mengw15 opened a new pull request, #7014:
URL: https://github.com/apache/texera/pull/7014
### What changes were proposed in this PR?
`retrieveWorkflowRuntimeStatistics` (`GET /executions/{wid}/stats/{eid}`)
was the only endpoint in `WorkflowExecutionsResource` declaring neither
`@RolesAllowed` nor an `@Auth` parameter — every other handler in the class
carries `@RolesAllowed(Array("REGULAR", "ADMIN"))` + `@Auth sessionUser`, and
there is no class-level annotation to fall back on. Auth is enforced per-method
via `RolesAllowedDynamicFeature`, so this one handler was reachable without
authentication.
- Add `@RolesAllowed(Array("REGULAR", "ADMIN"))` and an `@Auth sessionUser:
SessionUser` parameter, matching the sibling endpoints exactly.
- Add an **auth-annotation audit test** to `WorkflowExecutionsResourceSpec`:
it reflects over every `@GET/@PUT/@POST/@DELETE` handler in the class and
asserts each declares `@RolesAllowed` and takes an `@Auth` parameter — so any
future endpoint added without auth turns the suite red instead of shipping
unprotected. `exportResultToLocal` is explicitly exempted with a comment: it
serves a browser form-submit download (which can't carry an `Authorization`
header), so its JWT arrives as a form field and is verified in-method via
`JwtParser.parseToken`, including the role check.
The frontend is unaffected: `JwtModule` attaches the `Authorization` header
to every request (`app.module.ts`), and the same service already calls sibling
endpoints that require auth.
### Any related issues, documentation, discussions?
Closes #6977.
### How was this PR tested?
- The audit test **fails before the fix**, naming exactly
`retrieveWorkflowRuntimeStatistics` as the offender, and passes after — the
failing run is the repro for the issue. (Its first run also flagged
`exportResultToLocal`; on inspection that endpoint authenticates manually by
design — see above — which is why the exemption is explicit and documented
rather than silent.)
- Full `WorkflowExecutionsResourceSpec` run locally: all tests pass;
`WorkflowExecutionService/scalafmtCheck` (main + Test) passes.
- Verified no other caller of the method exists (the added parameter breaks
no call site), and that all sibling endpoints use the identical annotation
pattern being applied here.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (claude-opus-4-8)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
