lasdf1234 opened a new pull request, #12940: URL: https://github.com/apache/gravitino/pull/12940
### What changes were proposed in this pull request? Replace anonymous `GET /configs/secrets/providers` with a documented `/api` resource: - `GET /api/secrets/providers` via `SecretProviderOperations` - Authorize with `SERVICE_ADMIN` - Remove `SecretProvidersConfigServlet` (no deprecated alias; the old path never shipped) - Response is `name` and `type` only (no `uri`) - OpenAPI: `docs/open-api/secrets.yaml` - Audit: `HttpAuditFilter` covers the new path; verified with an in-process listener Fix: #12921 ### Why are the changes needed? The root servlet bypassed authentication and audit and returned infrastructure topology (`uri`) to unauthenticated callers. Management-plane discovery belongs under `/api` and is restricted to service admins. ### Does this PR introduce _any_ user-facing change? Yes. `GET /configs/secrets/providers` is removed. Clients must call `GET /api/secrets/providers` with authentication. Only service admins succeed when authorization is enabled. The JSON body no longer includes `uri`. ### How was this patch tested? - Unit tests for the REST resource, DTO, serviceAdmin expression, interceptor registration, and in-process server (including audit and 404 on the old path) - `./gradlew :docs:lintOpenAPI` Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
