Gargi-jais11 commented on code in PR #11764:
URL: https://github.com/apache/ozone/pull/11764#discussion_r4385659435
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/file/OMRecoverLeaseRequest.java:
##########
@@ -106,11 +106,23 @@ public OMRequest preExecute(OzoneManager ozoneManager)
throws IOException {
keyPath, getBucketLayout());
// check ACL
- checkKeyAcls(ozoneManager,
- recoverLeaseRequest.getVolumeName(),
- recoverLeaseRequest.getBucketName(),
- recoverLeaseRequest.getKeyName(),
- IAccessAuthorizer.ACLType.WRITE, OzoneObj.ResourceType.KEY);
+ try {
+ checkKeyAcls(ozoneManager,
+ recoverLeaseRequest.getVolumeName(),
+ recoverLeaseRequest.getBucketName(),
+ recoverLeaseRequest.getKeyName(),
+ IAccessAuthorizer.ACLType.WRITE, OzoneObj.ResourceType.KEY);
+ } catch (IOException ex) {
+ // Ensure audit log captures preExecute failures
Review Comment:
Nit: not needed to comment. It is clear anyway.
##########
hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/file/TestOMRecoverLeaseRequest.java:
##########
@@ -73,6 +82,25 @@ public BucketLayout getBucketLayout() {
return BucketLayout.FILE_SYSTEM_OPTIMIZED;
}
+ @Test
+ public void preExecutePermissionDeniedWhenAclEnabled() {
+ OMRecoverLeaseRequest req = new OMRecoverLeaseRequest(
+ createRecoverLeaseRequest(volumeName, bucketName, keyName, false)) {
+ @Override
+ protected void checkKeyAcls(OzoneManager ozoneManager, String volume,
+ String bucket, String key, IAccessAuthorizer.ACLType aclType,
+ OzoneObj.ResourceType type) throws IOException {
+ throw new OMException("denied",
OMException.ResultCodes.PERMISSION_DENIED);
+ }
+ };
+
+ OMException e = assertThrows(OMException.class, () ->
req.preExecute(ozoneManager));
+ assertEquals(OMException.ResultCodes.PERMISSION_DENIED, e.getResult());
+ // Simulate what OMExecutionFlow does in its catch block: flush the audit
builder
+ OMAuditLogger.log(req.getAuditBuilder());
+ verify(auditLogger).logWrite(any(AuditMessage.class));
Review Comment:
`any(AuditMessage.class)` would also pass if the entry had the wrong
operation, a SUCCESS result, or no exception.
Please capture the message and check it, like the delete and rename tests in
#11759
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
