imbajin commented on code in PR #3331:
URL: https://github.com/apache/hugegraph/pull/3331#discussion_r4275647882
##########
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/profile/GraphsAPI.java:
##########
@@ -693,6 +701,60 @@ public Map<String, GraphMode> mode(@Context GraphManager
manager,
return ImmutableMap.of("mode", g.mode());
}
+ @GET
+ @Timed
+ @Path("{name}/mode/owners")
+ @Produces(APPLICATION_JSON_WITH_CHARSET)
+ @RolesAllowed({"space", "$owner=$name"})
+ public Map<String, Object> loadingMode(@Context GraphManager manager,
+ @PathParam("graphspace") String
graphSpace,
+ @PathParam("name") String name) {
+ return graph(manager, graphSpace, name).loadingMode();
+ }
+
+ @PUT
+ @Timed
+ @Path("{name}/mode/owners")
+ @Consumes(APPLICATION_JSON)
+ @Produces(APPLICATION_JSON_WITH_CHARSET)
+ @RolesAllowed({"space", "$owner=$name"})
+ public Map<String, Object> loadingMode(@Context GraphManager manager,
+ @PathParam("graphspace") String
graphSpace,
+ @PathParam("name") String name,
+ JsonLoadingOwner owner,
+ @Context SecurityContext
securityContext) {
+ E.checkArgument(owner != null && owner.epoch != null, "Loading owner
body and epoch are required");
+ if ("recover".equals(owner.action)) {
+ if (securityContext == null ||
!securityContext.isUserInRole("admin")) {
Review Comment:
[P2] Clarify and test recovery authorization for auth-disabled graph spaces.
This check does not necessarily identify a global administrator:
AuthenticationFilter.Authorizer.matchPermission() returns true for every role
when graphSpace.auth() is false, and GraphManager opens those graphs without
HugeGraphAuthProxy. On an authentication-enabled Server, an authenticated
non-admin can therefore fetch the current tuple and recover another caller's
active owners in that space. This follows the existing all-access-space policy;
it is not a claim of a new general privilege escalation. However,
docs/server-runtime.md currently promises administrator permission at both
layers without this qualification.
Please explicitly document whether recovery follows space-wide auth
disabling or remains administrator-only. If administrator-only is intended even
in such spaces, use a global administrator check. Add a real Authorizer plus
unproxied-graph regression, since the current recovery test mocks isUserInRole.
This is a source-verified contract mismatch; no live HTTP reproduction was run
in this review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
