HappenLee commented on code in PR #68147:
URL: https://github.com/apache/doris/pull/68147#discussion_r4043587221
##########
fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/info/CreateResourceInfo.java:
##########
@@ -75,6 +77,13 @@ public void validate() throws UserException {
}
analyzeResourceType();
+
+ if (resourceType == ResourceType.AI &&
!"*".equals(Config.ai_resource_allowed_user)) {
+ UserIdentity allowedUser =
UserIdentity.fromString(Config.ai_resource_allowed_user);
+ if
(!ConnectContext.get().getCurrentUserIdentity().equals(allowedUser)) {
+ throw new AnalysisException("Current user does not have
permission to create AI resources");
Review Comment:
Confirmed against `182fc371e38e`: if `ai_resource_allowed_user` is set to
`'root'@'%'` and another ADMIN user tries to create an AI resource, this check
throws the string-only `AnalysisException`. That constructor defaults to
`ERR_UNKNOWN_ERROR`, and the `StmtExecutor` / `MysqlErrPacket` path preserves
it as **1105 / HY000**. The existing ADMIN check in the same method reports
**1227 / 42000**, so clients classifying failures by error code cannot
recognize this new rejection as an authorization failure.
Could we use an appropriate access-denied `ErrorCode` while retaining a
message that explains the configured identity restriction? The caller has
already passed the ADMIN check, so the message should not suggest that granting
ADMIN will fix it.
Please also assert `getMysqlErrorCode()` in the unit test. The current
assertion on the message's `errCode = 2` checks Doris's internal error code,
not the MySQL protocol error code. I ran `CreateResourceCommandTest` locally:
all five tests pass, but this distinction is currently untested.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
