Repository: risingwavelabs/risingwave
File: src/connector/src/sink/iceberg/mod.rs (Rust)

Code before:
        .collect();

        let iceberg_config = IcebergConfig::from_btreemap(values).unwrap();

        // Verify catalog type
        assert_eq!(iceberg_config.catalog_type(), "rest");

        // Verify Google-specific options
        assert_eq!(
            iceberg_config.common.catalog_security.as_deref(),
            Some("google")
        );
        assert_eq!(
            iceberg_config.common.gcp_credentials_path.as_deref(),
            Some("/path/to/service-account.json")
        );
        assert_eq!(
            iceberg_config.common.gcp_auth_scopes.as_deref(),
            Some(
                "https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/bigquery"
            )
        );

        // Verify warehouse path with bq:// prefix
        assert_eq!(
            iceberg_config.common.warehouse_path.as_deref(),
            Some("bq://projects/my-gcp-project")
        );

        // Verify custom header
        assert_eq!(
            iceberg_config.common.catalog_header.as_deref(),
            Some("x-goog-user-project=my-gcp-project")
        );
    }

    /// Test parsing `oauth2` security configuration.
    #[test]
    fn test_parse_oauth2_security_config() {
        let values: BTreeMap<String, String> = [
            ("connector", "iceberg"),
            ("type", "append-only"),
            ("force_append_only", "true"),
            ("catalog.name", "oauth2-catalog"),
            ("catalog.type", "rest"),
            ("catalog.uri", "https://example.com/iceberg/rest"),
            ("warehouse.path", "s3://my-bucket/warehouse"),
            ("catalog.security", "oauth2"),
            ("catalog.credential", "client_id:client_secret"),
            ("catalog.token", "bearer-token"),
            (

Review comment (security):
The test case does not verify that the Java catalog configuration is correctly generated with the GCP credentials path. While the test verifies that the configuration properties are parsed correctly, it should also verify that `build_jni_catalog_configs` produces the expected Java catalog properties, specifically that `gcp.auth.credentials-path` is set correctly when `gcp.credentials.path` is provided. Consider adding assertions to verify the generated Java catalog configuration.

Code after:
        assert_eq!(iceberg_config.catalog_type(), "rest");

        // Verify Google-specific options
        assert_eq!(
            iceberg_config.common.catalog_security.as_deref(),
            Some("google")
        );
        assert_eq!(
            iceberg_config.common.gcp_auth_scopes.as_deref(),
            Some(
                "https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/bigquery"
            )
        );

        // Verify warehouse path with bq:// prefix
        assert_eq!(
            iceberg_config.common.warehouse_path.as_deref(),
            Some("bq://projects/my-gcp-project")
        );

        // Verify custom header
        assert_eq!(
            iceberg_config.common.catalog_header.as_deref(),
            Some("x-goog-user-project=my-gcp-project")
        );
    }

    /// Test parsing `oauth2` security configuration.
    #[test]
    fn test_parse_oauth2_security_config() {
        let values: BTreeMap<String, String> = [
            ("connector", "iceberg"),
            ("type", "append-only"),
            ("force_append_only", "true"),
            ("catalog.name", "oauth2-catalog"),
            ("catalog.type", "rest"),
            ("catalog.uri", "https://example.com/iceberg/rest"),
            ("warehouse.path", "s3://my-bucket/warehouse"),
            ("catalog.security", "oauth2"),
            ("catalog.credential", "client_id:client_secret"),
            ("catalog.token", "bearer-token"),
            (
                "catalog.oauth2_server_uri",
                "https://oauth.example.com/token",
            ),
            ("catalog.scope", "read write"),
            ("database.name", "test_db"),
            ("table.name", "test_table"),
        ]
        .into_iter()
        .map(|(k, v)| (k.to_owned(), v.to_owned()))