[
https://issues.apache.org/jira/browse/NIFI-16487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18130979#comment-18130979
]
ASF subversion and git services commented on NIFI-16487:
--------------------------------------------------------
Commit 11c520e61b74c6ec2a5c8e9255cbca768cafc759 in nifi's branch
refs/heads/main from Matt Gilman
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=11c520e61b7 ]
NIFI-16487 Add Connector process group export support (#11836)
* NIFI-16487 Add Connector process group export support
Add Connector-scoped flow definition downloads, including component state,
cluster response merging, toolkit support, and Connector canvas actions.
* NIFI-16487: Addressing review feedback.
This closes #11836
> Add a Connector-scoped Process Group flow-definition download
> -------------------------------------------------------------
>
> Key: NIFI-16487
> URL: https://issues.apache.org/jira/browse/NIFI-16487
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core Framework
> Reporter: Matt Gilman
> Assignee: Matt Gilman
> Priority: Major
> Time Spent: 40m
> Remaining Estimate: 0h
>
> h2. Problem
> Downloading the flow definition of a Process Group managed by a Connector
> fails unless that Connector is in Troubleshooting mode.
> {code}
> GET /nifi-api/process-groups/PROCESS_GROUP_ID/download
> {code}
> returns HTTP 409:
> {code}
> Component [PROCESS_GROUP_ID] is managed by a Connector [CONNECTOR_ID]; the
> Connector must be in Troubleshooting mode for this component to be accessible.
> {code}
> ProcessGroupResource.exportProcessGroup authorizes through
> AuthorizableLookup.getProcessGroup(). That lookup locates the group with
> ComponentDAO.locateProcessGroup(), and
> verifyAccessibleForComponentOperation() rejects a Connector-managed group
> whose Connector is not in ConnectorState.TROUBLESHOOTING.
> ConnectorManagedAccessException is mapped to 409.
> That gate should stay in place for the global endpoint. Connector-scoped
> reads already bypass it by resolving the component from the Connector's
> managed Process Group and authorizing only the Connector. Examples:
> * GET /connectors/CONNECTOR_ID/process-groups/PROCESS_GROUP_ID
> * GET /connectors/CONNECTOR_ID/flow/process-groups/PROCESS_GROUP_ID
> There is no equivalent for flow-definition download, so a client that can
> read the managed flow still cannot export it.
> Changing only the authorization lookup is not sufficient.
> StandardNiFiServiceFacade.getCurrentFlowSnapshotByGroupId() calls
> processGroupDAO.getProcessGroup(processGroupId), which applies the same
> Troubleshooting gate. The snapshot has to be built from the Process Group
> already resolved from the Connector's managed tree.
> h2. Proposed endpoint
> {code}
> GET
> /nifi-api/connectors/CONNECTOR_ID/process-groups/PROCESS_GROUP_ID/download?includeReferencedServices=false&includeComponentState=false
> {code}
> * Authorize READ on /connectors/CONNECTOR_ID. When
> includeComponentState=true, require WRITE on the Connector, matching the
> global download.
> * Resolve the group with the same managed-tree lookup as
> getConnectorProcessGroup. Return 404 when the group is not inside that
> Connector.
> * Export through the existing snapshot mapping, including referenced services
> and component state. Keep the existing validation that processors are stopped
> and Controller Services are disabled before state is included.
> * Return the same attachment response as GET /process-groups/ID/download.
> * Leave GET /process-groups/ID/download unchanged, including its 409 outside
> Troubleshooting mode.
> * For includeComponentState=true in a cluster, replicate to all nodes and
> merge localNodeStates. ExportProcessGroupEndpointMerger only matches
> /nifi-api/process-groups/UUID/download, so the new path needs the same merge
> behavior.
> h2. Acceptance
> * A Connector that is not in Troubleshooting mode can download its managed
> Process Group, including a child group.
> * includeReferencedServices and includeComponentState match the global
> endpoint.
> * A Process Group id that does not belong to the given Connector returns 404.
> * The global download endpoint still returns 409 for that same group while
> the Connector is not troubleshooting.
> * A system test covers the non-troubleshooting download.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
