xiangfu0 opened a new pull request, #19236: URL: https://github.com/apache/pinot/pull/19236
## Summary - Apply one masking policy to table-config GET APIs, materialized-view details, and SHOW CREATE output. - Cover sensitive ingestion, storage, provider, custom-map, JAAS, key, and credential-bearing URI values while preserving unresolved environment placeholders. - Preserve GET-edit-PUT behavior by restoring unchanged masked values only when they map unambiguously to the same stored property and consumer identity. - Require explicit `get_znode` permission for raw ZooKeeper reads and avoid including configuration values in related diagnostics. ## Root cause Table configuration representations were produced through several independent paths without a shared masking and update policy. Some paths also used getters that apply variable replacement before rendering, while update handling had no safe interpretation for values returned as masks. ## Update semantics - `*****` retains the corresponding unresolved stored value only when the property and consumer identity are unchanged and unambiguous. - Literal replacements remain intentional updates. - New, moved, ambiguous, or reassociated masks are rejected instead of being persisted. - Environment placeholders remain placeholders and are not resolved for display or masked-value restoration. ## How to reproduce 1. Create a test table with synthetic sensitive values in representative ingestion, storage, JAAS, key, and URI properties, plus an environment placeholder and a benign property. 2. Fetch it through either table-config GET API as a table READ principal and render it with SHOW CREATE. 3. Verify sensitive values are represented as `*****`, the placeholder and benign property are unchanged, and raw ZooKeeper retrieval is denied without `get_znode`. 4. Edit only the benign property in the returned configuration and PUT it back. 5. Verify the stored sensitive values are retained; then verify an orphaned or reassociated mask is rejected. ## Validation - 224 targeted tests passed across SPI masking and restoration, controller APIs, READ-only authorization, raw-read permission checks, SHOW CREATE, materialized-view metadata and scheduling, DDL emission, authentication, and task diagnostics. - Post-rebase smoke runs passed: SPI `28/28` and controller/API/SHOW/MV `85/85`. - `spotless:apply`, `license:format`, `checkstyle:check`, and `license:check` passed for all affected modules. - Direct affected-module `test-compile` passed on JDK 25 with `-Xlint:all` and no warnings on added lines. - `git diff --check` passed. The full reactor `test-compile -am` gate remains blocked in unchanged `pinot-segment-local` by a pre-existing zstd-jni annotation classpath issue. Direct compilation of every modified module passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
