Copilot commented on code in PR #18975:
URL: https://github.com/apache/pinot/pull/18975#discussion_r3762694038
##########
pinot-controller/src/main/java/org/apache/pinot/controller/api/access/AccessControlUtils.java:
##########
@@ -74,6 +75,36 @@ public static void validatePermission(@Nullable String
tableName, AccessType acc
Response.Status.FORBIDDEN);
}
+ /// Maps a fine grained action name (see [Actions]) to the coarse
[AccessType] bucket that guards the corresponding
+ /// endpoint, so that access control implementations backed by coarse
permissions can authorize fine grained actions.
+ /// Action names follow a `<verb><noun>` convention, hence the verb prefix
selects the bucket.
+ ///
+ /// Actions whose verb does not match the access type of their endpoint are
listed as exact matches, which are
+ /// evaluated before the prefixes. Keep new actions in sync with the
`@Authenticate` annotation of the endpoint they
+ /// protect, otherwise a principal configured with only that endpoint's
coarse permission is denied.
Review Comment:
This derivation does not match the existing endpoint annotations. Some
actions are shared across different coarse types: `REBALANCE_TENANT_TABLES`
guards both DELETE (`PinotTenantRestletResource:703-704`) and UPDATE
(`:739-740`), and `EXECUTE_TASK` guards CREATE
(`PinotTaskRestletResource:870-871`) and UPDATE
(`PinotControllerPeriodicTaskRestletResource:113-114`). Other actions are
directly misclassified: `CREATE_TASK` protects an UPDATE endpoint
(`PinotTaskRestletResource:818-820`), while
`FORCE_RELEASE_TASK_GENERATION_LOCK` protects DELETE (`:1003-1008`) but falls
through to UPDATE. Consequently, principals with the endpoint's configured
coarse permission pass the first auth check and are then incorrectly denied
here. Use access-type-specific action constants (or pass the endpoint's
`AccessType` through) and cover these cases for both factories.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
