gavinchou opened a new pull request, #66629:
URL: https://github.com/apache/doris/pull/66629
## Proposed changes
BE HTTP auth for Stream Load currently builds a `GLOBAL/LOAD` privilege
request before stream load header parsing. This makes users with only db/table
`LOAD_PRIV` fail direct BE stream load auth.
This patch:
- builds Stream Load auth from the HTTP path `{db}/{table}` and checks
`TABLE/LOAD` on `internal.db.table`
- applies the same table-level check to table-specific Stream Load 2PC
requests
- keeps a database-level fallback for the legacy
`/api/{db}/_stream_load_2pc` route
- adds a docker auth_call regression case for direct BE, FE redirect, 2PC,
and denied load to another table with only table-level `LOAD_PRIV`
## Testing
- `sh format_code.sh be/src/service/http/action/stream_load.cpp`
- `sh format_code.sh be/src/service/http/action/stream_load.h`
- `sh format_code.sh be/src/service/http/action/stream_load_2pc.cpp`
- `sh format_code.sh be/src/service/http/action/stream_load_2pc.h`
- `git diff --check`
- `source custom_env.sh && ninja -C be/ut_build_ASAN
src/service/CMakeFiles/Service.dir/http/action/stream_load.cpp.o
src/service/CMakeFiles/Service.dir/http/action/stream_load_2pc.cpp.o`
`sh run-be-ut.sh --run --filter "HttpAuthTest.*"` was attempted. CMake
configured successfully after initializing missing `contrib/openblas` and
`contrib/faiss`, but the full UT build stopped before test execution because
local thirdparty is missing
`thirdparty/installed/lib64/libadbc_driver_manager.a`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
