Felix-Gong opened a new pull request, #11471: URL: https://github.com/apache/rocketmq/pull/11471
Fixes #11470 `ProxyAdminAuthInterceptor` skipped authorization for any method missing from `METHOD_PERMISSIONS` — the branch was `resourceAction != null && authzEnabled`, so an unmapped served method ran with authentication only, in both normal and fail-closed (`grpcAdminServerAuthEnable`) configurations. Nothing is unmapped on develop today, but the Admin surface grows through rocketmq-apis (three recent expansions) and nothing pins the proto against the hand-written map, so the next RPC added without an entry would be an unauthorized path by construction. Two changes, one theme: - **Runtime**: when `authorizationEnabled` is on, a method without a `proxy.admin.*` mapping is now closed with `PERMISSION_DENIED` instead of being served. Open mode (cluster auth fully off) is untouched. - **Drift guard**: `everyServedAdminMethodHasAnAclMapping` walks `AdminGrpc.getServiceDescriptor()` and asserts every served RPC resolves to a resource/action, so CI fails the moment a new proto RPC lands without someone deciding its ACL. Red/green: `unmappedMethodIsDeniedWhenAuthorizationEnabled` passes on the current code (verified by stashing the fix — it asserts `startCall` never happens and the status is `PERMISSION_DENIED`). `ProxyAdminAuthInterceptorTest` 9/9, full `proxy` module 455 tests green on JDK 11. Coordination: PR #11363 (for #11362) changes `resolveSourceIp` in the same two files — different concern (which address is evaluated vs whether an authorization decision exists at all). The hunks are adjacent where it updates the `resolveSourceIp(call)` call site inside the block this PR restructures; a trivial rebase either way, happy to rebase once it lands. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
