feat: add authz action checks to missing api's#17725
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #17725 +/- ##
============================================
- Coverage 63.23% 63.21% -0.03%
Complexity 1502 1502
============================================
Files 3179 3181 +2
Lines 190710 190816 +106
Branches 29153 29164 +11
============================================
+ Hits 120597 120618 +21
- Misses 60746 60816 +70
- Partials 9367 9382 +15
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This pull request adds authorization checks (@Authorize annotations) to previously unprotected API endpoints across multiple Pinot components (server and minion). The changes enforce fine-grained access control by specifying appropriate target types (CLUSTER or TABLE) and actions for each endpoint.
Changes:
- Added authorization annotations to server resource APIs for tables, segments, logging, debugging, and operational endpoints
- Added authorization annotations to minion resource APIs for task progress, metrics, logging, and configuration endpoints
- Imported required authorization classes (Actions, Authorize, TargetType) in all modified resource files
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/TablesResource.java | Added authorization to 16 endpoints covering table listing, segment operations, metadata retrieval, uploads, consuming segments, and ingestion metrics |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/TableTierResource.java | Added authorization to 2 endpoints for storage tier information |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/TableSizeResource.java | Added authorization to 2 endpoints for table size queries |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/ReingestionResource.java | Added authorization to 2 endpoints for segment re-ingestion operations |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/QueryResource.java | Added authorization to 2 endpoints for query cancellation and listing running queries |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/PinotServerLogger.java | Added authorization to 5 endpoints for logger management and log file operations |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/PinotServerAppConfigs.java | Added authorization to 1 endpoint for application configuration retrieval |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/MmapDebugResource.java | Added authorization to 2 endpoints for memory debugging |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/InstanceResource.java | Added authorization to 4 endpoints for instance information |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/DebugResource.java | Added authorization to 6 endpoints for debugging and resource usage |
| pinot-server/src/main/java/org/apache/pinot/server/api/resources/ControllerJobStatusResource.java | Added authorization to 1 endpoint for controller job status |
| pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotTaskProgressResource.java | Added authorization to 3 endpoints for task progress tracking |
| pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotMinionMetricsResource.java | Added authorization to 1 endpoint for gauge metrics |
| pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotMinionLogger.java | Added authorization to 5 endpoints for logger management and log file operations |
| pinot-minion/src/main/java/org/apache/pinot/minion/api/resources/PinotMinionAppConfigs.java | Added authorization to 1 endpoint for application configuration retrieval |
Instructions:
featurebugfixperformanceuibackward-incompatrelease-notes(**)(*) Other labels to consider:
testingdependenciesdockerkubernetesobservabilitysecuritycode-styleextension-pointrefactorcleanup(**) Use
release-noteslabel for scenarios like: