Vamsi-klu commented on code in PR #18975:
URL: https://github.com/apache/pinot/pull/18975#discussion_r3817439217
##########
pinot-controller/src/main/java/org/apache/pinot/controller/api/access/BaseBasicAuthAccessControl.java:
##########
@@ -48,22 +55,36 @@ public final boolean hasAccess(String tableName, AccessType
accessType, HttpHead
&& authenticatedPrincipal.hasPermission(Objects.toString(accessType));
}
+ /// Guards endpoints that name no table. Such a request is cluster-wide, so
beyond the requested permission it
+ /// requires a principal whose table scope is unrestricted: a principal
confined to a subset of tables must not reach
+ /// cluster state that lies outside that subset.
@Override
public final boolean hasAccess(AccessType accessType, HttpHeaders
httpHeaders, String endpointUrl) {
Optional<P> principal = getPrincipal(httpHeaders);
if (principal.isEmpty()) {
throw new NotAuthorizedException("Basic");
}
- return principal.get().hasPermission(Objects.toString(accessType));
+ P authenticatedPrincipal = principal.get();
+ return authenticatedPrincipal.hasUnrestrictedTableAccess()
+ && authenticatedPrincipal.hasPermission(Objects.toString(accessType));
Review Comment:
Yeah, that one is a data-path break, not a UI annoyance. I added
LLCSegmentCompletionHandlers and the minion callbacks that carry no tableName
to the Backward-incompatible list, next to POST /segments. Helm now says the
same thing: if
[pinot.server.segment.uploader.auth.token](https://github.com/apache/pinot/pull/18975#)
(or the controller-facing token) is a table-scoped principal, move it to an
unrestricted one before you roll controllers, or commit stalls with 403.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
