CRZbulabula opened a new pull request, #18309:
URL: https://github.com/apache/iotdb/pull/18309

   ## Description
   
   Replace the misleading `read-only` error used for unsupported operations on 
the audit database with a more accurate message:
   
   > Apache IoTDB does not support this operation on database '%s'.
   
   The message is shared by the tree-model and table-model authorization paths 
and is localized in both English and Chinese.
   
   This PR also fixes the internal audit writer exemption in 
`TreeAccessCheckVisitor`. The check now compares `INTERNAL_AUDIT_USER` with the 
request username instead of the target path.
   
   ## Affected operations
   
   - Apply the new message to tree-model write, schema, template, TTL, and 
database deletion checks that previously reported the audit database as 
read-only.
   - Apply the same message to unsupported table-model operations on `__audit`.
   - Keep the existing reserved-name, grant/revoke, and AUDIT-admin query 
messages unchanged because they already describe their restrictions precisely.
   - Preserve writes from the internal audit user while rejecting external 
writes to `root.__audit`.
   
   ## Test coverage
   
   - Add coverage for `DELETE DATABASE root.__audit` and template operations in 
`IoTDBTemplateAuthIT`.
   - Update TTL coverage in `IoTDBSeriesPermissionIT`.
   - Add coverage for `DROP DATABASE __audit` in `IoTDBAuthenticationTableIT`.
   - Add a focused unit test for internal audit writes, external audit writes, 
and writes to ordinary paths.
   
   Verified with:
   
   - `mvn spotless:apply -pl iotdb-core/datanode`
   - `IoTDBTemplateAuthIT#manageDataBaseTest`
   - `IoTDBSeriesPermissionIT#ttlOperationsTest`
   - `git diff --check`
   
   <hr>
   
   This PR has:
   - [x] been self-reviewed.
   - [x] added comments explaining the intent where it was not obvious.
   - [x] added or updated unit and integration tests.
   - [x] been tested in a test IoTDB cluster.
   
   <hr>
   
   ##### Key changed/added classes (or packages if there are too many classes) 
in this PR
   
   - `AccessControlImpl`
   - `ITableAuthCheckerImpl`
   - `TreeAccessCheckVisitor`
   - `DataNodeQueryMessages`
   - `TreeAccessTest`
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to