[GitHub] [kafka] d8tltanc commented on a change in pull request #9485: KAKFA-10619: Idempotent producer will get authorized once it has a WRITE access to at least one topic

[GitBox]

d8tltanc commented on a change in pull request #9485:
URL: https://github.com/apache/kafka/pull/9485#discussion_r543080612



##########
File path: 
clients/src/main/java/org/apache/kafka/server/authorizer/Authorizer.java
##########
@@ -139,4 +151,126 @@
      * @return Iterator for ACL bindings, which may be populated lazily.
      */
     Iterable<AclBinding> acls(AclBindingFilter filter);
+
+    /**
+     * Check if the caller is authorized to perform the given ACL operation on 
at least one
+     * resource of the given type.
+     *
+     * 1. Filter out all the resource pattern corresponding to the 
requestContext, AclOperation,
+     *    and ResourceType
+     * 2. If wildcard deny exists, return deny directly
+     * 3. For any literal allowed resource, if there's no dominant literal 
denied resource, and
+     *    no dominant prefixed denied resource, return allow
+     * 4. For any prefixed allowed resource, if there's no dominant denied 
resource, return allow
+     * 5. For any other cases, return deny

Review comment:
       Sure. commit 25e0bfcc97f956ceb4254ab8c457fe5d8d250e82




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org