SEZ9 commented on PR #10838: URL: https://github.com/apache/seatunnel/pull/10838#issuecomment-6104893662
Thanks for syncing the branch with `dev` — the merge conflicts in `Constant.java` and `RestConstant.java` are resolved and the merge-state blocker from my earlier comment is cleared. Those two files now only carry the PR's additive lines (`IMAP_METADATA_DATASOURCE`, `STATUS`/`MESSAGE`, and the two `/metadata/datasource(s)` URLs), which is what I'd expect. On the other half of the ask: comparing the diff against the merge base at `86d128c3b8` and at the current head `e3317f38`, the author-side changes are identical — the only new commits are merges of `dev`. That means the source review items from the earlier review still stand unchanged on this head. In particular, the management write-surface / security-boundary concern is still open: the `POST`/`PUT`/`DELETE` `/metadata/datasource` routes are mounted whenever `metadata.enabled && kind=dynamic`, but `JettyService` only enforces basic auth when `isEnableBasicAuth()` is set, so a secret-bearing write API can be exposed without authentication by default. This needs to fail closed. Concrete remaining asks before I do another full pass: 1. Address the write-surface protection so the metadata datasource write endpoints are not reachable unauthenticated by default (either require auth for these routes regardless of the global basic-auth toggle, or refuse to mount them when auth is disabled), plus a test covering that behavior. 2. Work through the remaining source findings from the earlier review on this head, and leave a short note on the PR summarizing what changed per item. 3. Keep the branch current with `dev` after those changes land so it stays conflict-free. Once an updated revision with the source changes is pushed, I'll re-review the full diff promptly. <!-- streview-comment:1668 --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
