aicam commented on code in PR #6869:
URL: https://github.com/apache/texera/pull/6869#discussion_r3827631915
##########
file-service/src/main/scala/org/apache/texera/service/FileService.scala:
##########
@@ -90,6 +92,8 @@ class FileService extends
Application[FileServiceConfiguration] with LazyLogging
environment.jersey.register(classOf[DatasetResource])
environment.jersey.register(classOf[DatasetAccessResource])
+ environment.jersey.register(classOf[ModelResource])
Review Comment:
`FileServiceRunSpec` hard-codes the list of resources it scans
(`DatasetResource`, `DatasetAccessResource`, `HealthCheckResource`), so the two
resources registered here aren't covered by its access-control assertion — the
spec keeps passing without checking them. Worth adding both to that `Seq`.
Same gap on the other side: there's no `ModelResourcePermissionsSpec`
mirroring `DatasetResourcePermissionsSpec`, so nothing pins `getPublicModel` as
the only `@PermitAll` endpoint on `ModelResource`.
##########
file-service/src/main/scala/org/apache/texera/service/FileService.scala:
##########
@@ -90,6 +92,8 @@ class FileService extends
Application[FileServiceConfiguration] with LazyLogging
environment.jersey.register(classOf[DatasetResource])
environment.jersey.register(classOf[DatasetAccessResource])
+ environment.jersey.register(classOf[ModelResource])
+ environment.jersey.register(classOf[ModelAccessResource])
Review Comment:
These endpoints aren't reachable through any gateway. `/api/dataset` and
`/api/access/dataset` are declared in three places —
`frontend/proxy.config.json`, `bin/single-node/nginx.conf`, and
`bin/k8s/templates/base/gateway/gateway-routes.yaml` — and `/api/model` /
`/api/access/model` are in none of them, so they fall into the `/api` catch-all
and hit the dashboard webserver instead. Direct `:9092` is the only way in
today.
Reasonable if routing is meant to land with the frontend PR, but worth
calling out in the description. One thing to watch when adding it:
`/api/models` (plural) already routes to access-control-service for the LLM
catalog.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
