Fix namespace property updates that set a location always failing

[ayushtkn]

With ALLOW_NAMESPACE_CUSTOM_LOCATION at its default of false, every updateNamespaceProperties request carrying the base-location property is rejected with HTTP 400 — including one that restates the location the namespace already has, which is by definition not a custom location.

The error names a location that cannot exist:

Namespace ns has a custom location, which is not enabled.
Expected location: [file:///.../test-catalog/ns/ns/]
Got location:      [file:///.../test-catalog/ns/]

ns/ns/ is the namespace nested inside itself.
The check expects the namespace to check plus a resolved path whose leaf is that namespace's parent. The call in setProperties supplied neither:

• resolvedEntities is the namespace's own resolved path, so getResolvedLeafEntity() returns the namespace itself. The expected default is then computed as <namespace location>/<namespace name>, which can never equal the namespace's location — hence the doubled path and the unconditional rejection.

• entity is the pre-update entity, so the location validated is the old one rather than the one the request asks for.

• Both call sites were introduced together in Disable custom namespace locations #2422 ("Disable custom namespace locations"), and the create path in that same commit passes the parent correctly:

// createNamespace — correct
validateNamespaceUsesDefaultLocation(entity, resolvedParent);
// setProperties — neither argument is right
validateNamespaceUsesDefaultLocation(NamespaceEntity.of(entity), resolvedEntities);

Both arguments have to change together. Correcting only the parent would leave the check reading the pre-update location, which always equals the default, so a genuinely custom location in the request would never be examined — the endpoint would silently stop enforcing the flag. The test asserts both directions.

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Fixes namespace property update validation so that, when custom namespace locations are disabled, restating the existing default location is accepted while genuinely custom locations are still rejected.

Changes:

• Adjust setProperties to validate against the updated namespace entity and the resolved parent path (instead of validating the pre-update entity against itself).
• Add a regression test covering both “restate default location” (allowed) and “different location” (rejected) behaviors.
• Document the fix in CHANGELOG.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergAllowedLocationTest.java	Adds a regression test ensuring default-location restatement is accepted and custom locations are rejected.
runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/LocalIcebergCatalog.java	Fixes validation inputs by using the updated entity and resolved parent path.
CHANGELOG.md	Documents the behavior change and the previous failure mode.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[flyingImer]

nice!

[dimas-b]

Nice catch! Thanks, @ayushtkn !

[flyrain]

Nice fix! Thanks @ayushtkn !

[flyrain]

nit: can we have a more human readable version? :-)