fivetran-arunsuri commented on code in PR #2197:
URL: https://github.com/apache/polaris/pull/2197#discussion_r2286687462
##########
persistence/relational-jdbc/src/main/java/org/apache/polaris/persistence/relational/jdbc/JdbcBasePersistenceImpl.java:
##########
@@ -773,6 +773,73 @@ public PolarisPrincipalSecrets generateNewPrincipalSecrets(
return principalSecrets;
}
+ @Nullable
+ @Override
+ public PolarisPrincipalSecrets resetPrincipalSecrets(
+ @Nonnull PolarisCallContext callCtx,
+ @Nonnull String clientId,
+ long principalId,
+ String customClientId,
+ String customClientSecret,
+ boolean customReset) {
+ PolarisPrincipalSecrets principalSecrets = loadPrincipalSecrets(callCtx,
clientId);
+
+ // should be found
+ callCtx
+ .getDiagServices()
+ .checkNotNull(
+ principalSecrets,
+ "cannot_find_secrets",
+ "client_id={} principalId={}",
+ clientId,
+ principalId);
+
+ // ensure principal id is matching
+ callCtx
+ .getDiagServices()
+ .check(
+ principalId == principalSecrets.getPrincipalId(),
+ "principal_id_mismatch",
+ "expectedId={} id={}",
+ principalId,
+ principalSecrets.getPrincipalId());
+
+ if (customReset) {
+ principalSecrets =
+ new PolarisPrincipalSecrets(
+ principalSecrets.getPrincipalId(), customClientId,
customClientSecret, null);
+ } else {
+ principalSecrets.rotateSecrets(principalSecrets.getMainSecretHash());
Review Comment:
Made following changes to the flow:
- **Partial updates supported**: clientId and clientSecret can be set
individually; null values are handled gracefully.
- **Main secret reset only**: clientSecret is replaced or generated;
secondary secret remains unchanged.
- **Principal entity sync**: clientId in the principal is updated to match
the reset credentials.
- **Immutability**: A new PolarisPrincipalSecrets object is returned; the
old one remains unchanged.
- **Access control**: Only authorized users (admins) can reset credentials;
principals cannot reset their own credentials
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@polaris.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
