Yutong-1424 opened a new pull request, #7391:
URL: https://github.com/apache/kyuubi/pull/7391
<!--
Thanks for sending a pull request!
Here are some tips for you:
1. If this is your first time, please read our contributor guidelines:
https://kyuubi.readthedocs.io/en/master/contributing/code/index.html
2. If the PR is related to an issue in
https://github.com/apache/kyuubi/issues, add '[KYUUBI #XXXX]' in your PR title,
e.g., '[KYUUBI #XXXX] Your PR title ...'.
3. If the PR is unfinished, add '[WIP]' in your PR title, e.g.,
'[WIP][KYUUBI #XXXX] Your PR title ...'.
-->
### Why are the changes needed?
1. Sensitive settings in session APIs
Session APIs were returning full session configs as-is. Some keys
(passwords, tokens, etc.) should not be shown to clients or in traces. This
patch applies the same redaction pattern the server already uses elsewhere
(SERVER_SECRET_REDACTION_PATTERN + Utils.redact) so list/detail responses don’t
expose those values in plain text.
2. Over-broad session listing
GET /api/v1/sessions returned every session on the server. With auth turned
on, it should only return sessions for the logged-in user, not everyone else’s
### How was this patch tested?
Added a REST test that opens a session with a sensitive Spark key, calls GET
/api/v1/sessions, and checks the value is redacted.
Updated the session control CLI test so the session is opened with the same
user the test client uses for auth, so the “list sessions” output matches real
usage.
Verified tests run locally
### Was this patch authored or co-authored using generative AI tooling?
No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
