From a5b6730d664053be9a451f589bb792549036378a Mon Sep 17 00:00:00 2001
From: Gavin Chou <gavin@selectdb.com>
Date: Wed, 5 Aug 2026 15:55:06 +0800
Subject: [PATCH] [fix](fe) Restrict frontend config updates to root in cloud
 mode

Restore the cloud-mode root-only authorization check for ADMIN SET FRONTEND CONFIG that existed in the legacy DDL executor. The Nereids command retained the global ADMIN privilege check but omitted the root restriction.

Add a regression test that verifies an ordinary admin is rejected while root remains allowed in cloud mode.
---
 .../AdminSetFrontendConfigCommand.java        |  8 ++++++
 .../AdminSetFrontendConfigCommandTest.java    | 27 +++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java b/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
index f967d28e2d9810..e215fe56b3f46f 100644
--- a/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
+++ b/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
@@ -20,10 +20,13 @@
 import org.apache.doris.analysis.RedirectStatus;
 import org.apache.doris.catalog.Env;
 import org.apache.doris.common.AnalysisException;
+import org.apache.doris.common.Config;
 import org.apache.doris.common.ConfigBase;
+import org.apache.doris.common.DdlException;
 import org.apache.doris.common.ErrorCode;
 import org.apache.doris.common.ErrorReport;
 import org.apache.doris.common.UserException;
+import org.apache.doris.mysql.privilege.Auth;
 import org.apache.doris.mysql.privilege.PrivPredicate;
 import org.apache.doris.nereids.trees.plans.PlanType;
 import org.apache.doris.nereids.trees.plans.visitor.PlanVisitor;
@@ -92,6 +95,11 @@ public void validate() throws UserException {
         if (type != NodeType.FRONTEND) {
             throw new AnalysisException("Only support setting Frontend configs now");
         }
+
+        if (Config.isCloudMode()
+                && !ConnectContext.get().getCurrentUserIdentity().getUser().equals(Auth.ROOT_USER)) {
+            throw new DdlException("Unsupported operation");
+        }
     }
 
     @Override
diff --git a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
index 54e47ac054071c..a6231a05b6b4d3 100644
--- a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
+++ b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
@@ -18,6 +18,7 @@
 package org.apache.doris.nereids.trees.plans.commands;
 
 import org.apache.doris.analysis.RedirectStatus;
+import org.apache.doris.analysis.UserIdentity;
 import org.apache.doris.catalog.Env;
 import org.apache.doris.common.AnalysisException;
 import org.apache.doris.common.CaseSensibility;
@@ -46,6 +47,32 @@ public void testNormal() throws Exception {
                 .startsWith("ADMIN SET FRONTEND CONFIG"));
     }
 
+    @Test
+    public void testCloudAdminCannotSetFrontendConfig() {
+        String originalDeployMode = Config.deploy_mode;
+        String originalCloudUniqueId = Config.cloud_unique_id;
+        boolean originalEnableUdfInLoad = Config.enable_udf_in_load;
+        UserIdentity originalUserIdentity = connectContext.getCurrentUserIdentity();
+        try {
+            Config.deploy_mode = "cloud";
+            Config.cloud_unique_id = "";
+            connectContext.setCurrentUserIdentity(UserIdentity.ADMIN);
+
+            IllegalStateException exception = Assertions.assertThrows(IllegalStateException.class,
+                    () -> executeSql("admin set frontend config(\"enable_udf_in_load\" = \"true\");"));
+            Assertions.assertEquals("errCode = 2, detailMessage = Unsupported operation", exception.getMessage());
+
+            connectContext.setCurrentUserIdentity(UserIdentity.ROOT);
+            Assertions.assertDoesNotThrow(
+                    () -> executeSql("admin set frontend config(\"enable_udf_in_load\" = \"true\");"));
+        } finally {
+            connectContext.setCurrentUserIdentity(originalUserIdentity);
+            Config.deploy_mode = originalDeployMode;
+            Config.cloud_unique_id = originalCloudUniqueId;
+            Config.enable_udf_in_load = originalEnableUdfInLoad;
+        }
+    }
+
     @Test
     public void testRedirectStatus() {
         String sql = "admin set frontend config(\"alter_table_timeout_second\" = \"60\");";