, and explicit override (case-sensitive and case-insensitive).