Validate segment upload destinations

[xiangfu0]

Summary

• Establish and canonicalize the final segment destination before controller storage or metadata handling.
• Authorize the exact destination table for every v1 upload variant and reject inconsistent request, header, or segment metadata table names.
• Preserve v2 request-table promotion behavior while binding database headers and batch uploads to their authorized destinations.
• Return clear client errors for missing, blank, invalid, or mismatched table inputs.

Root cause

The upload handlers did not share a canonical destination-binding step across request inputs and segment metadata. In v1, authorization could therefore complete before the final table destination was established.

Impact

Upload and refresh authorization now targets the same table used by all subsequent controller operations, independently of the configured access-control implementation. Existing valid v2 promotion behavior remains supported.

How to reproduce

Run the added PinotSegmentUploadAuthorizationTest. It configures permissive cluster-level create access with table-scoped authorization and exercises v1, v2, batch, upload, and refresh destination handling.

Validation

• FineGrainedAuthUtilsTest
• PinotSegmentUploadDownloadRestletResourceTest
• PinotSegmentUploadAuthorizationTest
• Spotless, Checkstyle, and license checks for pinot-core and pinot-controller
• JDK 25 warning-enabled test compilation for both affected modules

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (cb89c0e) to head (6965a73).

Additional details and impacted files

@@              Coverage Diff               @@
##             master    #19231       +/-   ##
==============================================
+ Coverage     66.97%   100.00%   +33.02%     
+ Complexity     1417         6     -1411     
==============================================
  Files          3453         3     -3450     
  Lines        218858         6   -218852     
  Branches      34787         0    -34787     
==============================================
- Hits         146591         6   -146585     
+ Misses        60556         0    -60556     
+ Partials      11711         0    -11711     

Flag	Coverage Δ
integration	100.00% <ø> (+100.00%)	⬆️
integration1	100.00% <ø> (?)
integration2	?
java-25	100.00% <ø> (+33.02%)	⬆️
lane-a	100.00% <ø> (+100.00%)	⬆️
lane-b	0.00% <ø> (ø)
temurin	100.00% <ø> (+33.02%)	⬆️
unittests	?
unittests1	?
unittests2	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.