This is an automated email from the ASF dual-hosted git repository. liyang-kylin pushed a commit to branch kylin5 in repository https://gitbox.apache.org/repos/asf/kylin.git
commit 08e89f2bb359fdceaa733bc725c2f71af3bb08f5 Author: Li Yang <[email protected]> AuthorDate: Fri Oct 2 09:30:20 2026 +0800 KYLIN-6103 improve ProjectService permission control --- .../java/org/apache/kylin/rest/service/ProjectService.java | 1 + .../org/apache/kylin/rest/service/ProjectServiceTest.java | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/src/common-service/src/main/java/org/apache/kylin/rest/service/ProjectService.java b/src/common-service/src/main/java/org/apache/kylin/rest/service/ProjectService.java index 3c5a1a8968..4f96e6ad7d 100644 --- a/src/common-service/src/main/java/org/apache/kylin/rest/service/ProjectService.java +++ b/src/common-service/src/main/java/org/apache/kylin/rest/service/ProjectService.java @@ -1294,6 +1294,7 @@ public class ProjectService extends BasicService { @Transaction(project = 0) public void updateJdbcConfig(String project, JdbcRequest jdbcRequest) { + aclEvaluate.checkProjectAdminPermission(project); Map<String, String> overrideKylinProps = Maps.newLinkedHashMap(); overrideKylinProps.put("kylin.source.jdbc.connection-url", jdbcRequest.getUrl()); overrideKylinProps.put("kylin.source.jdbc.driver", jdbcRequest.getDriver()); diff --git a/src/modeling-service/src/test/java/org/apache/kylin/rest/service/ProjectServiceTest.java b/src/modeling-service/src/test/java/org/apache/kylin/rest/service/ProjectServiceTest.java index 4745d6c63e..e056f41516 100644 --- a/src/modeling-service/src/test/java/org/apache/kylin/rest/service/ProjectServiceTest.java +++ b/src/modeling-service/src/test/java/org/apache/kylin/rest/service/ProjectServiceTest.java @@ -97,6 +97,7 @@ import org.mockito.InjectMocks; import org.mockito.Mock; import org.mockito.Mockito; import org.springframework.mock.web.MockMultipartFile; +import org.springframework.security.access.AccessDeniedException; import org.springframework.security.authentication.TestingAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.core.userdetails.UserDetails; @@ -970,6 +971,16 @@ public class ProjectServiceTest extends NLocalFileMetadataTestCase { projectInstances.get(0).getProject().getOverrideKylinProps().get("kylin.source.jdbc.pass")); } + @Test + public void testUpdateJdbcConfigCheckProjectAdminPermission() { + Mockito.doThrow(new AccessDeniedException("Access is denied")).when(aclEvaluate) + .checkProjectAdminPermission(PROJECT); + + Assert.assertThrows(AccessDeniedException.class, + () -> projectService.updateJdbcConfig(PROJECT, new JdbcRequest())); + Mockito.verify(aclEvaluate).checkProjectAdminPermission(PROJECT); + } + @Test public void testUpdateJdbcInfo() { ProjectInstance projectInstance = new ProjectInstance();
