github-actions[bot] commented on code in PR #68147:
URL: https://github.com/apache/doris/pull/68147#discussion_r4040748654
##########
fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/info/CreateResourceInfo.java:
##########
@@ -75,6 +77,13 @@ public void validate() throws UserException {
}
analyzeResourceType();
+
+ if (resourceType == ResourceType.AI &&
!"*".equals(Config.ai_resource_allowed_user)) {
+ UserIdentity allowedUser =
UserIdentity.fromString(Config.ai_resource_allowed_user);
Review Comment:
[P2] Reject malformed configured identities explicitly.
UserIdentity.fromString returns null for values such as root@%, so this FE
starts normally and every AI CREATE later falls through to the generic
caller-denied error. Because this field is not mutable, the operator cannot
correct the typo without another restart. Please validate the value at
configuration load, or at least detect null here and report
ai_resource_allowed_user and its required syntax; add a malformed-value test.
##########
fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/info/CreateResourceInfo.java:
##########
@@ -75,6 +77,13 @@ public void validate() throws UserException {
}
analyzeResourceType();
+
+ if (resourceType == ResourceType.AI &&
!"*".equals(Config.ai_resource_allowed_user)) {
+ UserIdentity allowedUser =
UserIdentity.fromString(Config.ai_resource_allowed_user);
+ if
(!ConnectContext.get().getCurrentUserIdentity().equals(allowedUser)) {
Review Comment:
[P2] Support the external/JIT identities admitted by the preceding privilege
check. JIT authentication builds the current identity as principal@remoteIp,
but UserIdentity.fromString splits on every @. An email-style principal such as
[email protected] is therefore impossible to configure even with an exact host;
principals without @ are still pinned to one client IP because equals does not
apply host-pattern semantics. Please define this setting against a stable
authenticated principal or use a validated quote-aware selector, or explicitly
reject/document JIT identities and cover that contract in tests.
##########
fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/info/CreateResourceInfo.java:
##########
@@ -75,6 +77,13 @@ public void validate() throws UserException {
}
analyzeResourceType();
+
+ if (resourceType == ResourceType.AI &&
!"*".equals(Config.ai_resource_allowed_user)) {
+ UserIdentity allowedUser =
UserIdentity.fromString(Config.ai_resource_allowed_user);
+ if
(!ConnectContext.get().getCurrentUserIdentity().equals(allowedUser)) {
+ throw new AnalysisException("Current user does not have
permission to create AI resources");
Review Comment:
[P2] Preserve an access-denied SQL error here. The string-only
AnalysisException constructor leaves mysqlErrorCode at ERR_UNKNOWN_ERROR, so
this deliberate authorization rejection is returned as 1105/HY000, unlike the
adjacent ADMIN check (1227/42000). Clients that classify permission failures
will treat this as an internal error. Please use an appropriate access-denied
ErrorCode (or a dedicated 5000-series code) and assert the protocol error code
in the test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
