chaitalicod opened a new pull request, #724: URL: https://github.com/apache/atlas/pull/724
…ia caller-supplied guid ## What changes were proposed in this pull request? *PreRequisites* Two authenticated users with permissions to use saved-search APIs (for example: userA, userB). *Steps* Login as userA and create a saved search using: POST /api/atlas/v2/search/saved capture the returned guid (call it G1). Login as userB and send another create request to: POST /api/atlas/v2/search/saved include: ownerName = userB guid = G1 different name / searchParameters. *Fetch saved searches for both users:* GET /api/atlas/v2/search/saved?user=userB GET /api/atlas/v2/search/saved?user=userA *Observed Result* The object with guid = G1 now appears under userB with updated content. userA no longer has that saved search entry with G1. *Expected Result* Create API should not allow client-supplied guid to update an existing saved-search object owned by another user. POST create should either reject non-empty guid or ignore it and always create a new object ## How was this patch tested? Ran tests ATLAS="http://localhost:21000/api/atlas/v2/search"; U1="admin:admin" U2="bob:bob123" TS=$(date +%s) ADMIN_NAME="admin-search-$TS" BOB_NAME="bob-search-$TS" ADMIN_CREATE=$(curl -sS -u "$U1" -H "Content-Type: application/json" \ -X POST "$ATLAS/saved" --data @- <<EOF { "guid":"", "name":"$ADMIN_NAME", "ownerName":"admin", "searchType":"BASIC", "searchParameters":{"typeName":"hive_table","excludeDeletedEntities":true} } EOF ) echo "$ADMIN_CREATE" | jq . ADMIN_GUID=$(echo "$ADMIN_CREATE" | jq -r '.guid') echo "ADMIN_GUID=$ADMIN_GUID" BOB_OVERWRITE=$(curl -sS -u "$U2" -H "Content-Type: application/json" \ -X POST "$ATLAS/saved" --data @- <<EOF { "guid":"$ADMIN_GUID", "name":"$BOB_NAME", "ownerName":"bob", "searchType":"BASIC", "searchParameters":{"typeName":"hive_table","excludeDeletedEntities":true} } EOF ) echo "$BOB_OVERWRITE" | jq . { "guid": "6baabe6d-00c3-4e84-8481-4a67fa74f572", "ownerName": "admin", "name": "admin-search-1786438863", "searchType": "BASIC", "searchParameters": { "typeName": "hive_table", "excludeDeletedEntities": true, "includeClassificationAttributes": false, "includeSubTypes": true, "includeSubClassifications": true, "excludeHeaderAttributes": false, "limit": 0, "offset": 0 } } ADMIN_GUID=6baabe6d-00c3-4e84-8481-4a67fa74f572 { "errorCode": "ATLAS-400-00-029", "errorMessage": "invalid data" } -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
