[OIiveirra]

What problem does this PR solve?

Issue Number: N/A (no public GitHub issue)

Problem Summary:

The retained LakeSoul scanner logs complete scanner parameters at INFO, including object storage credentials carried in options. The FE scan node also logs complete catalog properties at DEBUG.

Log only the query ID and batch size when opening the scanner, and remove the catalog-property dump. Authentication options continue to reach the reader unchanged.

Add focused regression tests and an explicit lakesoul-scanner-tests Maven profile so the deprecated scanner can be tested while remaining excluded from default builds.

Release note

Prevent sensitive LakeSoul scanner parameters and catalog properties from being written to logs.

Check List (For Author)

• Test

  • Regression test
  • Unit Test
  • Manual test (add detailed scripts or steps below)
  • No need to test or manual test. Explain why:

  Validation on JDK 17:

  • LakeSoulJniScannerTest: 3 tests passed, covering INFO, DEBUG, and a missing query ID; credentials still reach the native reader.
  • LakeSoulScanNodeTest: 1 test passed, verifying credentials stay in scan options and out of DEBUG logs.
  • Restoring the original production logging makes all 4 tests fail on credential-leak assertions; restoring the fix makes all 4 pass.
  • Targeted Checkstyle: 0 violations. git diff --check passed.

  Native I/O is isolated with Mockito. No live LakeSoul SQL scan was run.

• Behavior changed:

  • No.
  • Yes. Scanner startup logs contain the query ID and batch size instead of the full parameters; FE no longer logs complete catalog properties.

• Does this need documentation?

  • No.
  • Yes.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[OIiveirra]

run buildall

[linrrzqqq]

/review

[github-actions]

Reviewed all seven changed files and the related FE -> Thrift options -> BE/JNI -> native-reader flow at b75a4de. No actionable new finding was identified. The scanner startup log now selects query ID and batch size, the FE catalog-property dump is removed, and authentication option forwarding is preserved.

The review converged after one round: both complete-scope reviewers and the separate test/runtime risk reviewer returned NO_NEW_VALUABLE_FINDINGS on the unchanged empty finding set. All candidate and risk questions were dismissed with evidence; no unresolved candidate or uncovered changed path remains. There were no existing inline findings to carry forward and no additional user-provided focus.

Critical-checkpoint conclusions:

1. Goal and tests: the two credential-bearing map dumps are addressed. The three new scanner cases and one FE case check log suppression and preserved options at source level.
2. Scope: the two production logging changes and their test/profile support are focused.
3. Concurrency and locking: no new production thread, shared mutation, lock or lock-order dependency. Tests restore logger state in finally.
4. Lifecycle and initialization: production native/Arrow ownership and cleanup are unchanged. Mock/appender cleanup and the mocked native-construction boundary were checked statically, including exact-version dependency source.
5. Configuration: no runtime setting is added. The lakesoul-scanner-tests Maven profile is explicitly opt-in and preserves the normal module exclusion.
6. Compatibility: no production signature, storage format or options serialization change requires rolling-upgrade handling.
7. Shared definitions: no Thrift/protobuf definition changes; field-ID comparison is not applicable.
8. Parallel paths: both FE and scanner logging sites and related range/predicate/native transport paths were inspected; no additional issue introduced by this patch was found.
9. Conditions: production option/read-mode/null gates are unchanged. The scanner test includes missing query_id.
10. Coverage: tests inspect INFO/DEBUG logging, unknown future parameters, signed-path tokens in scanner params, credential propagation and unchanged input maps. Native IO is mocked; no live SQL/integration coverage is claimed.
11. Expected results: no regression output file changes. The new assertions match the inspected logging and option-mapping behavior; author-reported test passes were not rerun by this review.
12. Observability: query ID and batch size retain scanner correlation context. This focused logging fix needs no new metric.
13. Transactions and persistence: no commit/visibility, EditLog, replay or failover behavior changes.
14. Writes and crash behavior: no data mutation, atomicity, resource-ownership or crash-recovery behavior changes.
15. FE/BE variables: wire values and credential propagation are unchanged; query_id was already supplied by the BE runtime.
16. Performance: removal of whole-map formatting reduces logging work; no new production loop, allocation pattern or heavy locked operation was introduced.
17. Other concerns: logger identity/capture, native mocking, fresh-range population order, test dependency/discovery and default-versus-opt-in packaging were checked without finding a substantiated regression.

Validation limit: this was a static-only review. No builds, tests, native execution or end-to-end SQL scans were run, and repository source files were not modified. Review convergence does not assert runtime validation.

Review converged after 1 round(s).

[hello-stephen]

FE Regression Coverage Report

Increment line coverage 100% (0/0) 🎉
Increment coverage report
Complete coverage report