aglinxinyuan opened a new issue, #7689: URL: https://github.com/apache/texera/issues/7689
### Task Summary `access-control-service/src/main/scala/org/apache/texera/service/resource/AccessControlResource.scala` is the ext-authz endpoint the gateway calls on every request, and it sits at **74.2% of 159 lines** behind a 13-test spec. The percentage understates the problem. The largest uncovered region is `extractTokenFromBody`, which the whole suite invokes exactly once, with a body carrying no token at all -- so only the "everything returns None" skeleton runs. Its three real parsers (JSON, form-urlencoded, multipart) are entirely unexercised, as is the `access-token` query parameter, two arms of the route whitelist, and the token-precedence chain. Everything there is reachable in-module: `MockTexeraDB` is on this module's test classpath (root `build.sbt:151` has an explicit `dependsOn(DAO % "test->test", Auth % "test->test")`), and it boots zonky EmbeddedPostgres -- no Docker, no network. Traps worth knowing before writing anything, because each yields a test that looks strong and pins nothing: 1. **403-only assertions prove nothing about which check fired.** Every rejection inside `checkComputingUnitAccess` returns the same bare `Response.status(FORBIDDEN).build()` -- unparseable cuid, empty token, insufficient privilege, the exception catch, and no recorded URI. A negative test asserting only `getStatus shouldBe 403` still passes after you delete the branch it claims to pin. Pair every negative with a positive that goes red when the same branch is removed. 2. **A negative test must be negative for the intended reason.** A 403 obtained by naming a computing unit that does not exist in the fixture DB comes from the routing check, not the privilege check. 3. **A single fixture privilege cannot discriminate a lookup from a constant.** If every ACL row is `WRITE`, asserting `WRITE` comes back passes against a hard-coded `WRITE`. 4. **A single fixture user cannot discriminate the uid axis.** If every request authenticates as uid 1, hard-coding `"1"` into the response header survives. 5. **`logger.info` lines here never execute.** `access-control-service/src/main/resources/logback.xml:52` pins `org.apache` to `WARN`, and dropwizard-testing's `BootstrapLogging` independently resets the context in the same JVM. The `isEnabled` guard is the hit half; the interpolation never runs. That also means `uriInfo.getRequestUri` and `headers.getRequestHeaders` are read *only* inside disabled logging -- the existing spec's stubs for them never fire. 6. **`http://127.0.0.1:1` asserts the ambient environment, not the code.** Use an in-process `com.sun.net.httpserver.HttpServer` on port 0, as `LiteLLMProxyAuthSpec` already does. ### Task Type - [ ] Refactor / Cleanup - [ ] DevOps / Deployment / CI - [x] Testing / QA - [ ] Documentation - [ ] Performance - [ ] Other -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
