aayush2761 commented on code in PR #11764:
URL: https://github.com/apache/ozone/pull/11764#discussion_r4393682462
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/file/OMRecoverLeaseRequest.java:
##########
@@ -106,11 +106,23 @@ public OMRequest preExecute(OzoneManager ozoneManager)
throws IOException {
keyPath, getBucketLayout());
// check ACL
- checkKeyAcls(ozoneManager,
- recoverLeaseRequest.getVolumeName(),
- recoverLeaseRequest.getBucketName(),
- recoverLeaseRequest.getKeyName(),
- IAccessAuthorizer.ACLType.WRITE, OzoneObj.ResourceType.KEY);
+ try {
+ checkKeyAcls(ozoneManager,
+ recoverLeaseRequest.getVolumeName(),
+ recoverLeaseRequest.getBucketName(),
+ recoverLeaseRequest.getKeyName(),
+ IAccessAuthorizer.ACLType.WRITE, OzoneObj.ResourceType.KEY);
+ } catch (IOException ex) {
+ // Ensure audit log captures preExecute failures
Review Comment:
addressed, Thanks!
##########
hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/file/TestOMRecoverLeaseRequest.java:
##########
@@ -73,6 +82,25 @@ public BucketLayout getBucketLayout() {
return BucketLayout.FILE_SYSTEM_OPTIMIZED;
}
+ @Test
+ public void preExecutePermissionDeniedWhenAclEnabled() {
+ OMRecoverLeaseRequest req = new OMRecoverLeaseRequest(
+ createRecoverLeaseRequest(volumeName, bucketName, keyName, false)) {
+ @Override
+ protected void checkKeyAcls(OzoneManager ozoneManager, String volume,
+ String bucket, String key, IAccessAuthorizer.ACLType aclType,
+ OzoneObj.ResourceType type) throws IOException {
+ throw new OMException("denied",
OMException.ResultCodes.PERMISSION_DENIED);
+ }
+ };
+
+ OMException e = assertThrows(OMException.class, () ->
req.preExecute(ozoneManager));
+ assertEquals(OMException.ResultCodes.PERMISSION_DENIED, e.getResult());
+ // Simulate what OMExecutionFlow does in its catch block: flush the audit
builder
+ OMAuditLogger.log(req.getAuditBuilder());
+ verify(auditLogger).logWrite(any(AuditMessage.class));
Review Comment:
addressed, Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
