raghav-reglobe commented on PR #66115: URL: https://github.com/apache/doris/pull/66115#issuecomment-5727730950
Thanks for the careful pass. All six are in at `83ca91dac3`, and the description now says what a downgrade actually does. - The `Password` column of `SHOW ALL GRANTS` / `SHOW GRANTS FOR` / `SHOW PROC '/auth'` reads `Yes (dual)` while an account holds a retained secondary. Agreed this belongs here rather than behind #66198: it is the auditing half of the same concern, and it is a one-liner plus a `User.hasSecondaryPassword()`. Asserted in `DualPasswordTest` and in the regression suite across retain, a plain change (the marker stays, since the secondary does) and discard. - `DISCARD` now swaps in a new `Password` holding the primary alone, so it follows the same one-snapshot rule as a password change. The javadoc carries the domain-account note: the domain entry is cleared at once, the resolved-IP entries follow at the next resolver refresh, the same lag a plain password change has. The "evict early" wording in `Auth` is reworded to match. - The per-connection line moved to DEBUG; the counter carries the count. - `AlterUserOperationLog.discardOldPassword` names the `getOrCreatePolicy` side effect. - The test replays `AlterUserOperationLog.discardOldPassword(user)` at both call sites, so it exercises the entry a follower actually sees. - The expiration step runs on a 16-second interval with 10 s + 8 s sleeps. On the description: "Downgrade is safe including after the clauses have been used" is gone. The rolling-upgrade / downgrade section now states that a not-yet-upgraded FE rejects logins with the old password and applies a `DISCARD` as a no-op, and that a downgrade keeps replay and image load working but silently drops every retained secondary, which does not come back on re-upgrade. The Replay bullet was also stale (it still described the earlier `PrivInfo` discard flag) and now describes the `SET_PASSWORD_POLICY` carrier. Gate, built from the branch: FE build and checkstyle clean; `DualPasswordTest`, `PrivInfoTest`, `AuthTest`, `PasswordPolicyTest`, `ShowGrantsCommandTest`, `CloudAuthTest` green (32 tests), and `account_p0/test_dual_password` green against an FE built from this head. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
