roryqi opened a new pull request, #12778: URL: https://github.com/apache/gravitino/pull/12778
### What changes were proposed in this pull request? - Stop automatically exposing `gravitino.authorization.serviceAdmins` through the unauthenticated `/configs` endpoint. - Remove `gravitino.authorization.serviceAdmins` from the default `visibleConfigs` configuration. - Extend `/api/authn/me` with a `serviceAdmin` boolean for the current authenticated user. - Update web-v2 to use the server-resolved administrator status instead of downloading the full administrator list. - Add server, DTO, and web-v2 reducer tests and update the OpenAPI documentation. ### Why are the changes needed? The unauthenticated `/configs` endpoint currently exposes the principals with service-administrator privileges. This leaks high-value account names before authentication. The UI only needs to know whether the current authenticated user is a service administrator; it does not need the complete administrator list. Fix: #12777 ### Does this PR introduce _any_ user-facing change? Yes. - `/api/authn/me` now includes a `serviceAdmin` boolean. - `/configs` no longer exposes `gravitino.authorization.serviceAdmins` by default. - The web UI continues to show service-administrator actions based on the authenticated user's server-resolved privileges. Operators can still explicitly expose the property through `gravitino.server.visibleConfigs`. ### How was this patch tested? - `./gradlew spotlessApply` - `./gradlew :common:test --tests org.apache.gravitino.dto.responses.TestResponses` - `./gradlew :server:test --tests org.apache.gravitino.server.web.TestConfigServlet --tests org.apache.gravitino.server.web.rest.TestAuthnOperations` - `./gradlew :docs:build` - Formatted the changed web-v2 files with Prettier. - Bundled the changed JavaScript files with esbuild to validate their syntax. A web-v2 reducer test was added. The full Vitest suite was not run locally because installing the frontend dependencies exceeded the available workspace disk. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
