bitflicker64 opened a new pull request, #3257: URL: https://github.com/apache/hugegraph/pull/3257
## Purpose of the PR No linked issue; this removes a duplicate class. `hugegraph-struct` has its own `org.apache.hugegraph.auth.TokenGenerator`, with the same fully qualified name as the one in `hugegraph-core`. The method bodies are the same, but the config constructor reads `auth.token_secret` through a different `AuthOptions`: | Copy | Option holder | Default for `auth.token_secret` | |---|---|---| | `hugegraph-core` | `org.apache.hugegraph.config.AuthOptions` | `generateRandomBase64Key()`, random per process | | `hugegraph-struct` | `org.apache.hugegraph.options.AuthOptions` | a fixed string | `hugegraph-core` depends on `hg-store-common`, which depends on `hugegraph-struct`, so a built Server `lib/` ships both jars and both contain `auth/TokenGenerator.class`. The JVM uses whichever comes first on the classpath. `bin/hugegraph-server.sh` builds the classpath with `find ... 'hugegraph*.jar' | sort`, and `core` sorts before `struct`, so the Server loads the core copy today. Nothing else enforces that order. When the auth graph's config does not set `auth.token_secret`, `HugeConfig.get()` returns the option's own default, so the copy that loads decides the default signing key.  The only other code using this class name is PD's `pd/util/TokenUtil`, which nothing references. PD auth (REST and gRPC) compares a Basic-auth password with `auth.secret-key` in `Authentication.verifySecret()` and does not use `TokenGenerator`. ## Main Changes - Delete `hugegraph-struct/.../auth/TokenGenerator.java`. - Delete `AUTH_TOKEN_SECRET` from `hugegraph-struct/.../options/AuthOptions.java`, together with the private `generateRandomBase64Key()` helper that had no callers. - Delete `hugegraph-pd/hg-pd-service/.../pd/util/TokenUtil.java` (no callers). - `PDConfig.PUBLISHED_SECRET_KEY` is unchanged. After this change there is one class named `org.apache.hugegraph.auth.TokenGenerator`, so classpath order no longer matters for it. A Server started with `bin/hugegraph-server.sh` behaves the same as before, because it already loaded the core copy. Left for follow-ups to keep this diff small: - struct `options.AuthOptions` has no remaining references. Its other options duplicate keys that core already defines. - `hugegraph-struct/pom.xml` still declares `jjwt-*` and `jakarta.ws.rs-api`, and no struct source uses them now. Removing them touches the dependency lists. - struct and core share other class names as well. This PR only handles `TokenGenerator`, because its two copies read different defaults. ## Verifying these changes - [ ] Trivial rework / code cleanup without any test coverage. (No Need) - [ ] Already covered by existing tests, such as *(please modify tests here)*. - [x] Need tests and can be verified as follows: - Build, JDK 11, on this branch (base `176fb56dd`): `mvn -pl hugegraph-struct,hugegraph-pd/hg-pd-service,hugegraph-store/hg-store-common,hugegraph-server/hugegraph-core -am -DskipTests install` passes, and so does `mvn -pl hugegraph-store/hg-store-core,hugegraph-store/hg-store-client,hugegraph-server/hugegraph-hstore,hugegraph-server/hugegraph-api -am -DskipTests test-compile`. - `mvn -pl hugegraph-pd/hg-pd-service -am -Dtest=AuthenticationTest -Dsurefire.failIfNoSpecifiedTests=false test`: 10 run, 0 failures. - Which jar the class loads from, with a small probe that calls `Class.forName("org.apache.hugegraph.auth.TokenGenerator", false, ...)` and prints the code source. "Before" uses a Server `lib/` built from `c6853e70c` plus one unrelated query change; the files touched here are identical between that build and `176fb56dd`. "After" uses this branch's jars: ``` BEFORE -cp core,struct TokenGenerator loaded from hugegraph-core-1.7.0.jar BEFORE -cp struct,core TokenGenerator loaded from hugegraph-struct-1.7.0.jar AFTER -cp struct,core TokenGenerator loaded from hugegraph-core-1.7.0.jar AFTER struct jar: 0 entries for auth/TokenGenerator.class ``` - `git grep -n 'TokenUtil'` returns nothing, and `git grep -n 'import org.apache.hugegraph.options.AuthOptions' -- hugegraph-struct` returns nothing. ## Does this PR potentially affect the following parts? - [ ] Dependencies ([add/update license](https://hugegraph.apache.org/docs/contribution-guidelines/contribute/#321-check-licenses) info & [regenerate_known_dependencies.sh](../install-dist/scripts/dependency/regenerate_known_dependencies.sh)) - [ ] Modify configurations - [ ] The public API - [x] Other affects (typed here): removes the struct copy of `auth.TokenGenerator`, the struct `auth.token_secret` option and PD's `TokenUtil`. None of them has a caller in this repository. - [ ] Nope ## Documentation Status - [ ] `Doc - TODO`: required documentation is pending; complete it before merging. - [ ] `Doc - Done`: documentation is included here or linked below. - [x] `Doc - No Need`: no user-visible documentation is affected. Documentation files in this PR or paired hugegraph-doc PR: -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
