Copilot commented on code in PR #10771:
URL: https://github.com/apache/ozone/pull/10771#discussion_r3593189823
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OmMetadataReader.java:
##########
@@ -673,9 +673,16 @@ public boolean checkAcls(OzoneObj obj,
RequestContext.Builder contextBuilder,
* thread locals: the session policy from {@link STSTokenIdentifier} (set on
STS requests) and the
* S3 action from {@link S3Authentication} (set on S3 requests). Either or
both may be absent, in
* which case the corresponding field is left untouched on the builder.
+ * <p>
+ * The S3 action is only propagated when the S3 STS feature flag is enabled,
since it is only used
+ * for fine-grained STS authorization.
* @param contextBuilder the builder to enrich in-place
*/
- public static void maybeAddToContextFromThreadLocal(RequestContext.Builder
contextBuilder) {
+ private void maybeAddToContextFromThreadLocal(RequestContext.Builder
contextBuilder) {
+ if (!ozoneManager.isS3STSEnabled()) {
+ return;
+ }
Review Comment:
The Javadoc says only the S3 action propagation is gated by the S3 STS
feature flag, but the implementation returns early when STS is disabled, which
also skips propagating the session policy. Please update the comment to reflect
the actual behavior (or adjust the gating logic if sessionPolicy should still
be propagated).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
