pan3793 commented on code in PR #7391:
URL: https://github.com/apache/kyuubi/pull/7391#discussion_r3072830967
##########
kyuubi-server/src/main/scala/org/apache/kyuubi/server/api/v1/SessionsResource.scala:
##########
@@ -52,11 +52,15 @@ private[v1] class SessionsResource extends
ApiRequestContext with Logging {
content = Array(new Content(
mediaType = MediaType.APPLICATION_JSON,
array = new ArraySchema(schema = new Schema(implementation =
classOf[SessionData])))),
- description = "get the list of all live sessions")
+ description = "get the list of live sessions for the current user")
@GET
def sessions(): Seq[SessionData] = {
- sessionManager.allSessions()
- .map(session =>
ApiUtils.sessionData(session.asInstanceOf[KyuubiSession])).toSeq
+ val userName = fe.getSessionUser(Map.empty[String, String])
+ sessionManager
+ .allSessions()
+ .filter(session => session.user == userName)
Review Comment:
it's reasonable for security purposes, but it's a breaking change.
I would suggest making this change independent, with an internal legacy
config switch (something like
`kyuubi.frontend.rest.v1.legacy.sessionsReturnAllUsers`), and adding an item in
the migration guide.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
