DanielLeens commented on PR #11734:
URL: https://github.com/apache/seatunnel/pull/11734#issuecomment-5846257666
Thanks for taking another pass at this, @SEZ9 — and sorry, I think there's a
genuine mismatch here worth untangling before it turns into more review cycles.
I went back to the document at this exact head (`a986eb165c`) rather than
relying on my own summary from yesterday, and all four of your points are there
as explicit prose — they're just not inside the new "Normative Rules" (R1-R5)
section, which is why I think they didn't show up when you focused your re-read
there. Citing the actual lines at this head:
1. **Auth/authz** — `## Security and Input Validation`, "Authentication"
paragraph (`:395-397`): "The endpoint sits under the existing `JobInfoServlet`
mappings, so it inherits the `BasicAuthFilter` boundary... It adds no
endpoint-specific authentication," plus explicit statements that basic auth is
disabled by default, the boundary is a single shared credential with no
per-job/per-tenant authorization, and narrower access must be enforced at the
gateway/network layer. That's the explicit statement you asked for in point 1.
2. **Redaction before HA persistence** — same section, "Redaction" paragraph
(`:409`): "Best-effort redaction runs... before every write to the running map
or the finished snapshot," covering every capture path (worker-reported,
deployment, node-loss, master-recovery, terminal-snapshot). That's your point 2.
3. **Worker `host:port`** — "Worker addresses" paragraph (`:441`): "The
first version neither stores worker `host:port` attribution fields in running
or finished history nor exposes them in REST responses." Also stated in Scope
(`:33`) and Problem (`:43`). That's your point 3.
4. **`limit`/path validation** — `## REST Contract` (`:370-378`): the exact
URI grammar (`^/([0-9]{1,19})/failures$`), the `limit` regex (`^[0-9]{1,10}$`),
default/cap of 100, and the `400`/`404` rules for malformed input, plus
decision table R5 for job resolution across the absent-state window. That's
your point 4.
So I don't think these are open gaps in the current head — the substance has
been there since the round I cited it in my 2026-08-22 comment (under different
line numbers, before the document's later restructuring), and it's been
re-verified in my 2026-09-21 and 2026-09-25 reviews.
What I think is a fair ask, though: fold the Security paragraphs into a
table with the same shape as R1-R5 (writer/enforcement-point/fence style), and
extend R5 (or add a sibling table) for the `limit`/path grammar specifically,
so all the normative content lives in one consistent format instead of half in
prose and half in tables. @goutamadwant, that seems like a reasonable, purely
organizational follow-up rather than new content — happy to take a look once it
lands.
@SEZ9, if you still read any of these four as substantively unaddressed once
you've re-read the actual prose at the lines above (not just the new table
section), I'd genuinely like to know which one and why — that's a different,
real conversation than "not yet written down."
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
