### What problem does this PR solve?

Issue Number: None

Related PR: apache#67470

Problem Summary: Iceberg metadata system-table tasks serialize their FileIO implementation. The BE metadata scanner used the default ObjectInputStream resolver, which ignored the scanner classloader and failed to deserialize Azure ADLSFileIO even when the Azure dependencies were packaged. Add the Iceberg Azure runtime closure to both FE and BE Iceberg artifacts, use the JDK Azure HTTP transport to avoid Doris Netty incompatibility, and resolve serialized classes with the scanner classloader.

### Release note

Azure Iceberg metadata scans can load vended ADLSFileIO credentials; native BE data-file reads remain on the Azure object client.

### Check List (For Author)

- Test: Targeted Maven unit tests for FE connector and BE metadata scanner; manual Databricks Azure SAS scan including dollar-files and dollar-position-deletes
- Behavior changed: Yes (Azure Iceberg metadata classpath and deserialization)
- Does this need documentation: No

### What problem does this PR solve?\n\nIssue Number: N/A\n\nRelated PR: apache#67470\n\nProblem Summary: Record the verified Iceberg Azure native-client data-file capabilities separately from historical Hadoop ABFS evidence, including the tested SAS scan and DML path and explicit SharedKey and OAuth2 boundaries.\n\n### Release note\n\nNone\n\n### Check List (For Author)\n\n- Test: Manual Databricks Azure E2E with compiled FE/BE; documentation and diff checks\n- Behavior changed: No\n- Does this need documentation: Yes (this document)

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Normalize the PR apache#67470 Azure routing overview into copy-ready Markdown. The document now leads with verified conclusions and uses consistent headings, punctuation, code formatting, tables, and lists while preserving the technical details and validation gaps.

### Release note

None

### Check List (For Author)

- Test: No need to test (documentation-only formatting change)

- Behavior changed: No

- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Azure provider inputs accepted SharedKey, SAS, and OAuth2 spellings through independent string predicates. The backend map emitted SHARED_KEY while the property binder did not accept that canonical value on a round trip, and native client dispatch implicitly treated every non-SharedKey/non-SAS value as OAuth2. Add a provider-owned AzureAuthType parser, make validation and output exhaustive, and preserve the existing Hadoop/OneLake configuration view and native credential keys. Unknown explicit values now fail without falling back to another credential type.

### Release note

None

### Check List (For Author)

- Test: Checkstyle validate and git diff --check; FE UT source added but not run pending user compilation
- Behavior changed: Yes (canonical Azure auth values now round-trip and unknown explicit values are rejected)
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Azure endpoint and SAS normalization were duplicated across provider properties and Java client paths. Add provider-owned AzureAccountHost and AzureSasToken models, preserve Azure cloud suffixes, normalize only SAS transport prefixes, reconcile explicit/token expiry using the earliest known time, and route existing outputs through these models without changing the FE-to-BE key contract or OneLake Hadoop path.

### Release note

None

### Check List (For Author)

- Test: Checkstyle validate and git diff --check; FE UT source added but not run pending user compilation
- Behavior changed: Yes (DFS endpoints are normalized to Blob endpoints for native Blob client; malformed/expired known SAS expiry is rejected)
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Azure SAS expiry was evaluated while binding properties, which made a short-lived credential unusable even when the bound object was only being inspected or reused later. Defer time-dependent checks to backend/Hadoop credential output and native Azure client creation, allow tests to inject a Clock, and reject conflicting SharedKey, SAS, and OAuth2 material instead of inferring an ambiguous mode.

### Release note

None

### Check List (For Author)

- Test: Checkstyle validate and git diff --check; FE UT source added but not run pending user compilation
- Behavior changed: Yes (expiry is enforced at credential use points; ambiguous credential combinations are rejected)
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: The new Azure host model omitted the separator after the account name and discarded transport settings while converting DFS endpoints. SAS properties computed an effective expiry but still exported the raw explicit timestamp, and cached Java clients bypassed expiry validation. Correct host rendering, retain the explicit scheme, port and encoded path, export the earliest known expiry and check cached client access with an injectable clock. Reject malformed or ambiguous expiry without exposing credential input in exception causes. Add unit-test coverage and correct the SharedKey fixture to include its required account name.

### Release note

Preserve Azure endpoint transport settings and reject known expired SAS credentials when retrieving a cached FE Azure client.

### Check List (For Author)

- Test: Maven Checkstyle validate (7 modules, 0 violations) and git diff --check; unit tests added but not run, with compilation and UT execution handed to the user
- Behavior changed: Yes (correct host rendering and effective expiry export; cached FE client expiry checks; malformed SAS expiry rejection)
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: StorageAdapter converts backend properties once and returns cached copies on later calls. Azure SAS expiry checks in the provider converter therefore do not protect cached backend configurations. Add a provider-owned local access-validation hook and invoke it before every backend-map access. Azure reuses its typed SAS expiry validation, while other providers retain the default no-op behavior and existing caches. Keep binding/replay validation separate from credential lifetime checks. Add contract tests for cache hits, error propagation, copy isolation, and non-Azure providers.

### Release note

FE rejects known-expired Azure SAS credentials when retrieving cached backend configuration instead of forwarding the stale configuration.

### Check List (For Author)

- Test: Manual test / Unit Test
    - Manual test: Maven Checkstyle passed for fe-core, fe-filesystem-api, and fe-filesystem-azure; metadata-funnel gate and git diff --check passed.
    - Unit Test: Added and updated targeted tests; not run for this commit. Compilation and UT execution are delegated to the user.
    - Standalone Maven validate could not resolve uninstalled internal SNAPSHOT artifacts for fe-core; the same Checkstyle configuration was run directly without compilation.
- Behavior changed: Yes (cached Azure SAS access now checks known expiry; no automatic credential refresh)
- Does this need documentation: No (internal validation boundary; local test records are not committed)

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: ObjectInfoAdapter can forward both the stored Azure account key and a supplied SAS token, but the typed Azure provider rejects mixed authentication material. Convert a supplied SAS as the complete authentication choice without forwarding the old SharedKey; preserve account, endpoint and container. Keep malformed or expired SAS failures explicit instead of falling back to SharedKey. Preserve the no-token SharedKey path and the S3-compatible STS converter. Redact ObjectInfo token rendering so logging this credential holder does not expose SAS or session tokens. This change does not implement Azure getStsToken or claim Cloud ARN support.

### Release note

Azure stage credential conversion keeps SAS separate from SharedKey. ObjectInfo log rendering masks tokens without changing the values used for authentication.

### Check List (For Author)

- Test: Manual test / Unit Test
    - Manual test: fe-core Checkstyle passed with zero violations; metadata-funnel gate and git diff --check passed.
    - Unit Test: Added SharedKey/SAS conversion, malformed/blank/expired SAS rejection and token-redaction tests; existing S3/OSS tests retained. New tests and compilation are not run in this turn and are delegated to the user.
- Behavior changed: Yes (a supplied Azure SAS replaces SharedKey authentication; token log rendering is masked)
- Does this need documentation: No (conversion compatibility fix; local execution records are not committed)

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Bind account-scoped Iceberg ADLS SAS directly to typed Azure properties. Replace authentication as a group while preserving connection defaults and scope checks. Propagate recognized invalid or expired credentials without the legacy fail-soft fallback, remove Azure conversion from CredentialUtils, and preserve Azure URI authorities and object keys. Leave non-Azure vended routing and genuine Hadoop bindings on their existing paths.

### Release note

Azure vended SAS is bound directly by the filesystem provider. Filesystem plugins must target API version 2.0 after the new provider binding hook.

### Check List (For Author)

- Test: Unit Test - 333 tests across 17 targeted classes through run-fe-ut.sh; incremental build.sh --fe with Checkstyle; metadata-funnel and whitespace checks. No live Azure data access tested.
- Behavior changed: Yes - Azure provider owns ADLS SAS conversion and recognized credential failures propagate; non-Azure legacy failure behavior is retained.
- Does this need documentation: No - local implementation and validation notes are not included in this commit.

…fetimes

### What problem does this PR solve?

Related PR: apache#67470

Problem Summary: Native Azure data access still borrowed AWS credential fields and accepted Hadoop or catalog aliases. Move authentication into an SDK-independent Azure model, preserve legacy SharedKey only at wire boundaries, validate provider and URI scope, and retain literal Iceberg ADLS object names. Bound the Azure client cache, reject expired SAS before access and publication, preserve concurrent holder refresh, and avoid leaking container SAS or deleting published blobs during abort.

### Release note

Native Azure access rejects conflicting or expired credentials. SAS and OAuth2 credentials cannot produce a user-facing presigned URL; error logs retain their local path. Aborting a staged Azure upload no longer deletes an existing blob.

### Check List (For Author)

- Test: Unit tests added for native protocol, SDK-backed fake-transport range reads, expiry/cache concurrency, presigning, and abort/error-log behavior; not run yet. Standard incremental BE build attempted and stopped at a stale PCH/generated-header mismatch before Azure verification. Clang-format 16 and build hygiene passed; clang-tidy passed for both modified common Azure implementations. Remaining BE build and UT require the user-run near-full PCH rebuild.
- Behavior changed: Yes, explicit Azure protocol and credential admission, bounded Azure-only cache, literal ADLS names, and non-destructive abort/presign failure handling.
- Does this need documentation: No, local redesign and verification notes are maintained outside the commit.

### What problem does this PR solve?

Related PR: apache#67470

Problem Summary: Percent-decoding ABFS and WASB object names changes the object selected by Iceberg ADLSFileIO, which passes those names literally to the Azure SDK. Preserve literal ADLS names and decode Azure HTTP URL paths only once. Add a contract test against the actual Iceberg ADLSLocation and Java Blob SDK, using a test-scope Iceberg dependency without changing FileIO or plugin runtime dependencies. Correct the OneLake routing fixture to use its own OAuth2 binding, explicitly select Azure, and supply the existing Iceberg REST catalog context; preserve rejection of an unrelated account binding.

### Release note

Native Azure paths preserve percent sequences in Iceberg ABFS and WASB object names instead of addressing a different object.

### Check List (For Author)

- Test: Standard incremental FE build and Checkstyle passed. Standard run-fe-ut.sh targeted 25 classes: 435 reported tests, 434 passed, zero failures/errors, one pre-existing disabled GCS case. Actual Iceberg ADLSLocation/Java SDK contract tests passed without network I/O. OneLake binding failure was reproduced with a pre-routing assertion before the fixture fix. BE and live Azure verification remain pending separately.
- Behavior changed: Yes, ABFS/WASB names retain literal percent sequences; HTTP path decoding is unchanged.
- Does this need documentation: No, compatibility fix; detailed verification notes remain local and are not committed.

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Resolve Azure credentials, URI, reader and backend properties from a request-local provider binding. Replace stale static authentication before reading its backend view, keep native Azure parameters separate from OneLake Hadoop configuration, and use the same resolved contract in data scans, delete vectors and write sinks. Preserve legacy non-Azure routing and serialized Iceberg FileIO metadata tasks. Add real engine/provider and Thrift-range contract tests, including metadata roots on a different store and scoped credentials. Align one stale writer assertion with the existing empty-snapshot OCC contract without changing transaction code.

### Release note

Azure data access uses provider-owned native parameters and binding-aware HTTPS routing. OneLake keeps its Hadoop backend view. Connector and filesystem plugins must be rebuilt against API majors 8 and 4 respectively.

### Check List (For Author)

- Test: Unit Test / Manual test
    - run-fe-ut.sh: 71 selected classes, 1067 passed, 0 failures/errors, 1 pre-existing disabled test
    - build.sh --fe: incremental build and Checkstyle passed; target/output hashes and plugin API manifests verified
    - Connector import and metadata-funnel gates passed
    - BE build/tests and cloud end-to-end validation not run for this slice
- Behavior changed: Yes (provider-resolved Azure routing and isolated native/Hadoop credential views)
- Does this need documentation: No (internal protocol refactor; local implementation and testing notes intentionally excluded)

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Add a storage-provider output for the official Iceberg
FileIO without round-tripping BE or Hadoop credentials. Azure renders
SharedKey and SAS in the SDK's dialect, checks expiry and rejects endpoints
that carry separate credential material. Client-secret OAuth2 contributes
only a HadoopFileIO selection requirement; native credentials are unchanged.
Equivalent DFS and Blob SAS aliases now rebind as one account while
conflicting credentials remain rejected. Update both plugin API surfaces
and version gates for the shared contract. Catalog integration remains a
subsequent change; this commit does not claim to wire REST FileIO selection.

### Release note

Accept equivalent same-account DFS and Blob aliases for Azure vended SAS.
Connector and filesystem plugins require API versions 9.0 and 5.0.

### Check List (For Author)

- Test: Unit Test / Incremental FE build
    - Standard run-fe-ut.sh: 78 classes, 1175 tests, 0 failures, 0 errors,
      1 pre-existing disabled GCS test; Surefire XML counts verified.
    - Official ADLSFileIO and Azure Java SDK metadata reads against a
      loopback HTTP fixture with dummy SAS and SharedKey credentials.
    - Standard build.sh --fe, Checkstyle and packaged API version checks.
    - No BE build, cloud I/O or cluster restart in this change.
- Behavior changed: Yes (equivalent Azure SAS host aliases; new provider
  FileIO contract, not yet connected to catalog initialization)
- Does this need documentation: No (local execution notes are not committed)

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Native Azure credentials were not connected to the official Iceberg REST FileIO construction path. Per-key SDK configuration merging could retain an obsolete key or SAS expiry, while unconditional response adaptation could reject a metadata refresh using an already established FileIO. Resolve complete Azure authentication groups through the provider-owned storage binding, preserve metadata and scoped credentials, and adapt GET responses only during initial table loading. Validate metadata identity and incompatible explicit FileIO choices, and prevent a local response-binding failure from replaying a successful create/register request. Keep non-Azure storage, Hadoop metadata authentication, and the official SDK FileIO lifecycle intact. Bump the connector/filesystem API versions with their shared interface changes.

### Release note

Iceberg REST metadata FileIO and native Azure data access now share provider-selected SharedKey/SAS credentials. Unsupported explicit FileIO/authentication combinations fail clearly instead of silently selecting another identity.

### Check List (For Author)

- Test: Unit Test / offline SDK integration
    - run-fe-ut.sh: 88 related classes, 1305 tests, 0 failures/errors, 1 pre-existing GCS skip
    - build.sh --fe incremental build with Checkstyle; packaged plugin/API consistency checks
    - No BE full build or cloud E2E in this batch
- Behavior changed: Yes, bind Azure REST FileIO credentials as complete groups and validate selected metadata access
- Does this need documentation: No; local verification notes are not included in the commit

### What problem does this PR solve?

Issue Number: None

Related PR: apache#67470

Problem Summary: Metadata scan properties exported an expired static Azure SAS before replacing it with valid vended credentials. A cold serialized ResolvingFileIO also used the parent-loaded CatalogUtil, which could not see ADLSFileIO bundled in the JNI scanner and fell back to Hadoop. Replace only the typed Azure binding before exporting credentials and load the two FileIO factories locally in the Iceberg scanner while retaining shared interfaces, tasks, other FileIO implementations, and other scanners. Keep the existing all-manifests resolver and JNI credential forwarding until their replacement is verified across the remaining paths.

### Release note

Iceberg Azure metadata scans can select fresh vended SAS before static expiry validation and resolve cold serialized Azure FileIO in the BE Java scanner.

### Check List (For Author)

- Test: Unit Test - standard run-fe-ut.sh, 11 classes / 208 tests passed with packaged FileIO tests explicitly enabled; rerun against final target jars. Standard build.sh --fe incremental build and Checkstyle passed. Verified packaged class identity, Azure HTTP service discovery, loopback Azure/S3 reads, Hadoop configuration and local reads, real FE-planned all-manifests task rows, and static snapshot consumption. No BE C++ or live Azure/OneLake tests in this batch.
- Behavior changed: Yes - replace selected Azure credentials before expiry validation and use scanner-local Iceberg FileIO factories.
- Does this need documentation: No - no new configuration; local validation notes remain uncommitted.

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: The native Azure SAS reader test transport left HEAD response bodies null. The Azure SDK transport policy consumes a body stream even for HEAD, causing an ASAN null dereference before the range-read assertions ran. Provide a zero-length memory stream for HEAD while retaining the four-byte GET body and all existing assertions. Only the test fixture changes.

### Release note

None

### Check List (For Author)

- Test: Unit Test
    - run-be-ut.sh --run: 103 selected tests from 13 suites passed on the current migration worktree; no failures, errors, or skips.
    - Eleven cache and concurrency tests passed five repeated iterations using GTEST_REPEAT=5.
    - clang-format 16 and git diff --check passed. clang-tidy remains blocked by existing NOLINTEND, helper complexity, and getenv nullability diagnostics.
- Behavior changed: No; production client and reader code are unchanged.
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: The Iceberg scanner resolved every serialized class descriptor with Class.forName, which throws ClassNotFoundException for primitive descriptors such as int and does not resolve child-only proxy interfaces. Reuse the parent-provided Commons IO ClassLoaderObjectInputStream to preserve extension visibility and standard Java descriptor handling. Cover the public scanner boundary with primitive, array, ordinary class, isolated task and public/private proxy cases.

### Release note

Iceberg metadata tasks containing primitive class descriptors or extension-local proxy interfaces can be deserialized by the BE Java scanner.

### Check List (For Author)

- Test: Unit Test
    - Reproduced ClassNotFoundException: int before the fix; the same scanner test passes after it.
    - All 15 serialization tests passed via run-fe-ut.sh. The current migration worktree also passed 438 selected Java tests, including real packaged-scanner loopback reads.
    - build.sh --fe --be-java-extensions and Checkstyle passed; packaged parent Commons IO and scanner class bytes were verified.
- Behavior changed: Yes; preserve Java primitive/proxy serialization while retaining the scanner classloader.
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: A metadata query requesting split_offsets without file_size_in_bytes receives null even when the manifest contains valid offsets. The Iceberg BaseFile getter validates the last offset against the projected file size, which otherwise defaults to -1. Append the size field only as an internal dependency after the requested columns. The BE continues reading the requested prefix positionally, so visible columns and ordering remain unchanged. This is an Iceberg metadata projection issue exposed by the Azure packaged-scanner tests, not an Azure authentication failure.

### Release note

Iceberg files metadata projections retain split_offsets when file_size_in_bytes is not selected.

### Check List (For Author)

- Test: Unit Test
    - Nine projection tests passed across files, data_files, all_files and all_data_files, including explicit-size ordering and unrelated projections.
    - The original packaged Azure scanner test now returns exact map/array values across batches of two and one rows. A diagnostic control reproduced null before the packaged scanner prior to the fix.
    - run-fe-ut.sh: all 438 selected Java tests passed on the migration worktree. build.sh --fe --be-java-extensions, Checkstyle and git diff --check passed.
- Behavior changed: Yes; preserve non-null split offsets without adding user-visible columns or changing FileIO.
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: Azure metadata tasks previously depended on native reader credentials copied into the JNI Hadoop channel and a BE Java resolver that reflectively replaced all-manifests FileIO. Bind REST scoped metadata SAS through the existing provider bridge before task serialization, reject conflicting scopes, and retain the original official Iceberg FileIO. Forward only actual Hadoop execution configuration for metadata tasks, preserving HadoopFileIO and the authentication wrapper. Carry known fixed SAS expiry separately in optional Thrift field 13 and reject expired tasks at scanner open without echoing credentials. Remove the old resolver and replace reflection-based tests with real planned tasks and packaged-scanner loopback reads, including multi-batch map/array output.

### Release note

Azure Iceberg metadata tasks retain their planned FileIO credentials without native Azure Hadoop sideband rebinding. Known expired fixed SAS credentials are diagnosed before task execution; genuine Hadoop configuration and materialized metadata rows keep their existing paths.

### Check List (For Author)

- Test: Unit Test
    - run-fe-ut.sh on the complete migration worktree: 26 classes, 438 tests, zero failures/errors/skips; actual per-class XML agrees with the execution log.
    - Packaged scanner tests exercise cold all_manifests, files and entries reads through the official Azure Java SDK against a loopback fixture, plus materialized manifests/snapshots and fixed-credential expiry.
    - Previously executed run-be-ut.sh subset: 103 tests passed, including all five C++ JNI expiry/configuration forwarding tests; C++ code has not changed since that run.
    - build.sh --fe --be-java-extensions, Java Checkstyle, clang-format 16 for the four P7 C++ files, build hygiene and git diff --check passed.
    - clang-tidy remains unpassed due to the existing unmatched NOLINTEND in core/types.h; builtin-header lookup also required a local toolchain include-path correction. No checks were disabled.
    - Not claimed: live Azure/Entra/OneLake authentication, full C++ to JVM query execution, all custom FileIO combinations or mixed-version deployment.
- Behavior changed: Yes; metadata credentials stay in serialized FileIO, with a separate optional expiry value. Native Azure data access and true Hadoop channels retain their responsibilities.
- Does this need documentation: No; local verification notes and environment configuration are not committed.

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: The generated Thrift setters accept const references, so std::move in the two Iceberg JNI fixtures still copies and triggers performance-move-const-arg. Remove those four ineffective moves and the unused utility includes without changing fixture values, assertions or production code.

### Release note

None

### Check List (For Author)

- Test: No need to rerun GTest for the value-category-only cleanup: both setter signatures accept const references and preserve the same copies and assertions.
    - Both files passed syntax-only checks derived from their real UT compile database entries; no objects or PCH were generated.
    - clang-format 16, build hygiene and git diff --check passed.
    - Re-running repository clang-tidy removed all four move diagnostics. The check still exits 1 on the existing unmatched NOLINTEND in core/types.h; it is not reported as passing.
- Behavior changed: No; tests and production behavior are unchanged.
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: clang-tidy stops on core/types.h because its trailing
NOLINTEND has no matching NOLINTBEGIN. Remove only that dangling comment
so the native Azure and Iceberg JNI translation units can be analyzed.
No C++ declarations, definitions, or suppression settings are changed.

### Release note

None

### Check List (For Author)

- Test: Manual static checks: repository clang-tidy script passes all five
  selected Azure/JNI source and test files; clang-format 16 and build hygiene pass.
  No BE rebuild or GTest rerun for this comment-only change.
- Behavior changed: No
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: The native SAS reader fixture exceeds the cognitive
complexity gate through nested assertion macros, and repeated getenv calls
produce nullable-string diagnostics. Separate the reader-content and client
configuration assertions without removing checks, propagate fatal read
failures, and validate and consume the same environment-variable pointers.

### Release note

None

### Check List (For Author)

- Test: Repository clang-tidy, clang-format 16 and build hygiene pass.
  Exact Azure-enabled UT compile command passes syntax-only verification.
  GTest was not rerun after this cleanup; real Azure access was not attempted.
- Behavior changed: No production behavior change
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: The native Azure migration needs a repeatable cloud
acceptance entrypoint after the storage-binding and metadata-FileIO refactor.
Use a preconfigured write-enabled Azure catalog and an authorized namespace,
without putting credentials into suite SQL. Cover Parquet/ORC v2 and v3
reads, position deletes, Puffin DV consumers, UPDATE/MERGE, overwrite, and
metadata tables. Require positive native GET/byte counters on uncached reads.
Keep suite-owned tables for diagnosis and require explicit fixture opt-in.
Validate configuration before registration; disabled and dry runs register
no successful empty suites. Generate golden results only against real Azure.

### Release note

None

### Check List (For Author)

- Test: Standard run-regression-test.sh --compile succeeds, including 9
  existing framework unit tests. Suite parses with the actual SuiteScript base.
  Official dryRun verifies disabled/configuration-only execution reports zero
  suites, and enabled missing configuration exits nonzero before suite SQL.
  Real Azure/DBX execution and generated .out results remain pending; no cloud
  pass or writer/credential-mode acceptance is claimed.
- Behavior changed: No production behavior change
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: N/A

Related PR: apache#67470

Problem Summary: New Azure lifecycle and error-log tests used positional
SDK aggregate initialization and nested namespace syntax. GTest assertion
expansions also pushed the concurrent client snapshot test over the
complexity limit. Use designated fields and a qualified namespace, and
extract the snapshot assertions without changing their nonfatal behavior
or the test's barriers and join.

### Release note

None

### Check List (For Author)

- Test: clang-format 16 and official clang-tidy changed-line checks passed;
  lifecycle and runtime tests also pass full-file clang-tidy. GTest was not
  rerun; seven unrelated pre-existing factory diagnostics remain.
- Behavior changed: No
- Does this need documentation: No

### What problem does this PR solve?

Issue Number: None

Related PR: apache#67470

Problem Summary: Iceberg FileIO properties can contain provider-normalized DFS and Blob aliases alongside the original scoped credential. Merging the scoped values per key leaves an inconsistent expiry or an older authentication identity in native Azure bindings. Replace the complete Azure authentication group before applying the scoped credential, while retaining connection settings, strict scope validation and non-Azure merge behavior. Add extractor and real engine/provider tests that reproduce the expiry and token conflicts before the fix.

### Release note

Fix native Azure credential binding when vended SAS credentials coexist with normalized or older FileIO authentication properties.

### Check List (For Author)

- Test: Unit Test - standard run-fe-ut.sh, 8 classes and 426 tests passed; the four new real-provider cases failed before the fix. Standard build.sh --fe and Checkstyle passed. Manual read-only Azure data/Puffin/metadata queries passed on the updated FE; an uncached data query recorded a native GET. Full DML regression remains pending.
- Behavior changed: Yes - native Azure extraction replaces authentication atomically instead of retaining stale aliases; non-Azure and legacy extraction remain unchanged.
- Does this need documentation: No - internal credential-binding fix.

### What problem does this PR solve?

Issue Number: N/A
Related PR: apache#67470

Problem Summary: After merging the Iceberg 1.11 upgrade, RESTSessionCatalog
loads tables through a GET overload with a response-header consumer. The
native Azure FileIO client wrapper did not override it, so even S3-backed
REST catalogs failed with "Returning response headers is not supported"
before sending the table request. Forward this overload to the delegate
while retaining response adaptation, authentication and error handling.

Add local HTTP tests through the real RESTCatalog.loadTable path for S3 and
Azure locations, plus response adaptation/header forwarding, Supplier and
authenticated-client dispatch, HTTP 204/304 and missing-table errors. These
tests need neither cloud credentials nor an external storage environment.

### Release note

Restore Iceberg REST table loading after the Iceberg 1.11 upgrade, including
S3 and Azure-backed catalogs using the native FileIO client wrapper.

### Check List (For Author)

- Test: Unit Test / Manual test
    - Reproduced the original failure with five tests before the fix
    - ./run-fe-ut.sh: 224 targeted tests passed, including six new cases
    - ./build.sh --fe: build and Checkstyle passed
    - Original local HTTP loadTable reproducer passes with the fixed wrapper
    - Full external regression CI was not rerun locally
- Behavior changed: Yes (forward SDK response-header GET instead of throwing)
- Does this need documentation: No

### Self-review

- Goal and evidence: real SDK table loads now reach HTTP and construct the
  adapted FileIO; pre-fix failure and post-fix success were both observed.
- Scope: one missing forwarding overload, its null-response comment and tests.
- Concurrency: no new shared state, threads or locks in production.
- Lifecycle: existing auth-session wrappers and delegate ownership are unchanged;
  test HTTP servers and clients are closed after each case.
- Configuration: no new options or environment changes are committed.
- Compatibility: implements the existing SDK contract; no Doris SPI or persistent
  format changes and no plugin API version bump is required.
- Parallel paths: Map and inherited Supplier dispatch are covered, including
  withAuthSession; other GET and POST overloads are unchanged.
- Conditional handling: reuse null-response adaptation for HTTP 204/304;
  delegate errors propagate without adapting failed responses.
- Coverage: S3/Azure metadata locations, successful payload replacement, headers,
  conditional requests, empty responses and 404 errors are covered offline;
  existing external regressions exercise the SQL-level failure.
- Test results: no generated regression outputs were edited.
- Observability: preserve SDK error diagnostics; no new credential logging.
- Transactions and persistence: no changes to commits, EditLog or persisted data.
- Data writes: POST/create/commit behavior is unchanged.
- FE/BE transport: no new fields or reader changes.
- Performance: one existing delegate call plus existing response adaptation;
  no additional remote request, cache or per-row work.
- Other issues: no additional issue found in the changed production path.

### What problem does this PR solve?

Issue Number: N/A
Related PR: apache#67470

Problem Summary: Merge master e545b13 into the native Azure branch.
Both branches extend the connector API: this branch adds typed storage access
and master adds OpenCSV scan semantics and freezes the inlined scan property
keys. Preserve both API surfaces, both compatibility tests and the recent
Iceberg REST response-header fix. Use connector API 12.0 for the combined
contract rather than reusing either parent's version; explicitly reject
pre-merge API 11 plugins that lack the OpenCSV contract.

### Release note

Connector plugins use API 12.0 for the combined native Azure and OpenCSV
contract. Plugins built against older connector API versions must be rebuilt.

### Check List (For Author)

- Test: Unit Test / Manual test
    - ./run-fe-ut.sh: 363 initial targeted tests passed, including REST GET,
      storage binding, Iceberg scans, Hive CSV and plugin API version checks
    - ./run-fe-ut.sh: all 148 connector SPI tests and 13 FE CSV property tests
      passed (436 distinct tests across both runs)
    - ./build.sh --fe passed, including Checkstyle
    - Resolved-file git diff --check and C++ check-format.sh passed
    - Packaged connector manifests and FE version gate both declare API 12.0
    - Full external regression and BE suites were not rerun locally
- Behavior changed: Yes (API 12 rejects plugins predating the merged contract)
- Does this need documentation: No

### Merge self-review

- Goal: resolve four API/test baseline conflicts while retaining both branches;
  both frozen metadata/surface contracts and plugin version tests pass.
- Scope: manual resolutions are confined to the four conflicted files.
- Concurrency: no new production threads, shared mutable state or locks.
- Lifecycle: plugin registry test fixtures retain before/after cleanup; no
  scanner, FileIO or authentication-session lifecycle changes.
- Configuration: no user environment files are committed; use the existing
  build-time plugin API property, not a new runtime configuration option.
- Compatibility: API 12 prevents API 8/10/11 admission while current-version
  plugins remain loadable; preserve master scan-key freezing and Azure types.
- Parallel paths: all in-tree connector manifests inherit the same API property.
- Conditions: no new production branches or fallback behavior in resolutions.
- Coverage: all SPI tests, negative plugin admission cases and selected
  Iceberg/Hive paths pass; live external storage validation remains with CI.
- Results: merge existing frozen interface snapshots; no generated regression
  output was manually rewritten.
- Observability: preserve existing version mismatch diagnostics and inventory.
- Transactions/persistence: manual resolutions do not change transaction or
  persisted-state logic.
- Writes: no data write path changes in the manual resolutions.
- FE/BE transport: master OpenCSV field and Azure FileIO expiry field coexist;
  retain their respective producers and consumers.
- Performance: no new query-time work in manual resolutions.
- Other issues: REST response-header production code and tests are unchanged
  from c9c235f; no additional merge-resolution issue found.

…e in S3ClientFactory

Part 1 of the apache#67470 split tracked in apache#68103: the BE consumer side of the
native Azure protocol.

- AzureCredentialOptions models SharedKey / SAS / OAuth2 credential groups
  and S3ClientConf carries it; equality, hash and to_string are per provider.
- S3ClientFactory accepts the native AZURE_* map and the legacy AWS_*
  SharedKey map (convert_legacy_azure_properties), validates the data URI
  against the binding, and keeps Azure clients in a separate bounded cache
  that is pruned by SAS expiry and re-validated on every access.
- AzureAuthFactory builds clients for all three credential types and
  derives the effective SAS expiry from the token and AZURE_SAS_EXPIRY_MS.
- S3URI parses abfs[s]:// and wasb[s]:// authorities and Azure HTTP(S)
  hosts; ABFS/WASB object names stay literal.
- SAS tokens are redacted from SDK logs and client error messages;
  generate_presigned_url signs only under SharedKey and the error-log path
  falls back to the local file when no URL can be signed;
  abort_multipart_upload no longer deletes the blob.

Issue: apache#68103
Related PR: apache#67470
Depends on: nothing

Co-authored-by: xylaaaaa <[email protected]>
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Review follow-up for apache#68117. Legacy SharedKey producers (old FE property
maps, ObjectStoreInfoPB, TS3StorageParam) hand the endpoint over literally
and the old factory only defaulted the scheme. Two rewrites had leaked into
that path:

- normalize_azure_endpoint()'s bare account-name inference also ran for
  legacy endpoints, so an unschemed single-label host such as
  AWS_ENDPOINT=storage-proxy was redirected to
  https://storage-proxy.blob.core.windows.net.
- import_legacy_azure_shared_key() ran normalize_http_uri(), collapsing
  repeated path separators in custom reverse-proxy base paths.

The native protocol keeps its full normalization where it is parsed
(convert_native_azure_properties). _create_azure_client() now only applies
the transport rule the old factory had: default the scheme and normalize
the endpoint/container join boundary. The persisted endpoint is no longer
rewritten.

Tests cover all three legacy producers with unschemed single-label hosts
and exact custom base paths, asserting both the stored endpoint and the
container base the SDK signs against.

Issue: apache#68103
Related PR: apache#67470

Co-authored-by: xylaaaaa <[email protected]>
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Follow-up for apache#68117. azure_transport_endpoint() was added in the
anonymous namespace without a guard, but its only caller is the
USE_AZURE branch of S3ClientFactory::_create_azure_client(). The
Performance pipeline builds with DISABLE_BUILD_AZURE=ON, so gcc
rejected the file with -Werror=unused-function:

  be/src/util/s3_util.cpp:333:13: error: 'std::string
  doris::{anonymous}::azure_transport_endpoint(std::string)' defined
  but not used [-Werror=unused-function]

Every other pipeline builds with Azure on, which is why only the
Performance job failed. Move the helper under the same USE_AZURE guard
as the other _create_azure_client()-only helpers. Verified locally with
-fsyntax-only for s3_util.cpp, s3_uri.cpp, s3_file_system.cpp and
runtime_state.cpp both with and without -DUSE_AZURE.

Issue: apache#68103
Related PR: apache#67470

Co-authored-by: xylaaaaa <[email protected]>
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…idate_azure_uri

Review follow-up for apache#68117, three defects in the new native Azure URI
contract:

- S3URI::parse() stripped '?' and '#' from ABFS/WASB object paths. Iceberg's
  ADLSLocation ("^(abfss?|wasbs?)://([^/?#]+)(.*)?$") and Hadoop's Path both
  take everything after the authority as the object path, so an object
  named path/a?b#c.parquet was opened as path/a. Query and fragment are now
  only stripped for the S3 and HTTP(S) schemes.
- The OneLake fence compared the raw authority, so an explicit port
  (onelake.dfs.fabric.microsoft.com:443) or a trailing DNS root dot made a
  genuine Fabric location pass the later checks and reach the native client.
  The fence now matches on the DNS host (case-folded, no port, no root dot).
- Azure RA-GRS/RA-GZRS secondary endpoints append "-secondary" to the
  account label while keeping the primary account identity and keys (the SDK
  signs with the credential's account name and only swaps the host). The
  account check compared that label with the credential and rejected valid
  secondary reads. On official Azure hosts the suffix now folds to the
  primary account for the ABFS/WASB endpoint identity and for the credential
  account check; HTTP(S) transport matching stays exact.

Tests: S3URITest.QueryAndFragmentAreLiteralOnlyInAdlsPaths (plus '?'/'#'
names in IcebergAdlsPathsPreserveLiteralPercentSequences),
S3ClientFactoryTest.OneLakeFenceIgnoresPortAndDnsRootDot,
AllowsDocumentedAzureSecondaryEndpoints and
SecondaryFoldingKeepsOtherAccountsApart.

Issue: apache#68103
Related PR: apache#67470

Co-authored-by: xylaaaaa <[email protected]>
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>