rzo1 commented on PR #8973: URL: https://github.com/apache/storm/pull/8973#issuecomment-5381685353
> _Disclaimer: this comment was drafted with the help of an LLM._ > > Thanks for tightening up the daemon-log authorization here — the per-endpoint deny tests are a nice addition. > > One small suggestion on coverage: both `ResourceAuthorizer` tests stub `getUserGroups(...)` to return an empty set, so the group-based path (`logs.groups` / `nimbus.admins.groups`) isn't actually exercised. A case where a user is authorized purely via group membership would close that gap. Separately, the three handler tests assert the `403` deny path but not the authorized `200` path — a positive case could guard against accidentally over-blocking. > > Neither is a blocker — just an additional safeguard for a security-sensitive change. Done. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
