bitflicker64 commented on code in PR #3192:
URL: https://github.com/apache/hugegraph/pull/3192#discussion_r4075569806
##########
hugegraph-server/hugegraph-dist/docker/docker-entrypoint.sh:
##########
@@ -70,12 +74,141 @@ set_prop() {
get_prop_encoded() {
local key="$1" file="$2"
- local esc_key
- esc_key=$(printf '%s' "$key" | sed -e 's/[][(){}.^$*+?|\\/]/\\&/g')
- sed -nE \
-
"s~^[[:space:]]*${esc_key}([[:space:]]*[:=][[:space:]]*|[[:space:]]+)(.*)$~\\2~p"
\
- "${file}" | head -n 1
+ PROPS_MODE=get PROPS_KEY="${key}" PROPS_FILE="${file}" \
+ awk -f "${PROPS_AWK}" /dev/null
+}
+
+# Decoded read: unescapes the on-disk value the way java.util.Properties
+# does, so it compares equal with the snakeyaml-decoded scalar from
+# get_yaml_authenticator. The raw get_prop_encoded mode stays for the
+# secret round trip, which must replay backslashes byte-for-byte.
+get_prop() {
+ local key="$1" file="$2"
+
+ PROPS_MODE=get-decoded PROPS_KEY="${key}" PROPS_FILE="${file}" \
+ awk -f "${PROPS_AWK}" /dev/null
+}
+
+# First uncommented `authenticator:` inside the gremlin-server.yaml
+# authentication block, or on the `authentication:` line itself (a flow
+# mapping). snakeyaml resolves duplicate top-level keys to the last one,
+# but a mounted file carrying two authentication blocks is pathological;
+# report the first and let the mismatch WARN handle it. The scalar is
+# cleaned the way snakeyaml reads it — an inline comment (a '#' preceded
+# by whitespace), surrounding quotes and padding are stripped — because
+# java.util.Properties keeps all of those in the class name.
+get_yaml_authenticator() {
Review Comment:
⚠️ This reader, and the propagation it feeds in `align_auth_config`, can go.
Keep the guarantee (REST and Gremlin never end up on different authenticators)
and drop the YAML parsing.
The PR already refuses one case, a yaml block with no readable
authenticator, because carrying on would leave auth half-applied. Refuse every
one-sided case the same way and the entrypoint no longer needs to know *which*
class the yaml names, only *whether* each side names one. Both inputs already
exist in this diff:
```bash
check_auth_sides() {
local rest=0 yaml=0
[[ -n "$(get_prop_encoded auth.authenticator "${REST_SERVER_CONF}")" ]]
&& rest=1
has_yaml_authentication_block && yaml=1
if (( rest != yaml )); then
log "ERROR: authentication is configured in only one of" \
"rest-server.properties and gremlin-server.yaml;" \
"configure both or neither, then restart."
return 1
fi
}
```
Neither side: `enable-auth.sh` appends both, with its own
`AUTHENTICATOR_CLASS` default. Both sides: its per-file guards make it a no-op.
One side: stop.
That deletes `get_yaml_authenticator` (quotes, flow mappings, inline
comments, indent scoping), `get_prop` and the `get-decoded` mode in props.awk,
most of `align_auth_config`, and the test blocks for yaml scalars, sibling
scope, escaped authenticators and the `AUTHENTICATOR_CLASS` default: roughly
250 lines. The trailing-space thread on props.awk line 279 goes away with
`get-decoded`.
What you give up: an operator with a one-sided mounted config gets an error
telling them to finish it, instead of the entrypoint finishing it for them, and
two sides naming different classes are left alone without the WARN, as they
were before this PR. Checked with the head helpers: neither and both (including
`auth\.authenticator : A` next to a quoted yaml scalar) pass; REST-only,
yaml-only and a block without an authenticator all refuse.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
