This is an automated email from the ASF dual-hosted git repository.
aho135 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new c217127a35d fix: Change auth from WRITE to READ for specGetAll (#19272)
c217127a35d is described below
commit c217127a35dc11c86d564014c16d1429a2412c19
Author: aho135 <[email protected]>
AuthorDate: Tue Apr 21 12:05:13 2026 -0700
fix: Change auth from WRITE to READ for specGetAll (#19272)
* Change auth from WRITE to READ for specGetAll
* Add authorizationFn parameter to filterAuthorizedSupervisorIds
* Fix indentation
---
.../overlord/supervisor/SupervisorResource.java | 14 +++++++++-----
.../overlord/supervisor/SupervisorResourceTest.java | 19 +++++++++++++++++++
2 files changed, 28 insertions(+), 5 deletions(-)
diff --git
a/indexing-service/src/main/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResource.java
b/indexing-service/src/main/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResource.java
index fc1767a3594..aff9edf19af 100644
---
a/indexing-service/src/main/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResource.java
+++
b/indexing-service/src/main/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResource.java
@@ -214,7 +214,8 @@ public class SupervisorResource
Set<String> authorizedSupervisorIds = filterAuthorizedSupervisorIds(
req,
manager,
- manager.getSupervisorIds()
+ manager.getSupervisorIds(),
+ AuthorizationUtils.DATASOURCE_READ_RA_GENERATOR
);
final boolean includeFull = full != null;
final boolean includeState = state != null && state;
@@ -509,7 +510,8 @@ public class SupervisorResource
Set<String> authorizedSupervisorIds = filterAuthorizedSupervisorIds(
req,
manager,
- manager.getSupervisorIds()
+ manager.getSupervisorIds(),
+ AuthorizationUtils.DATASOURCE_WRITE_RA_GENERATOR
);
for (final String supervisorId : authorizedSupervisorIds) {
@@ -652,7 +654,8 @@ public class SupervisorResource
private Set<String> filterAuthorizedSupervisorIds(
final HttpServletRequest req,
SupervisorManager manager,
- Collection<String> supervisorIds
+ Collection<String> supervisorIds,
+ Function<String, ResourceAction> authorizationFn
)
{
Function<String, Iterable<ResourceAction>> raGenerator = supervisorId -> {
@@ -660,7 +663,7 @@ public class SupervisorResource
if (supervisorSpecOptional.isPresent()) {
return Iterables.transform(
supervisorSpecOptional.get().getDataSources(),
- AuthorizationUtils.DATASOURCE_WRITE_RA_GENERATOR
+ authorizationFn
);
} else {
return null;
@@ -710,7 +713,8 @@ public class SupervisorResource
Set<String> authorizedSupervisorIds = filterAuthorizedSupervisorIds(
req,
manager,
- manager.getSupervisorIds()
+ manager.getSupervisorIds(),
+ AuthorizationUtils.DATASOURCE_WRITE_RA_GENERATOR
);
for (final String supervisorId : authorizedSupervisorIds) {
diff --git
a/indexing-service/src/test/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResourceTest.java
b/indexing-service/src/test/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResourceTest.java
index 268f6432a1d..bb7581ee874 100644
---
a/indexing-service/src/test/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResourceTest.java
+++
b/indexing-service/src/test/java/org/apache/druid/indexing/overlord/supervisor/SupervisorResourceTest.java
@@ -374,6 +374,25 @@ public class SupervisorResourceTest extends EasyMockSupport
Assert.assertEquals(503, response.getStatus());
}
+ @Test
+ public void testSpecGetAllWithPartialAuthorizationForReadAccess()
+ {
+
EasyMock.expect(taskMaster.getSupervisorManager()).andReturn(Optional.of(supervisorManager));
+
EasyMock.expect(supervisorManager.getSupervisorIds()).andReturn(SUPERVISOR_IDS).atLeastOnce();
+
EasyMock.expect(supervisorManager.getSupervisorSpec(SPEC1.getId())).andReturn(Optional.of(SPEC1));
+
EasyMock.expect(supervisorManager.getSupervisorSpec(SPEC2.getId())).andReturn(Optional.of(SPEC2));
+ setupMockRequestForUser("notDruid");
+ replayAll();
+
+ Response response = supervisorResource.specGetAll(null, null, null,
request);
+ verifyAll();
+
+ Assert.assertEquals(200, response.getStatus());
+ // Only id1 (datasource1) should be returned since user lacks READ access
to datasource2
+ Set<String> returnedIds = (Set<String>) response.getEntity();
+ Assert.assertEquals(ImmutableSet.of("id1"), returnedIds);
+ }
+
@Test
public void testSpecGetAllFull()
{
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
