ryerraguntla commented on code in PR #4401: URL: https://github.com/apache/iggy/pull/4401#discussion_r4202080913
########## gateways/kafka/src/protocol/handlers/describe_groups.rs: ########## @@ -0,0 +1,155 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +//! `DescribeGroups` (API key 15). +//! +//! Reports the members, assignment and state of groups this coordinator holds. A named group +//! that is not here is `Dead`: v6 also carries `GROUP_ID_NOT_FOUND`, and earlier versions do +//! not, matching Kafka 4.0's `describeGroups`. A v6 client treats error 0 as a real group. +//! +//! `include_authorized_operations` is not answered. The field stays at the omitted sentinel +//! (`i32::MIN`): there is no group ACL bitfield to report, and any other value fails the +//! encoder below v3. + +use bytes::Bytes; +use kafka_protocol::messages::describe_groups_response::{DescribedGroup, DescribedGroupMember}; +use kafka_protocol::messages::{DescribeGroupsRequest, DescribeGroupsResponse, GroupId}; +use kafka_protocol::protocol::StrBytes; + +use crate::error::Result; +use crate::group::{DescribeGroupsView, GroupDescription, MemberDescription}; +use crate::protocol::api::{ + API_KEY_DESCRIBE_GROUPS, ApiVersionRange, ERROR_GROUP_ID_NOT_FOUND, GatewayState, + HandleOutcome, is_supported_version, +}; +use crate::protocol::bounds_guard::validate_describe_groups_shape; +use crate::protocol::dedup::dedup_first_seen; +use crate::protocol::handlers::{ + decode_guarded, encode_message, respond_or_close, unsupported_version_response, +}; + +pub const RANGE: ApiVersionRange = ApiVersionRange { + api_key: API_KEY_DESCRIBE_GROUPS, + min_version: 0, + max_version: 6, +}; + +/// Kafka's `Dead` state. This coordinator never stores it: an absent group is reported as one. +const DEAD: &str = "Dead"; +/// First version whose response has `error_message`, and the first on which Kafka 4.0 sends +/// `GROUP_ID_NOT_FOUND` for a missing group. +const FIRST_ERROR_MESSAGE_VERSION: i16 = 6; + +pub async fn handle(state: &GatewayState, api_version: i16, body: Bytes) -> HandleOutcome { + if !is_supported_version(API_KEY_DESCRIBE_GROUPS, api_version) { + // No top-level error field to carry a code on, so this answers with an empty group + // list rather than a dedicated error response. Versions outside 0-6 fail in the + // encoder, which is what makes `unsupported_version_response` close the connection + // instead - a version this encoder accepts is not a version the firewall rejects. + return unsupported_version_response(API_KEY_DESCRIBE_GROUPS, api_version, |version| { + encode_response(version, Vec::new()) + }); + } + let request = + match decode_guarded::<DescribeGroupsRequest>(api_version, body, |version, body| { + validate_describe_groups_shape(version, body, state.max_frame_size) + }) { + Ok(request) => request, + Err(error) => { + // debug!, not warn!: attacker-controlled, not operator-actionable. + // The response has no top-level error field, and a failed decode yields no group + // id to hang `INVALID_REQUEST` on. An empty group list would look like success. + tracing::debug!(%error, api_version, "Failed to decode DescribeGroups request"); + return HandleOutcome::Close; + } + }; + + let requested: Vec<StrBytes> = request + .groups + .iter() + .map(|group_id| group_id.0.clone()) + .collect(); + // One result per distinct id. Repeating one group would otherwise copy its members into the + // response once per copy, and the shape guard only charges the id strings. + let group_ids = dedup_first_seen(&requested); + match state + .groups + .describe_groups(&group_ids, api_version, state.max_frame_size) + .await + { + DescribeGroupsView::ExceedsFrame { encoded_bytes } => { Review Comment: fixed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
