Hi @flyrain , I am interested in working on this feature :)

And I have a question about the rule for adding API endpoints: do we mainly based on the access control privileges?

For example:

• if a user with NAMESPACE_LIST privilege, add these into endpoints
  • GET /v1/{prefix}/namespaces
  • GET /v1/{prefix}/namespaces/{namespace}
  • GET /v1/{prefix}/namespaces/{namespace}/tables
  • GET /v1/{prefix}/namespaces/{namespace}/tables/{table}
• if a user with NAMESPACE_CREATE, add this into endpoints
  • POST /v1/{prefix}/namespaces
• if a user with NAMESPACE_DROP , add this into endpoints
  • `DELETE /v1/{prefix}/namespaces'

I don't believe it emits endpoints based on privileges; it should simply list all available endpoints. Even if a client lacks the privilege for a specific endpoint, they would still receive the full capabilities of the server.

I don't believe it emits endpoints based on privileges; it should simply list all available endpoints. Even if a client lacks the privilege for a specific endpoint, they would still receive the full capabilities of the server.

Thanks for the clarification! That approach makes a lot more sense, my earlier approach was overcomplicating it.

Hi @flyrain, I created a draft PR as the POC of this feature. However, I’d like your suggestion on one thing: the endpoints-related feature in Iceberg hasn’t been released yet (current version 1.6.1) and is planned for 1.7.0. I’ve temporarily extended some necessary classes as a workaround. Would you suggest we proceed with the current approach, or would it be better to pause development and continue once 1.7.0 is released and integrated with Polaris?

I'd recommend to wait for iceberg 1.7.0. It's not urgent as clients probably also wait for 1.7.