[SteNicholas]

Purpose

Linked issue: close #468

Paimon C++ only implemented the default and openapi DLF signers, so a REST catalog
configured with dlf.signing-algorithm=openapi-v4 failed at creation. Java Paimon signs
requests to DlfNext endpoints with this opt-in algorithm (apache/paimon#9918,
apache/paimon#9937).

Add DlfOpenApiV4Signer to sign requests to DlfNext OpenAPI endpoints with
ACS4-HMAC-SHA256, aligned with Java DLFOpenApiV4Signer. It is opt-in: only
dlf.signing-algorithm=openapi-v4 selects it, and a dlfnext endpoint without a
configured algorithm still selects openapi.

• Port Java DLFOpenApiActions as DlfOpenApiActions, which maps the method and path of
  a request to its POP action. The V4 signer signs that action in x-acs-action and
  sends it with the request; a request that matches no registered operation is signed
  without one.
• Pass the sign headers to DlfRequestSigner::Authorization by pointer so a signer can
  add headers to them. The default and openapi signers only read them.
• Spell the Host and Content-Type headers as RestApi and the openapi signer do, so
  merging them replaces a header of the same name instead of sending a second copy that
  differs only in case. The signature lowercases every header name, so it still matches
  Java.
• Share the signing key derivation between the default and V4 signers.

Tests

Unit tests in src/paimon/rest/dlf_auth_test.cpp:

• DlfOpenApiV4SignerTest:
  • MatchesJavaGoldenSignatureForEncodedQueryValues and
    MatchesJavaGoldenSignatureWithAction: match the signatures pinned by Java
    DLFOpenApiV4SignerTest, covering query value encoding, header sorting and the
    signed action.
  • SignsHeadersWithBody and OmitsBodyAndSecurityTokenHeadersWhenAbsent: the headers
    signed with and without a body.
  • SignsUtcDateInNonUtcTimezone: the date in x-acs-date and in the credential scope
    stays UTC when the local timezone is ahead of UTC by a day.
  • SignatureDependsOnRegion, SignsHeaderNamesInLowerCaseAndValuesTrimmed,
    SignsUnregisteredPathWithoutAction and RequiresSigningDate.
• DlfAuthProviderTest.SignsWithOpenApiV4OnlyWhenConfigured: only
  dlf.signing-algorithm=openapi-v4 signs with ACS4 and sends x-acs-action, including
  the STS token, and the merged request carries one Host and one Content-Type header.
• DlfOpenApiActionsTest, ported from Java DLFOpenApiActionsTest: every operation
  resolves to its own unique action, every request RestApi sends resolves to its
  action, names match whole segments and methods ignore case, and unregistered requests
  have no action.

API and Format

No public API or storage format changes. include/paimon/catalog_options.h only updates
the documentation of DLF_SIGNING_ALGORITHM. The internal DlfRequestSigner::Authorization
in src/paimon/rest/dlf_auth.h now takes the sign headers by pointer.

On the wire, a request signed with openapi-v4 carries an ACS4-HMAC-SHA256
authorization and, when it matches a registered operation, an x-acs-action header, as
the Java client sends. Requests signed with default or openapi are unchanged.

Documentation

Yes. docs/source/user_guide/catalog.rst documents openapi-v4 for
dlf.signing-algorithm and shows it in the DLF configuration example.

Generative AI tooling

Generated-by: Claude Code 2.1.310 (Claude Opus 5.5)

🤖 Generated with Claude Code

[JingsongLi]

+1