agali-09 commented on code in PR #20687:
URL: https://github.com/apache/druid/pull/20687#discussion_r4381116906
##########
server/src/main/java/org/apache/druid/query/lookup/LookupListeningResource.java:
##########
@@ -89,13 +93,21 @@ public Response handleUpdates(InputStream inputStream,
ObjectMapper mapper)
}
try {
+ final HttpServletRequest request = requestProvider.get();
+ LookupResourceFilter.filterBulk(
+ request,
+ new LookupsState<>(null, state.getToLoad(),
state.getToDrop())
+ );
state.getToLoad().forEach(manager::add);
state.getToDrop().forEach(lookName -> {
manager.remove(lookName,
state.getToLoad().getOrDefault(lookName, null));
});
return
Response.status(Response.Status.ACCEPTED).entity(manager.getAllLookupsState()).build();
Review Comment:
Hmm, sorry if I'm misunderstanding but we are already returning the response
after filtering right.
```
return Response.status(Response.Status.ACCEPTED)
.entity(readableState(
request,
tier,
manager.getAllLookupsState(),
authorizerMapper,
authConfig,
true
))
.build();
```
`readableState` returns filtered node states and if you don't have READ
access to LOOKUPs, they wouldn't be returned. If a caller is unauthorized for
WRITE access on any lookup, the entire request would be rejected.
>
Response.status(Response.Status.ACCEPTED).entity(manager.getAllLookupsState()).build()
This looks to be from an older version. Please take a look at the latest
version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
