This is an automated email from the ASF dual-hosted git repository.
jackie pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pinot.git
The following commit(s) were added to refs/heads/master by this push:
new 19c9c2d7163 Add access control to segment download API (#17508)
19c9c2d7163 is described below
commit 19c9c2d71638fb85d2a16806a0479caa78726a4a
Author: Akanksha kedia <[email protected]>
AuthorDate: Thu Feb 12 07:15:49 2026 +0530
Add access control to segment download API (#17508)
---
.../java/org/apache/pinot/server/api/resources/TablesResource.java | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git
a/pinot-server/src/main/java/org/apache/pinot/server/api/resources/TablesResource.java
b/pinot-server/src/main/java/org/apache/pinot/server/api/resources/TablesResource.java
index 4ff0e169379..14ecfa698d8 100644
---
a/pinot-server/src/main/java/org/apache/pinot/server/api/resources/TablesResource.java
+++
b/pinot-server/src/main/java/org/apache/pinot/server/api/resources/TablesResource.java
@@ -84,6 +84,9 @@ import org.apache.pinot.common.utils.ServiceStatus;
import org.apache.pinot.common.utils.TarCompressionUtils;
import org.apache.pinot.common.utils.URIUtils;
import org.apache.pinot.common.utils.helix.HelixHelper;
+import org.apache.pinot.core.auth.Actions;
+import org.apache.pinot.core.auth.Authorize;
+import org.apache.pinot.core.auth.TargetType;
import org.apache.pinot.core.data.manager.InstanceDataManager;
import org.apache.pinot.core.data.manager.offline.ImmutableSegmentDataManager;
import org.apache.pinot.core.data.manager.realtime.RealtimeSegmentDataManager;
@@ -472,10 +475,10 @@ public class TablesResource {
}
}
- // TODO Add access control similar to
PinotSegmentUploadDownloadRestletResource for segment download.
@GET
@Produces(MediaType.APPLICATION_OCTET_STREAM)
@Path("/segments/{tableNameWithType}/{segmentName}")
+ @Authorize(targetType = TargetType.TABLE, paramName = "tableNameWithType",
action = Actions.Table.DOWNLOAD_SEGMENT)
@ApiOperation(value = "Download an immutable segment", notes = "Download an
immutable segment in zipped tar format.")
public Response downloadSegment(
@ApiParam(value = "Name of the table with type REALTIME OR OFFLINE",
required = true, example = "myTable_OFFLINE")
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
