roryqi commented on code in PR #12850:
URL: https://github.com/apache/gravitino/pull/12850#discussion_r3922716665
##########
server/src/main/java/org/apache/gravitino/server/web/filter/GravitinoInterceptionService.java:
##########
@@ -238,6 +194,24 @@ public Object invoke(MethodInvocation methodInvocation)
throws Throwable {
secondaryExpression,
secondaryExpressionCondition,
expressionAnnotation.allowCheckExistence());
+
authorizationMetalakes.addAll(executor.getAuthorizationMetalakes());
+ }
+
+ for (String metalake : authorizationMetalakes) {
+ Optional<Response> validationFailure =
+ validateCurrentUserAndActiveRoles(
+ NameIdentifier.of(metalake),
+ authorizationRequestContext,
Review Comment:
Fixed in e7f6ccfa2. A lineage RunEvent now has exactly one organization:
job.namespace is the authorization metalake, and every input/output namespace
must match it. Cross-metalake events return 400 before user or active-role
validation, so one AuthorizationRequestContext is never shared across
metalakes. Added regression coverage for mismatches at every input and output
position.
##########
lineage/src/main/java/org/apache/gravitino/lineage/source/rest/LineageOperations.java:
##########
@@ -53,22 +56,28 @@ public LineageOperations(LineageDispatcher
lineageDispatcher) {
@Produces(MediaType.APPLICATION_JSON)
@Timed(name = "post-lineage." + MetricNames.HTTP_PROCESS_DURATION, absolute
= true)
@ResponseMetered(name = "post-lineage", absolute = true)
- public Response postLineage(OpenLineage.RunEvent event) {
- LOG.info(
- "Open lineage event, run id:{}, job name:{}",
- org.apache.gravitino.lineage.Utils.getRunID(event),
- org.apache.gravitino.lineage.Utils.getJobName(event));
-
+ @AuthorizationExpression(expression =
AuthorizationExpressionConstants.CAN_ACCESS_METADATA)
+ public Response postLineage(
+ @AuthorizationRequest(type = AuthorizationRequest.RequestType.LINEAGE)
+ OpenLineage.RunEvent event) {
try {
return Utils.doAs(
httpRequest,
() -> {
+ LineageEventValidator.validate(event);
+ LOG.info(
+ "Open lineage event, run id:{}, job name:{}",
+ org.apache.gravitino.lineage.Utils.getRunID(event),
+ org.apache.gravitino.lineage.Utils.getJobName(event));
if (lineageDispatcher.dispatchLineageEvent(event)) {
return Utils.created();
} else {
return Utils.tooManyRequests();
}
});
+ } catch (IllegalArgumentException e) {
Review Comment:
Fixed in e7f6ccfa2. RunEvent validation now has its own try/catch before
dispatcher execution. An IllegalArgumentException from the dispatcher is
treated as an internal error (500), with a regression test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
