xiangfu0 opened a new pull request, #19234:
URL: https://github.com/apache/pinot/pull/19234
## Summary
- apply configured cluster-level CRUD permissions for both controller
BasicAuth implementations
- share authorization target resolution between coarse and fine-grained
checks
- mark mutation-capable controller callbacks with their required access type
- preserve existing table-scoped behavior and legacy wildcard permissions
## Root cause
The cluster-level BasicAuth path authenticated the principal without
applying the requested CRUD permission. Authorization target selection also
relied partly on URI parameter names, which could diverge from the endpoint's
declared target.
## Compatibility
- principals with explicit permission lists are denied operations outside
that list
- empty permission lists retain their existing wildcard behavior
- invalid credentials return 401; authenticated but unauthorized requests
return 403
- table-scoped READ, CREATE, UPDATE, and DELETE behavior remains unchanged
## How to reproduce
Run the controller authorization regression suite against the base revision.
The new restricted-principal assertions demonstrate the behavior difference;
the updated implementation makes the complete permission and status-code matrix
pass.
## Testing
- `./mvnw -pl pinot-controller -am -Ppinot-fastdev
-Dtest=BasicAuthAccessControlFactoryTest,AuthenticationFilterTest,ControllerClusterBasicAuthAuthorizationTest,PinotUserWithAccessLogicalTableResourceTest
-Dsurefire.failIfNoSpecifiedTests=false test`
- 33 tests, 0 failures, 0 errors, 0 skipped
- `./mvnw -pl pinot-common,pinot-core,pinot-controller spotless:apply
license:format spotless:check checkstyle:check license:check`
- passed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
