This is an automated email from the ASF dual-hosted git repository. CRZbulabula pushed a commit to branch yongzao/improve-audit-database-error-message in repository https://gitbox.apache.org/repos/asf/iotdb.git
commit 93d3d650caa7cf42e8c5baffaf4a5a1376a151c8 Author: Yongzao <[email protected]> AuthorDate: Sat Jul 25 21:21:36 2026 +0800 Fix internal audit user check --- .../security/TreeAccessCheckVisitor.java | 2 +- .../org/apache/iotdb/db/auth/TreeAccessTest.java | 28 ++++++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java index 39902e77745..4381cdc5729 100644 --- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java +++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java @@ -2297,7 +2297,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces protected TSStatus checkUnsupportedAuditDatabaseWrite( IAuditEntity auditEntity, PartialPath path) { if (includeByAuditTreeDB(path) - && !AuthorityChecker.INTERNAL_AUDIT_USER.equals(path.getFullPath())) { + && !AuthorityChecker.INTERNAL_AUDIT_USER.equals(auditEntity.getUsername())) { AUDIT_LOGGER.recordObjectAuthenticationAuditLog(auditEntity, path::getFullPath); return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode()) .setMessage(getUnsupportedAuditDatabaseOperationMessage(TREE_MODEL_AUDIT_DATABASE)); diff --git a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/auth/TreeAccessTest.java b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/auth/TreeAccessTest.java index dd1826982c9..0e83cc5b477 100644 --- a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/auth/TreeAccessTest.java +++ b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/auth/TreeAccessTest.java @@ -214,4 +214,32 @@ public class TreeAccessTest { .getAllPathPatterns() .contains(new PartialPath("root.__audit.**"))); } + + @Test + public void testUnsupportedAuditDatabaseWrite() throws Exception { + TestTreeAccessCheckVisitor treeAccessCheckVisitor = new TestTreeAccessCheckVisitor(); + + Assert.assertEquals( + TSStatusCode.SUCCESS_STATUS.getStatusCode(), + treeAccessCheckVisitor.checkUnsupportedAuditDatabaseWriteStatus( + new TreeAccessCheckContext( + AuthorityChecker.INTERNAL_AUDIT_USER_ID, AuthorityChecker.INTERNAL_AUDIT_USER, ""), + new PartialPath("root.__audit"))); + Assert.assertEquals( + TSStatusCode.NO_PERMISSION.getStatusCode(), + treeAccessCheckVisitor.checkUnsupportedAuditDatabaseWriteStatus( + new TreeAccessCheckContext(10000L, "user1", ""), new PartialPath("root.__audit"))); + Assert.assertEquals( + TSStatusCode.SUCCESS_STATUS.getStatusCode(), + treeAccessCheckVisitor.checkUnsupportedAuditDatabaseWriteStatus( + new TreeAccessCheckContext(10000L, "user1", ""), new PartialPath("root.sg"))); + } + + private static class TestTreeAccessCheckVisitor extends TreeAccessCheckVisitor { + + private int checkUnsupportedAuditDatabaseWriteStatus( + TreeAccessCheckContext context, PartialPath path) { + return checkUnsupportedAuditDatabaseWrite(context, path).getCode(); + } + } }
