yuqi1129 commented on code in PR #13105:
URL: https://github.com/apache/gravitino/pull/13105#discussion_r4005720603
##########
docs/lance-rest-service.md:
##########
@@ -296,7 +296,7 @@ for diagnosis.
| Mode | Identity used for Gravitino metadata
operations
| Metadata authorization
|
| ---------------------------------- |
-------------------------------------------------------------------------------------------------------------------------------------------------------------
|
--------------------------------------------------------------------------------------------------------------------------------------
|
-| Auxiliary (running with Gravitino) | Authenticated caller, including active
roles; anonymous requests fall back to
`gravitino.lance-rest.gravitino-simple.user-name` (default `lance-rest-server`)
| Enabled by `gravitino.authorization.enable=true` with a configured metalake
|
+| Auxiliary (running with Gravitino) | Authenticated caller, including active
roles; anonymous requests fall back to
`gravitino.lance-rest.gravitino-simple.user-name` (default `lance-rest-server`)
**only when authorization is disabled**. When authorization is enabled, the
filter is not installed and anonymous requests are rejected with 403. | Enabled
by `gravitino.authorization.enable=true` with a configured metalake
|
Review Comment:
The table is not aligned.
##########
lance/lance-rest-server/src/test/java/org/apache/gravitino/lance/TestLanceRESTService.java:
##########
@@ -18,22 +18,112 @@
*/
package org.apache.gravitino.lance;
+import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
import java.util.Set;
+import org.apache.commons.lang3.reflect.FieldUtils;
+import org.apache.gravitino.Config;
+import org.apache.gravitino.Configs;
+import org.apache.gravitino.GravitinoEnv;
import org.apache.gravitino.lance.common.config.LanceConfig;
+import org.apache.gravitino.lance.service.LanceServiceIdentityFilter;
import org.apache.gravitino.listener.EventBus;
+import org.apache.gravitino.metrics.MetricsSystem;
import org.apache.gravitino.server.web.HttpAuditFilter;
import org.apache.gravitino.server.web.JettyServer;
import org.apache.gravitino.server.web.JettyServerConfig;
import org.apache.gravitino.server.web.JettyServerTestUtils;
import org.apache.gravitino.server.web.RequestContextFilter;
import org.eclipse.jetty.servlet.ServletHandler;
+import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.Test;
public class TestLanceRESTService {
+ private Config previousConfig;
+ private MetricsSystem previousMetricsSystem;
+ private EventBus previousEventBus;
+
+ @AfterEach
+ public void tearDown() throws Exception {
+ if (previousConfig != null) {
+ FieldUtils.writeField(GravitinoEnv.getInstance(), "config",
previousConfig, true);
+ }
+ if (previousMetricsSystem != null) {
+ FieldUtils.writeField(
+ GravitinoEnv.getInstance(), "metricsSystem", previousMetricsSystem,
true);
+ }
+ if (previousEventBus != null) {
+ FieldUtils.writeField(GravitinoEnv.getInstance(), "eventBus",
previousEventBus, true);
+ }
+ }
+
+ private void injectGravitinoEnv(boolean authorizationEnabled) throws
Exception {
+ previousConfig = (Config) FieldUtils.readField(GravitinoEnv.getInstance(),
"config", true);
+ previousMetricsSystem =
+ (MetricsSystem) FieldUtils.readField(GravitinoEnv.getInstance(),
"metricsSystem", true);
+ previousEventBus =
+ (EventBus) FieldUtils.readField(GravitinoEnv.getInstance(),
"eventBus", true);
+
+ Config mockConfig = mock(Config.class);
+
when(mockConfig.get(Configs.ENABLE_AUTHORIZATION)).thenReturn(authorizationEnabled);
+ FieldUtils.writeField(GravitinoEnv.getInstance(), "config", mockConfig,
true);
+ FieldUtils.writeField(GravitinoEnv.getInstance(), "metricsSystem", new
MetricsSystem(), true);
+ FieldUtils.writeField(
+ GravitinoEnv.getInstance(), "eventBus", new
EventBus(Collections.emptyList()), true);
+ }
+
+ private boolean hasServiceIdentityFilter(LanceRESTService service) throws
Exception {
+ JettyServer server = (JettyServer) FieldUtils.readField(service, "server",
true);
+ ServletHandler servletHandler =
+
JettyServerTestUtils.getServletContextHandler(server).getServletHandler();
+ Set<String> filterPathSpecs =
+ JettyServerTestUtils.filterPathSpecsFor(servletHandler,
LanceServiceIdentityFilter.class);
+ return !filterPathSpecs.isEmpty();
+ }
+
+ /** See GH-13093. The filter must not be registered when authorization is
enabled. */
+ @Test
+ public void testServiceIdentityFilterNotRegisteredWhenAuthorizationEnabled()
throws Exception {
Review Comment:
Did you real add the test described above in `LanceNamespaceAuthorizationIT`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
