CRZbulabula opened a new pull request, #18309: URL: https://github.com/apache/iotdb/pull/18309
## Description Replace the misleading `read-only` error used for unsupported operations on the audit database with a more accurate message: > Apache IoTDB does not support this operation on database '%s'. The message is shared by the tree-model and table-model authorization paths and is localized in both English and Chinese. This PR also fixes the internal audit writer exemption in `TreeAccessCheckVisitor`. The check now compares `INTERNAL_AUDIT_USER` with the request username instead of the target path. ## Affected operations - Apply the new message to tree-model write, schema, template, TTL, and database deletion checks that previously reported the audit database as read-only. - Apply the same message to unsupported table-model operations on `__audit`. - Keep the existing reserved-name, grant/revoke, and AUDIT-admin query messages unchanged because they already describe their restrictions precisely. - Preserve writes from the internal audit user while rejecting external writes to `root.__audit`. ## Test coverage - Add coverage for `DELETE DATABASE root.__audit` and template operations in `IoTDBTemplateAuthIT`. - Update TTL coverage in `IoTDBSeriesPermissionIT`. - Add coverage for `DROP DATABASE __audit` in `IoTDBAuthenticationTableIT`. - Add a focused unit test for internal audit writes, external audit writes, and writes to ordinary paths. Verified with: - `mvn spotless:apply -pl iotdb-core/datanode` - `IoTDBTemplateAuthIT#manageDataBaseTest` - `IoTDBSeriesPermissionIT#ttlOperationsTest` - `git diff --check` <hr> This PR has: - [x] been self-reviewed. - [x] added comments explaining the intent where it was not obvious. - [x] added or updated unit and integration tests. - [x] been tested in a test IoTDB cluster. <hr> ##### Key changed/added classes (or packages if there are too many classes) in this PR - `AccessControlImpl` - `ITableAuthCheckerImpl` - `TreeAccessCheckVisitor` - `DataNodeQueryMessages` - `TreeAccessTest` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
