imbajin opened a new pull request, #3315: URL: https://github.com/apache/hugegraph/pull/3315
Scoped users could access edges but were denied equivalent vertex operations in a GraphSpace. Six Vertex API permission declarations omitted the graphspace prefix, so the authorization filter could not interpret their graph and action requirements. Add the missing scope to vertex creation, update, get and delete, matching the existing Edge API and vertex-list declarations. Existing admin/member behavior and space, graph and action restrictions remain intact. Validation: the same real Jersey authorization-filter regression rejects the affected routes before the fix and passes afterward; cross-space, wrong-graph and insufficient-action requests still fail. Focused offline Maven tests, Java 17 formatting, clean reactor compilation and three independent reviews passed. Full authenticated HTTP and distributed deployment acceptance remain open. Related release issue: SV11. This restores the existing permission contract without changing endpoints, payloads or configuration (`Doc - No Need`). The source branch follows current ASF master. The org comparison also contains the already merged launcher baseline; the Vertex permission fix itself is limited to its API declarations and regression tests. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
