dimas-b commented on code in PR #4459:
URL: https://github.com/apache/polaris/pull/4459#discussion_r3277231994
##########
runtime/service/src/main/java/org/apache/polaris/service/events/PolarisEventMetadataFactory.java:
##########
@@ -92,11 +97,35 @@ private String getRealmId() {
* taken place, e.g. in pre-authentication filters.
*/
private Optional<PolarisPrincipal> getUser() {
- SecurityIdentity identity =
-
currentIdentityAssociation.getDeferredIdentity().subscribeAsCompletionStage().getNow(null);
- return identity == null || identity.isAnonymous()
- ? Optional.empty()
- : Optional.of(identity.getPrincipal(PolarisPrincipal.class));
+ return getSecurityIdentity()
+ .filter(identity -> !identity.isAnonymous())
+ .map(identity -> identity.getPrincipal(PolarisPrincipal.class));
+ }
+
+ /**
+ * Resolves the current security identity if available.
+ *
+ * <p>Returns {@link Optional#empty()} if the identity has not been resolved
yet, or if the
+ * deferred identity resolution failed with an {@link
AuthenticationFailedException} (e.g. on
+ * unauthenticated endpoints where the auth pipeline throws when triggered).
+ *
+ * <p>Other exceptions (e.g. {@link
org.apache.iceberg.exceptions.ServiceFailureException}) are
+ * not suppressed and will propagate to the caller.
+ */
+ private Optional<SecurityIdentity> getSecurityIdentity() {
+ try {
+ return Optional.ofNullable(
+ currentIdentityAssociation
+ .getDeferredIdentity()
+ .subscribeAsCompletionStage()
+ .getNow(null));
+ } catch (CompletionException e) {
+ if (e.getCause() instanceof AuthenticationFailedException) {
Review Comment:
How about a holder approach?
We could start with `PolarisPrincipalHolder` but alter it to always receive
the `PolarisPrincipal` after authentication completes... that is in
`AuthenticatingAugmentor`.
The normal producer method would assert that the principal is set.
The events factory could deal with `PolarisPrincipalHolder` and get an
optional `PolarisPrincipal` value via another getter.
This way most of the processing logic does not have to deal with async
aspects.
WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
