The GitHub Actions job "Benchmarks" on texera.git/main has succeeded. Run started by GitHub user github-merge-queue[bot] (triggered by github-merge-queue[bot]).
Head commit for run: 58112d771762980595dbaac28f24bd8e9239e307 / Eugene Gu <[email protected]> refactor(amber): remove the unregistered GuestAuthFilter and its unreachable guest guard (#7926) ### What changes were proposed in this PR? `GuestAuthFilter` is an authentication filter that is never registered: every `AuthDynamicFeature` registration in the repo installs `JwtAuthFilter` (`JwtAuth.scala`, `AuthFeatures.scala`, `NotebookMigrationService.scala`), and nothing constructs `GuestAuthFilter` or its `Builder`. It was originally registered for the non-user-system mode behind the `user-sys.enabled` flag, but that mode and its registration were removed in #3831, leaving the filter with no production path. With the filter gone, the guest guard in `WorkflowResource.persistWorkflow` became unreachable: it compares the request user against `GuestAuthFilter.GUEST` (whose `uid` is null), but the only production path to that endpoint is `JwtAuthFilter` → `JwtParser.claimsToSessionUser`, which fails authentication with a 401 unless the token carries a non-null `userId` claim — so every user that reaches the guard has a non-null `uid` and can never equal `GUEST`. The endpoint stays protected by `@Auth` + `@RolesAllowed`, so removing the guard changes no user-facing behavior. Changes: - Delete `GuestAuthFilter.scala` (the filter class, its `Builder`, and the `GUEST` singleton — the singleton's only production use was the unreachable guard). - Delete `GuestAuthFilterSpec.scala`, since the filter it covers has no production path. - Remove the guest guard block from `WorkflowResource.persistWorkflow`. - Remove the "reject the guest user" case from `WorkflowResourceSpec` (it hand-built a `SessionUser(GUEST)` principal that no production path can produce) along with the now-unused `GuestAuthFilter` import, and move the `"WorkflowResource.persistWorkflow" should` subject prefix onto the following test so the later `it should` cases keep their subject binding. ### Any related issues, documentation, discussions? Fixes #7923. The filter was introduced for the non-user-system mode in #1394, the guard was added in #2836 while that mode was still supported, and the mode along with the filter's registration was removed in #3831. This PR cleans up what #3831 left behind. ### How was this PR tested? No new tests: the two removed tests covered only the unreachable path (both had to construct the guest principal by hand). The remaining `WorkflowResourceSpec` cases for `persistWorkflow` (owner update with version recording, no-access and no-write-access rejections) continue to cover the endpoint. A repo-wide grep confirms no references to `GuestAuthFilter` or `GUEST` remain outside this PR's deletions. ### Was this PR authored or co-authored using generative AI tooling? Co-authored by: Claude Fable 5 (Claude Code) Report URL: https://github.com/apache/texera/actions/runs/32798695801 With regards, GitHub Actions via GitBox
