Copilot commented on code in PR #10971: URL: https://github.com/apache/gravitino/pull/10971#discussion_r3212660824
########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpUserOperations.java: ########## @@ -0,0 +1,126 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpUserManager; +import org.apache.gravitino.dto.requests.CreateUserRequest; +import org.apache.gravitino.dto.requests.ResetPasswordRequest; +import org.apache.gravitino.dto.responses.IdpUserResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/users") +public class IdpUserOperations { + + private final IdpUserManager userManager; + + @Context private HttpServletRequest httpRequest; + + public IdpUserOperations() { + this(IdpUserManager.fromEnvironment()); + } + + IdpUserOperations(IdpUserManager userManager) { + this.userManager = userManager; + } + + @GET + @Path("{user}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-user", absolute = true) + public Response getUser(@PathParam("user") String user) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpUserResponse(userManager.getUser(user)))); + } catch (Exception e) { + return ExceptionHandlers.handleUserException(OperationType.GET, user, "", e); + } + } + + @POST + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-user", absolute = true) + public Response addUser(CreateUserRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok( + new IdpUserResponse( + userManager.createUser(request.getUser(), request.getPassword()))); Review Comment: `CreateUserRequest request` can be null (e.g., missing/empty body), which will throw NPE at `request.validate()` and then be handled as an internal error. Please add an explicit null check at the start of `addUser` and return an illegal-arguments (400) response consistent with other REST operations (e.g., MetalakeOperations#createMetalake). ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpUserOperations.java: ########## @@ -0,0 +1,126 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpUserManager; +import org.apache.gravitino.dto.requests.CreateUserRequest; +import org.apache.gravitino.dto.requests.ResetPasswordRequest; +import org.apache.gravitino.dto.responses.IdpUserResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/users") +public class IdpUserOperations { + + private final IdpUserManager userManager; + + @Context private HttpServletRequest httpRequest; + + public IdpUserOperations() { + this(IdpUserManager.fromEnvironment()); + } + + IdpUserOperations(IdpUserManager userManager) { + this.userManager = userManager; + } + + @GET + @Path("{user}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-user", absolute = true) + public Response getUser(@PathParam("user") String user) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpUserResponse(userManager.getUser(user)))); + } catch (Exception e) { + return ExceptionHandlers.handleUserException(OperationType.GET, user, "", e); + } + } + + @POST + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-user", absolute = true) + public Response addUser(CreateUserRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok( + new IdpUserResponse( + userManager.createUser(request.getUser(), request.getPassword()))); + }); + } catch (Exception e) { + return ExceptionHandlers.handleUserException(OperationType.ADD, request.getUser(), "", e); + } Review Comment: In the `catch` block, `request.getUser()` can itself NPE if the request body was null/deserialization failed, masking the original error. Use a safe fallback (e.g., `request != null ? request.getUser() : ""`) or avoid referencing `request` in the catch path. ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpUserOperations.java: ########## @@ -0,0 +1,126 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpUserManager; +import org.apache.gravitino.dto.requests.CreateUserRequest; +import org.apache.gravitino.dto.requests.ResetPasswordRequest; +import org.apache.gravitino.dto.responses.IdpUserResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/users") +public class IdpUserOperations { + + private final IdpUserManager userManager; Review Comment: This PR introduces new user-facing REST endpoints under `/idp/*`, but there doesn't appear to be any corresponding OpenAPI spec update (no `/idp` paths found under `docs/open-api/*.yaml`). Please add IdP user/group/membership endpoints to the OpenAPI documentation so clients can discover and generate against these APIs. ########## server/src/main/java/org/apache/gravitino/server/GravitinoServer.java: ########## @@ -123,6 +128,10 @@ public ServerConfig serverConfig() { } private void initializeRestApi() { + boolean enableBasicAuthenticator = + serverConfig + .get(Configs.AUTHENTICATORS) + .contains(AuthenticatorType.BASIC.name().toLowerCase()); HashSet<String> restApiPackagesSet = new HashSet<>(); Review Comment: Server initialization checks for `basic` in `Configs.AUTHENTICATORS` to enable the IdP APIs, but the authenticator factory currently only maps `simple`, `oauth`, and `kerberos`. With `AUTHENTICATORS=basic`, `ServerAuthenticator.initialize()` will attempt `Class.forName("basic")` and fail at startup. Please add BASIC support to the authenticator wiring (factory mapping + implementation), or adjust gating/config expectations so `basic` is a valid configured authenticator name. ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpGroupOperations.java: ########## @@ -0,0 +1,146 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.DefaultValue; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.QueryParam; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpGroupManager; +import org.apache.gravitino.dto.requests.CreateGroupRequest; +import org.apache.gravitino.dto.requests.UpdateGroupUsersRequest; +import org.apache.gravitino.dto.responses.IdpGroupResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/groups") +public class IdpGroupOperations { + + private final IdpGroupManager groupManager; + + @Context private HttpServletRequest httpRequest; + + public IdpGroupOperations() { + this(IdpGroupManager.fromEnvironment()); + } + + IdpGroupOperations(IdpGroupManager groupManager) { + this.groupManager = groupManager; + } + + @GET + @Path("{group}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-group", absolute = true) + public Response getGroup(@PathParam("group") String group) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpGroupResponse(groupManager.getGroup(group)))); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.GET, group, "", e); + } + } + + @POST + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-group", absolute = true) + public Response addGroup(CreateGroupRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok(new IdpGroupResponse(groupManager.createGroup(request.getGroup()))); + }); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.ADD, request.getGroup(), "", e); + } + } + + @DELETE + @Path("{group}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "remove-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "remove-idp-group", absolute = true) + public Response removeGroup( + @PathParam("group") String group, @DefaultValue("false") @QueryParam("force") boolean force) { + try { + return Utils.doAs( + httpRequest, + () -> { + boolean removed = groupManager.deleteGroup(group, force); + return Utils.ok(new RemoveResponse(removed)); + }); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.REMOVE, group, "", e); + } + } + + @PUT + @Path("{group}/add") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-group-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-group-user", absolute = true) + public Response addUsers(@PathParam("group") String group, UpdateGroupUsersRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok( + new IdpGroupResponse(groupManager.addUsersToGroup(group, request.getUsers()))); + }); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.ADD, group, "", e); + } + } + + @PUT + @Path("{group}/remove") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "remove-idp-group-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "remove-idp-group-user", absolute = true) + public Response removeUsers(@PathParam("group") String group, UpdateGroupUsersRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok( + new IdpGroupResponse(groupManager.removeUsersFromGroup(group, request.getUsers()))); + }); + } catch (Exception e) { Review Comment: `UpdateGroupUsersRequest request` can be null for `/idp/groups/{group}/remove`; this currently causes NPE at `request.validate()` and a 500. Add an explicit null check and return 400 for null request bodies. ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpUserOperations.java: ########## @@ -0,0 +1,126 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpUserManager; +import org.apache.gravitino.dto.requests.CreateUserRequest; +import org.apache.gravitino.dto.requests.ResetPasswordRequest; +import org.apache.gravitino.dto.responses.IdpUserResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/users") +public class IdpUserOperations { + + private final IdpUserManager userManager; + + @Context private HttpServletRequest httpRequest; + + public IdpUserOperations() { + this(IdpUserManager.fromEnvironment()); + } + + IdpUserOperations(IdpUserManager userManager) { + this.userManager = userManager; + } + + @GET + @Path("{user}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-user", absolute = true) + public Response getUser(@PathParam("user") String user) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpUserResponse(userManager.getUser(user)))); + } catch (Exception e) { + return ExceptionHandlers.handleUserException(OperationType.GET, user, "", e); + } Review Comment: Passing an empty metalake string into `ExceptionHandlers.handleUserException(..., "", e)` produces user-facing error messages like "under metalake []" for IdP APIs. Consider introducing IdP-specific exception handling (or at least a non-metalake context string) so errors from `/idp/users` are not mislabeled as metalake-scoped user operations. ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpGroupOperations.java: ########## @@ -0,0 +1,146 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.DefaultValue; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.QueryParam; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpGroupManager; +import org.apache.gravitino.dto.requests.CreateGroupRequest; +import org.apache.gravitino.dto.requests.UpdateGroupUsersRequest; +import org.apache.gravitino.dto.responses.IdpGroupResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/groups") +public class IdpGroupOperations { + + private final IdpGroupManager groupManager; + + @Context private HttpServletRequest httpRequest; + + public IdpGroupOperations() { + this(IdpGroupManager.fromEnvironment()); + } + + IdpGroupOperations(IdpGroupManager groupManager) { + this.groupManager = groupManager; + } + + @GET + @Path("{group}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-group", absolute = true) + public Response getGroup(@PathParam("group") String group) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpGroupResponse(groupManager.getGroup(group)))); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.GET, group, "", e); + } + } + + @POST + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-group", absolute = true) + public Response addGroup(CreateGroupRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok(new IdpGroupResponse(groupManager.createGroup(request.getGroup()))); + }); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.ADD, request.getGroup(), "", e); + } Review Comment: In the `catch` block, `request.getGroup()` can NPE if the request body was null/deserialization failed, masking the original error. Use a safe fallback or avoid referencing `request` in the catch path. ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpUserOperations.java: ########## @@ -0,0 +1,126 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpUserManager; +import org.apache.gravitino.dto.requests.CreateUserRequest; +import org.apache.gravitino.dto.requests.ResetPasswordRequest; +import org.apache.gravitino.dto.responses.IdpUserResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/users") +public class IdpUserOperations { + + private final IdpUserManager userManager; + + @Context private HttpServletRequest httpRequest; + + public IdpUserOperations() { + this(IdpUserManager.fromEnvironment()); + } + + IdpUserOperations(IdpUserManager userManager) { + this.userManager = userManager; + } + + @GET + @Path("{user}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-user", absolute = true) + public Response getUser(@PathParam("user") String user) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpUserResponse(userManager.getUser(user)))); + } catch (Exception e) { + return ExceptionHandlers.handleUserException(OperationType.GET, user, "", e); + } + } + + @POST + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-user", absolute = true) + public Response addUser(CreateUserRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok( + new IdpUserResponse( + userManager.createUser(request.getUser(), request.getPassword()))); + }); + } catch (Exception e) { + return ExceptionHandlers.handleUserException(OperationType.ADD, request.getUser(), "", e); + } + } + + @PUT + @Path("{user}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "update-idp-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "update-idp-user", absolute = true) + public Response resetPassword(@PathParam("user") String user, ResetPasswordRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok( + new IdpUserResponse(userManager.resetPassword(user, request.getPassword()))); + }); Review Comment: `ResetPasswordRequest request` can be null (missing/empty body), leading to NPE at `request.validate()` and a 500 instead of a 400. Add an explicit null check early in `resetPassword` and treat it as an illegal request. ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpGroupOperations.java: ########## @@ -0,0 +1,146 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.DefaultValue; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.QueryParam; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpGroupManager; +import org.apache.gravitino.dto.requests.CreateGroupRequest; +import org.apache.gravitino.dto.requests.UpdateGroupUsersRequest; +import org.apache.gravitino.dto.responses.IdpGroupResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/groups") +public class IdpGroupOperations { + + private final IdpGroupManager groupManager; + + @Context private HttpServletRequest httpRequest; + + public IdpGroupOperations() { + this(IdpGroupManager.fromEnvironment()); + } + + IdpGroupOperations(IdpGroupManager groupManager) { + this.groupManager = groupManager; + } + + @GET + @Path("{group}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-group", absolute = true) + public Response getGroup(@PathParam("group") String group) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpGroupResponse(groupManager.getGroup(group)))); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.GET, group, "", e); + } + } + + @POST + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-group", absolute = true) + public Response addGroup(CreateGroupRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok(new IdpGroupResponse(groupManager.createGroup(request.getGroup()))); + }); Review Comment: `CreateGroupRequest request` can be null (missing/empty body), which will throw NPE at `request.validate()` and then be handled as an internal error. Add an explicit null check at the start of `addGroup` and return a 400 illegal-arguments response. ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpGroupOperations.java: ########## @@ -0,0 +1,146 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.DefaultValue; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.QueryParam; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpGroupManager; +import org.apache.gravitino.dto.requests.CreateGroupRequest; +import org.apache.gravitino.dto.requests.UpdateGroupUsersRequest; +import org.apache.gravitino.dto.responses.IdpGroupResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/groups") +public class IdpGroupOperations { + + private final IdpGroupManager groupManager; + + @Context private HttpServletRequest httpRequest; + + public IdpGroupOperations() { + this(IdpGroupManager.fromEnvironment()); + } + + IdpGroupOperations(IdpGroupManager groupManager) { + this.groupManager = groupManager; + } + + @GET + @Path("{group}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-group", absolute = true) + public Response getGroup(@PathParam("group") String group) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpGroupResponse(groupManager.getGroup(group)))); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.GET, group, "", e); + } + } + + @POST + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-group", absolute = true) + public Response addGroup(CreateGroupRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok(new IdpGroupResponse(groupManager.createGroup(request.getGroup()))); + }); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.ADD, request.getGroup(), "", e); + } + } + + @DELETE + @Path("{group}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "remove-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "remove-idp-group", absolute = true) + public Response removeGroup( + @PathParam("group") String group, @DefaultValue("false") @QueryParam("force") boolean force) { + try { + return Utils.doAs( + httpRequest, + () -> { + boolean removed = groupManager.deleteGroup(group, force); + return Utils.ok(new RemoveResponse(removed)); + }); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.REMOVE, group, "", e); + } + } + + @PUT + @Path("{group}/add") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "add-idp-group-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "add-idp-group-user", absolute = true) + public Response addUsers(@PathParam("group") String group, UpdateGroupUsersRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + return Utils.ok( + new IdpGroupResponse(groupManager.addUsersToGroup(group, request.getUsers()))); + }); + } catch (Exception e) { Review Comment: `UpdateGroupUsersRequest request` can be null for `/idp/groups/{group}/add`; this currently causes NPE at `request.validate()` and a 500. Add an explicit null check and return 400 for null request bodies (consistent with other REST resources). ########## server/src/main/java/org/apache/gravitino/server/web/rest/IdpGroupOperations.java: ########## @@ -0,0 +1,146 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.DELETE; +import javax.ws.rs.DefaultValue; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.QueryParam; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.authorization.IdpGroupManager; +import org.apache.gravitino.dto.requests.CreateGroupRequest; +import org.apache.gravitino.dto.requests.UpdateGroupUsersRequest; +import org.apache.gravitino.dto.responses.IdpGroupResponse; +import org.apache.gravitino.dto.responses.RemoveResponse; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.web.Utils; + +@Path("/idp/groups") +public class IdpGroupOperations { + + private final IdpGroupManager groupManager; + + @Context private HttpServletRequest httpRequest; + + public IdpGroupOperations() { + this(IdpGroupManager.fromEnvironment()); + } + + IdpGroupOperations(IdpGroupManager groupManager) { + this.groupManager = groupManager; + } + + @GET + @Path("{group}") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "get-idp-group." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "get-idp-group", absolute = true) + public Response getGroup(@PathParam("group") String group) { + try { + return Utils.doAs( + httpRequest, () -> Utils.ok(new IdpGroupResponse(groupManager.getGroup(group)))); + } catch (Exception e) { + return ExceptionHandlers.handleGroupException(OperationType.GET, group, "", e); + } Review Comment: Passing an empty metalake string into `ExceptionHandlers.handleGroupException(..., "", e)` produces user-facing error messages like "under metalake []" for IdP APIs. Consider IdP-specific exception handling (or a different context string) so `/idp/groups` errors aren't mislabeled as metalake-scoped group operations. ########## server/src/test/java/org/apache/gravitino/server/TestGravitinoServer.java: ########## @@ -136,4 +172,162 @@ public void testMainShutdownHookShouldInvokeServerStop() throws IOException { hookBlock.contains("server.gracefulStop()"), "Shutdown hook should invoke server.gracefulStop() so app-level cleanup runs on SIGTERM"); } + + @Test + public void testInitializeRestApiWithBasicAuthenticator() throws Exception { + ServerConfig serverConfig = new ServerConfig(); + serverConfig.loadFromMap(ImmutableMap.of(Configs.AUTHENTICATORS.getKey(), "basic"), t -> true); + + GravitinoServer restServer = newRestApiTestServer(serverConfig, Collections.emptySet()); + invokeInitializeRestApi(restServer); + + IdpUserManager userManager = Mockito.mock(IdpUserManager.class); + Mockito.when(userManager.getUser("user1")) + .thenReturn( + IdpUserDTO.builder() + .withName("user1") + .withGroups(Collections.emptyList()) + .withAudit(buildAudit()) + .build()); + + restServer.register(newIdpUserOperations(userManager)); + restServer.register( + new AbstractBinder() { + @Override + protected void configure() { + bind(Mockito.mock(HttpServletRequest.class)).to(HttpServletRequest.class); + } + }); + + JerseyTest jerseyTest = + new JerseyTest() { + @Override + protected Application configure() { + return restServer; + } + }; + + try { + jerseyTest.setUp(); + Response response = + jerseyTest.target("/idp/users/user1").request("application/vnd.gravitino.v1+json").get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + IdpUserResponse userResponse = response.readEntity(IdpUserResponse.class); + assertEquals("user1", userResponse.getUser().name()); + assertEquals("admin", userResponse.getUser().auditInfo().creator()); + } finally { + jerseyTest.tearDown(); + } + } + + @Test + public void testInitializeRestApiWithoutBasicAuthenticator() throws Exception { + ServerConfig serverConfig = new ServerConfig(); + serverConfig.loadFromMap( + ImmutableMap.of( + Configs.AUTHENTICATORS.getKey(), "simple", + Configs.REST_API_EXTENSION_PACKAGES.getKey(), "org.apache.gravitino.test.extension"), + t -> true); + + GravitinoServer restServer = + newRestApiTestServer(serverConfig, Set.of("org.apache.gravitino.test.lineage")); + + invokeInitializeRestApi(restServer); + + JerseyTest jerseyTest = + new JerseyTest() { + @Override + protected Application configure() { + return restServer; + } + }; + + try { + jerseyTest.setUp(); + assertIdpInterfaceNotFound(jerseyTest, "/idp/users/user1"); + assertIdpInterfaceNotFound(jerseyTest, "/idp/groups/group1"); + } finally { + jerseyTest.tearDown(); + } + } + + private GravitinoServer newRestApiTestServer( + ServerConfig serverConfig, Set<String> lineagePackages) throws IllegalAccessException { + GravitinoEnv gravitinoEnv = Mockito.mock(GravitinoEnv.class); + mockDispatchers(gravitinoEnv); + + GravitinoServer restServer = new GravitinoServer(serverConfig, gravitinoEnv); + JettyServer jettyServer = Mockito.mock(JettyServer.class); + ThreadPool threadPool = Mockito.mock(ThreadPool.class); + LineageService lineageService = Mockito.mock(LineageService.class); + + Mockito.when(jettyServer.getThreadPool()).thenReturn(threadPool); + Mockito.when(lineageService.getRESTPackages()).thenReturn(lineagePackages); + + FieldUtils.writeField(restServer, "server", jettyServer, true); + FieldUtils.writeField(restServer, "lineageService", lineageService, true); + return restServer; + } + + private void mockDispatchers(GravitinoEnv gravitinoEnv) { + Mockito.when(gravitinoEnv.metalakeDispatcher()) + .thenReturn(Mockito.mock(MetalakeDispatcher.class)); + Mockito.when(gravitinoEnv.catalogDispatcher()) + .thenReturn(Mockito.mock(CatalogDispatcher.class)); + Mockito.when(gravitinoEnv.schemaDispatcher()).thenReturn(Mockito.mock(SchemaDispatcher.class)); + Mockito.when(gravitinoEnv.tableDispatcher()).thenReturn(Mockito.mock(TableDispatcher.class)); + Mockito.when(gravitinoEnv.partitionDispatcher()) + .thenReturn(Mockito.mock(PartitionDispatcher.class)); + Mockito.when(gravitinoEnv.filesetDispatcher()) + .thenReturn(Mockito.mock(FilesetDispatcher.class)); + Mockito.when(gravitinoEnv.topicDispatcher()).thenReturn(Mockito.mock(TopicDispatcher.class)); + Mockito.when(gravitinoEnv.tagDispatcher()).thenReturn(Mockito.mock(TagDispatcher.class)); + Mockito.when(gravitinoEnv.policyDispatcher()).thenReturn(Mockito.mock(PolicyDispatcher.class)); + Mockito.when(gravitinoEnv.credentialOperationDispatcher()) + .thenReturn(Mockito.mock(CredentialOperationDispatcher.class)); + Mockito.when(gravitinoEnv.modelDispatcher()).thenReturn(Mockito.mock(ModelDispatcher.class)); + Mockito.when(gravitinoEnv.functionDispatcher()) + .thenReturn(Mockito.mock(FunctionDispatcher.class)); + Mockito.when(gravitinoEnv.jobOperationDispatcher()) + .thenReturn(Mockito.mock(JobOperationDispatcher.class)); + Mockito.when(gravitinoEnv.statisticDispatcher()) + .thenReturn(Mockito.mock(StatisticDispatcher.class)); + } Review Comment: `mockDispatchers(...)` stubs many dispatchers but not `gravitinoEnv.viewDispatcher()`, even though `GravitinoServer.initializeRestApi()` binds it into HK2. Returning null here can make the test fragile (depending on HK2 behavior) and can break if any resource later requests `ViewDispatcher`. Stub `viewDispatcher()` (and any other newly bound dispatcher) to a Mockito mock like the others. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
