Copilot commented on code in PR #500: URL: https://github.com/apache/hugegraph-doc/pull/500#discussion_r4109476819
########## content/en/docs/clients/restful-api/auth.md: ########## @@ -8,6 +8,16 @@ description: "Authentication REST API: Manage users, roles, permissions, and acc > **Version Change Notice**: > - 1.7.0+: Auth API paths use GraphSpace format, such as > `/graphspaces/DEFAULT/auth/users`, and group/target IDs match their names > (e.g., `admin`) > - 1.5.x and earlier: Auth API paths include graph name, and group/target IDs > use format like `-69:grant`. See [HugeGraph 1.5.x RESTful > API](https://github.com/apache/hugegraph-doc/tree/release-1.5.0) +> +> Group paths are the exception in 1.7.0: there `GroupAPI` is served at `/auth/groups` +> with no GraphSpace prefix, while on 1.5.x it carried the graph name +> (`/graphs/{graph}/auth/groups`) like the other auth APIs. The +> `/graphspaces/{graphspace}/auth/groups` forms below need a build that includes +> [apache/hugegraph#3096](https://github.com/apache/hugegraph/pull/3096), which is newer +> than the 1.7.0 release. On 1.7.0 that route is unregistered rather than 404: +> `AuthenticationFilter` is `@PreMatching`, so it runs before route matching and answers +> 401 (no credentials) or 403 (IP outside the white list); 404 comes back only when +> authentication is disabled. Review Comment: This says that 404 is possible only with authentication disabled, but an unmatched prefixed route also returns 404 after `AuthenticationFilter` accepts a request with valid credentials (and an allowed IP). Please qualify this sentence so authenticated 1.7.0 users are not told to expect only 401/403. ########## content/cn/docs/clients/restful-api/auth.md: ########## @@ -8,6 +8,14 @@ description: "Authentication（认证鉴权）REST 接口:管理用户、角色 > **版本变更说明**: > - 1.7.0+: Auth API 路径使用 GraphSpace 格式，如 `/graphspaces/DEFAULT/auth/users`，且 > group/target 等 id 格式与 name 一致（如 `admin`） > - 1.5.x 及更早: Auth API 路径包含 graph 名称，group/target 等 id 格式类似 `-69:grant`。参考 > [HugeGraph 1.5.x RESTful > API](https://github.com/apache/hugegraph-doc/tree/release-1.5.0) +> +> 用户组路径在 1.7.0 上是例外：该版本的 `GroupAPI` 挂载于 `/auth/groups`，不带 GraphSpace 前缀， +> 而 1.5.x 的用户组路径与其他 Auth API 一样带有 graph 名称（`/graphs/{graph}/auth/groups`）。 +> 下文的 `/graphspaces/{graphspace}/auth/groups` 形式需要包含 +> [apache/hugegraph#3096](https://github.com/apache/hugegraph/pull/3096) 的构建，晚于 1.7.0 发布版。 +> 在 1.7.0 上该路由并未注册，而不是直接返回 404：`AuthenticationFilter` 标注了 `@PreMatching`， +> 在路由匹配之前执行，开启鉴权时会先返回 401（缺少凭据）或 403（IP 不在白名单内）， +> 只在关闭鉴权时才返回 404。 Review Comment: 这里说只有关闭鉴权才会返回 404，但未注册的带前缀路由在 `AuthenticationFilter` 接受有效凭据（且 IP 通过白名单）后同样会继续到路由匹配并返回 404。请补充这一种情况，避免 1.7.0 用户误以为带凭据请求只会得到 401/403。 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
