This is an automated email from the ASF dual-hosted git repository. imbajin pushed a commit to branch cx/bump-server-api-version in repository https://gitbox.apache.org/repos/asf/hugegraph.git
commit 28641f5431f14dda78001660bf6cf3ff4a61c4d8 Author: dark <[email protected]> AuthorDate: Tue Aug 18 13:29:26 2026 +0800 fix(server): preserve anonymous template ownership - defer authenticator lookup until manager access is needed - keep anonymous creators on the owner mutation path - cover lazy owner and manager authorization paths --- .../hugegraph/api/space/SchemaTemplateAPI.java | 17 ++++++++++----- .../unit/api/space/SchemaTemplateAPITest.java | 25 +++++++++++++++------- 2 files changed, 29 insertions(+), 13 deletions(-) diff --git a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/space/SchemaTemplateAPI.java b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/space/SchemaTemplateAPI.java index afdb9505a..cffca156c 100644 --- a/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/space/SchemaTemplateAPI.java +++ b/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/space/SchemaTemplateAPI.java @@ -20,6 +20,7 @@ package org.apache.hugegraph.api.space; import java.util.Date; import java.util.Objects; import java.util.Set; +import java.util.function.Supplier; import org.apache.commons.lang3.StringUtils; import org.apache.hugegraph.HugeException; @@ -135,7 +136,8 @@ public class SchemaTemplateAPI extends API { "Schema template '%s' does not exist", name); String username = HugeGraphAuthProxy.username(); - if (canManage(manager.authManager(), graphSpace, st.creator(), username)) { + if (canManage(manager::authManager, graphSpace, st.creator(), + username)) { manager.dropSchemaTemplate(graphSpace, name); } else { throw new ForbiddenException("No permission to delete schema template"); @@ -164,7 +166,8 @@ public class SchemaTemplateAPI extends API { } String username = HugeGraphAuthProxy.username(); - if (canManage(manager.authManager(), graphSpace, old.creator(), username)) { + if (canManage(manager::authManager, graphSpace, old.creator(), + username)) { SchemaTemplate template = jsonSchemaTemplate.build(old); template.creator(old.creator()); template.create(old.create()); @@ -177,10 +180,14 @@ public class SchemaTemplateAPI extends API { } - private static boolean canManage(AuthManager authManager, String graphSpace, String creator, + private static boolean canManage(Supplier<AuthManager> authManagerSupplier, + String graphSpace, String creator, String username) { - return Objects.equals(creator, username) || - authManager.isAdminManager(username) || + if (Objects.equals(creator, username)) { + return true; + } + AuthManager authManager = authManagerSupplier.get(); + return authManager.isAdminManager(username) || authManager.isSpaceManager(graphSpace, username); } diff --git a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/unit/api/space/SchemaTemplateAPITest.java b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/unit/api/space/SchemaTemplateAPITest.java index c2be357eb..617957fa5 100644 --- a/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/unit/api/space/SchemaTemplateAPITest.java +++ b/hugegraph-server/hugegraph-test/src/main/java/org/apache/hugegraph/unit/api/space/SchemaTemplateAPITest.java @@ -19,6 +19,8 @@ package org.apache.hugegraph.unit.api.space; +import java.util.function.Supplier; + import org.apache.hugegraph.api.space.SchemaTemplateAPI; import org.apache.hugegraph.auth.AuthManager; import org.apache.hugegraph.testutil.Assert; @@ -33,7 +35,11 @@ public class SchemaTemplateAPITest { @Test public void testCreatorCanManageTemplate() { - Assert.assertTrue(canManage(authManager(false, false), CREATOR)); + Supplier<AuthManager> authManager = + Mockito.mock(Supplier.class); + + Assert.assertTrue(canManage(authManager, CREATOR)); + Mockito.verifyZeroInteractions(authManager); } @Test @@ -43,7 +49,8 @@ public class SchemaTemplateAPITest { @Test public void testSpaceManagerCanManageAnotherUsersTemplate() { - Assert.assertTrue(canManage(authManager(false, true), "space-admin")); + Assert.assertTrue(canManage(authManager(false, true), + "space-admin")); } @Test @@ -51,22 +58,24 @@ public class SchemaTemplateAPITest { Assert.assertFalse(canManage(authManager(false, false), "member")); } - private static AuthManager authManager(boolean admin, - boolean spaceManager) { + private static Supplier<AuthManager> authManager(boolean admin, + boolean spaceManager) { AuthManager auth = Mockito.mock(AuthManager.class); Mockito.when(auth.isAdminManager(Mockito.anyString())) .thenReturn(admin); Mockito.when(auth.isSpaceManager(GRAPHSPACE, "space-admin")) .thenReturn(spaceManager); - return auth; + return () -> auth; } - private static boolean canManage(AuthManager auth, String username) { + private static boolean canManage( + Supplier<AuthManager> authManager, + String username) { return Whitebox.invokeStatic( SchemaTemplateAPI.class, - new Class<?>[]{AuthManager.class, String.class, + new Class<?>[]{Supplier.class, String.class, String.class, String.class}, "canManage", - auth, GRAPHSPACE, CREATOR, username); + authManager, GRAPHSPACE, CREATOR, username); } }
