Skip to content

[CU-86bcf3q9q] Look up a table's data model in the request's tenant - #180

Merged
jstromsky merged 2 commits into
mainfrom
Tenant-scoped-data-model-lookup-CU-86bcf3q9q
Oct 9, 2026
Merged

jstromsky merged 2 commits into
mainfrom
Tenant-scoped-data-model-lookup-CU-86bcf3q9q

Conversation

@jstromsky

Copy link
Copy Markdown
Contributor

What changed

data-connect-trino now looks up a table's stored data model in the tenant of the request.

  • A request in a non-management tenant calls GET /tenants/{tenantId}/collection/{schema}/item/{table} on collection-service. It uses a token for that tenant (TokenTenantPolicy.tenantFromRequestPath()).
  • A request in the management tenant keeps the old path and the management token. This keeps it working against a collection-service that does not serve /tenants/{tenantId}/... yet (see collection-service PR #583).
  • DataModelSupplier.supply now takes the TenantId as its first parameter. TrinoDataConnectAdapter passes the tenant of the request. The indexing-service and tables-registry suppliers ignore it, as before.
  • If no token can be obtained for the tenant, the lookup returns no data model and the service falls back to Trino. Before this change, the error reached the caller.

Why

Before this change, every lookup ran as the management tenant. A tenant could receive a data model that is stored in the management tenant.

What this does not change

In production, collection-service refuses this lookup today. It answers 403 insufficient_scope, because the endpoint requires the collection:read permission and data-connect-trino only holds collection_item:read. So every caller already gets the Trino fallback. This PR does not add the permission. The lookup was found in the production logs only 6 times since 1 January 2026. Callers will see no difference after this PR. The routing is now correct if the permission is added later.

How it was tested

  • New unit tests in CollectionServiceDataModelSupplierTest: a tenant uses the tenant path, management uses the old path, other catalogs are skipped, and a failed token request falls back.
  • Mutation check: routing every lookup to one client makes the tests fail. Removing the new catch makes the token test fail.
  • All 147 unit tests pass, including TenancyArchitectureTest.

🤖 Generated with Claude Code

jstromsky and others added 2 commits October 8, 2026 17:39
A tenant's table info looked up the stored data model in collection-service
as the management tenant. Requests from a non-management tenant now call
/tenants/{tenantId}/collection/... with a token for that tenant. Requests
from the management tenant keep the old path and token.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A failed token request for a tenant threw out of the data model lookup and
returned an error to the caller. It now falls back to Trino, like a failed
call to collection-service does.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@jstromsky
jstromsky merged commit 2c0f031 into main Oct 9, 2026
@jstromsky
jstromsky deleted the Tenant-scoped-data-model-lookup-CU-86bcf3q9q branch October 9, 2026 07:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants