This is an automated email from the ASF dual-hosted git repository. liyang-kylin pushed a commit to branch kylin5 in repository https://gitbox.apache.org/repos/asf/kylin.git
commit 4abaee62b270dbfc566d8a23a3795f8c36c2f63c Author: Li Yang <[email protected]> AuthorDate: Sat Nov 7 16:07:46 2026 +0800 KYLIN-6125 enforce internal table read authorization --- .../apache/kylin/rest/service/InternalTableServiceTest.java | 13 +++++++++++++ .../org/apache/kylin/rest/service/InternalTableService.java | 2 ++ 2 files changed, 15 insertions(+) diff --git a/src/data-loading-service/src/test/java/org/apache/kylin/rest/service/InternalTableServiceTest.java b/src/data-loading-service/src/test/java/org/apache/kylin/rest/service/InternalTableServiceTest.java index c2ebb7076f..73f0f990a8 100644 --- a/src/data-loading-service/src/test/java/org/apache/kylin/rest/service/InternalTableServiceTest.java +++ b/src/data-loading-service/src/test/java/org/apache/kylin/rest/service/InternalTableServiceTest.java @@ -91,6 +91,7 @@ import org.mockito.MockedStatic; import org.mockito.Mockito; import org.mockito.MockitoAnnotations; import org.mockito.Spy; +import org.springframework.security.access.AccessDeniedException; import org.springframework.security.authentication.TestingAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; @@ -348,6 +349,18 @@ public class InternalTableServiceTest extends AbstractTestCase { } + @Test + void testInternalTableReadsCheckProjectReadPermission() { + Mockito.doThrow(new AccessDeniedException("Access is denied")).when(aclEvaluate) + .checkProjectReadPermission(PROJECT); + + Assertions.assertThrows(AccessDeniedException.class, + () -> internalTableService.getTableList(PROJECT, false, true, "", "")); + Assertions.assertThrows(AccessDeniedException.class, + () -> internalTableService.getTableDetail(PROJECT, "DEFAULT", "TEST_KYLIN_FACT")); + Mockito.verify(aclEvaluate, Mockito.times(2)).checkProjectReadPermission(PROJECT); + } + @Test void testReloadInternalTableSchema() throws Exception { KylinConfig config = KylinConfig.getInstanceFromEnv(); diff --git a/src/datasource-service/src/main/java/org/apache/kylin/rest/service/InternalTableService.java b/src/datasource-service/src/main/java/org/apache/kylin/rest/service/InternalTableService.java index 0914d14e95..2ff92fe14b 100644 --- a/src/datasource-service/src/main/java/org/apache/kylin/rest/service/InternalTableService.java +++ b/src/datasource-service/src/main/java/org/apache/kylin/rest/service/InternalTableService.java @@ -418,6 +418,7 @@ public class InternalTableService extends BasicService { public List<InternalTableDescResponse> getTableList(String project, boolean isFuzzy, boolean needDetails, String databaseName, String tableName) { + aclEvaluate.checkProjectReadPermission(project); InternalTableManager internalTableManager = getManager(InternalTableManager.class, project); List<InternalTableDesc> tableList; if (StringUtils.isNotBlank(databaseName) || StringUtils.isNotBlank(tableName)) { @@ -434,6 +435,7 @@ public class InternalTableService extends BasicService { } public List<InternalTablePartitionDetail> getTableDetail(String project, String databaseName, String tableName) { + aclEvaluate.checkProjectReadPermission(project); InternalTableManager internalTableManager = getManager(InternalTableManager.class, project); String tableIdentity = databaseName + "." + tableName; InternalTableDesc internalTableDesc = internalTableManager.getInternalTableDesc(tableIdentity);
