Skip to content

feat: add authz action checks to missing api's#17725

Merged
yashmayya merged 1 commit intoapache:masterfrom
jayeshchoudhary:add-missing-rbac-actions
Feb 19, 2026
Merged

feat: add authz action checks to missing api's#17725
yashmayya merged 1 commit intoapache:masterfrom
jayeshchoudhary:add-missing-rbac-actions

Conversation

@jayeshchoudhary
Copy link
Contributor

Instructions:

  1. The PR has to be tagged with at least one of the following labels (*):
    1. feature
    2. bugfix
    3. performance
    4. ui
    5. backward-incompat
    6. release-notes (**)
  2. Remove these instructions before publishing the PR.

(*) Other labels to consider:

  • testing
  • dependencies
  • docker
  • kubernetes
  • observability
  • security
  • code-style
  • extension-point
  • refactor
  • cleanup

(**) Use release-notes label for scenarios like:

  • New configuration options
  • Deprecation of configurations
  • Signature changes to public methods/interfaces
  • New plugins added or old plugins removed

@codecov-commenter
Copy link

codecov-commenter commented Feb 19, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.21%. Comparing base (657e7f0) to head (623e2d6).
⚠️ Report is 11 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff              @@
##             master   #17725      +/-   ##
============================================
- Coverage     63.23%   63.21%   -0.03%     
  Complexity     1502     1502              
============================================
  Files          3179     3181       +2     
  Lines        190710   190816     +106     
  Branches      29153    29164      +11     
============================================
+ Hits         120597   120618      +21     
- Misses        60746    60816      +70     
- Partials       9367     9382      +15     
Flag Coverage Δ
custom-integration1 100.00% <ø> (ø)
integration 100.00% <ø> (ø)
integration1 100.00% <ø> (ø)
integration2 0.00% <ø> (ø)
java-11 63.18% <ø> (-0.03%) ⬇️
java-21 63.17% <ø> (-0.01%) ⬇️
temurin 63.21% <ø> (-0.03%) ⬇️
unittests 63.20% <ø> (-0.03%) ⬇️
unittests1 55.61% <ø> (-0.02%) ⬇️
unittests2 34.04% <ø> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request adds authorization checks (@Authorize annotations) to previously unprotected API endpoints across multiple Pinot components (server and minion). The changes enforce fine-grained access control by specifying appropriate target types (CLUSTER or TABLE) and actions for each endpoint.

Changes:

  • Added authorization annotations to server resource APIs for tables, segments, logging, debugging, and operational endpoints
  • Added authorization annotations to minion resource APIs for task progress, metrics, logging, and configuration endpoints
  • Imported required authorization classes (Actions, Authorize, TargetType) in all modified resource files

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.

Show a summary per file
File Description
pinot-server/src/main/java/org/apache/pinot/server/api/resources/TablesResource.java Added authorization to 16 endpoints covering table listing, segment operations, metadata retrieval, uploads, consuming segments, and ingestion metrics
pinot-server/src/main/java/org/apache/pinot/server/api/resources/TableTierResource.java Added authorization to 2 endpoints for storage tier information
pinot-server/src/main/java/org/apache/pinot/server/api/resources/TableSizeResource.java Added authorization to 2 endpoints for table size queries
pinot-server/src/main/java/org/apache/pinot/server/api/resources/ReingestionResource.java Added authorization to 2 endpoints for segment re-ingestion operations
pinot-server/src/main/java/org/apache/pinot/server/api/resources/QueryResource.java Added authorization to 2 endpoints for query cancellation and listing running queries
pinot-server/src/main/java/org/apache/pinot/server/api/resources/PinotServerLogger.java Added authorization to 5 endpoints for logger management and log file operations
pinot-server/src/main/java/org/apache/pinot/server/api/resources/PinotServerAppConfigs.java Added authorization to 1 endpoint for application configuration retrieval
pinot-server/src/main/java/org/apache/pinot/server/api/resources/MmapDebugResource.java Added authorization to 2 endpoints for memory debugging
pinot-server/src/main/java/org/apache/pinot/server/api/resources/InstanceResource.java Added authorization to 4 endpoints for instance information
pinot-server/src/main/java/org/apache/pinot/server/api/resources/DebugResource.java Added authorization to 6 endpoints for debugging and resource usage
pinot-server/src/main/java/org/apache/pinot/server/api/resources/ControllerJobStatusResource.java Added authorization to 1 endpoint for controller job status
pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotTaskProgressResource.java Added authorization to 3 endpoints for task progress tracking
pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotMinionMetricsResource.java Added authorization to 1 endpoint for gauge metrics
pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotMinionLogger.java Added authorization to 5 endpoints for logger management and log file operations
pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotMinionAppConfigs.java Added authorization to 1 endpoint for application configuration retrieval

@yashmayya yashmayya merged commit 570d4f1 into apache:master Feb 19, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Comments