Matt Gilman created NIFI-16487:
----------------------------------
Summary: Add a Connector-scoped Process Group flow-definition
download
Key: NIFI-16487
URL: https://issues.apache.org/jira/browse/NIFI-16487
Project: Apache NiFi
Issue Type: Bug
Components: Core Framework
Reporter: Matt Gilman
h2. Problem
Downloading the flow definition of a Process Group managed by a Connector fails
unless that Connector is in Troubleshooting mode.
{code}
GET /nifi-api/process-groups/PROCESS_GROUP_ID/download
{code}
returns HTTP 409:
{code}
Component [PROCESS_GROUP_ID] is managed by a Connector [CONNECTOR_ID]; the
Connector must be in Troubleshooting mode for this component to be accessible.
{code}
ProcessGroupResource.exportProcessGroup authorizes through
AuthorizableLookup.getProcessGroup(). That lookup locates the group with
ComponentDAO.locateProcessGroup(), and verifyAccessibleForComponentOperation()
rejects a Connector-managed group whose Connector is not in
ConnectorState.TROUBLESHOOTING. ConnectorManagedAccessException is mapped to
409.
That gate should stay in place for the global endpoint. Connector-scoped reads
already bypass it by resolving the component from the Connector's managed
Process Group and authorizing only the Connector. Examples:
* GET /connectors/CONNECTOR_ID/process-groups/PROCESS_GROUP_ID
* GET /connectors/CONNECTOR_ID/flow/process-groups/PROCESS_GROUP_ID
There is no equivalent for flow-definition download, so a client that can read
the managed flow still cannot export it.
Changing only the authorization lookup is not sufficient.
StandardNiFiServiceFacade.getCurrentFlowSnapshotByGroupId() calls
processGroupDAO.getProcessGroup(processGroupId), which applies the same
Troubleshooting gate. The snapshot has to be built from the Process Group
already resolved from the Connector's managed tree.
h2. Proposed endpoint
{code}
GET
/nifi-api/connectors/CONNECTOR_ID/process-groups/PROCESS_GROUP_ID/download?includeReferencedServices=false&includeComponentState=false
{code}
* Authorize READ on /connectors/CONNECTOR_ID. When includeComponentState=true,
require WRITE on the Connector, matching the global download.
* Resolve the group with the same managed-tree lookup as
getConnectorProcessGroup. Return 404 when the group is not inside that
Connector.
* Export through the existing snapshot mapping, including referenced services
and component state. Keep the existing validation that processors are stopped
and Controller Services are disabled before state is included.
* Return the same attachment response as GET /process-groups/ID/download.
* Leave GET /process-groups/ID/download unchanged, including its 409 outside
Troubleshooting mode.
* For includeComponentState=true in a cluster, replicate to all nodes and merge
localNodeStates. ExportProcessGroupEndpointMerger only matches
/nifi-api/process-groups/UUID/download, so the new path needs the same merge
behavior.
h2. Acceptance
* A Connector that is not in Troubleshooting mode can download its managed
Process Group, including a child group.
* includeReferencedServices and includeComponentState match the global endpoint.
* A Process Group id that does not belong to the given Connector returns 404.
* The global download endpoint still returns 409 for that same group while the
Connector is not troubleshooting.
* A system test covers the non-troubleshooting download.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
