HTHou opened a new pull request, #18345:
URL: https://github.com/apache/iotdb/pull/18345
## Description
### Root cause
Tree-model batch inserts passed the complete distinct time-series path list
to the object authentication audit logger. The object text is embedded in the
`root.__audit` `log` field, so one audit record grew with every path in the
batch. The root-user path also materialized the full path and device lists only
for audit handling.
### Changes
- Reuse the existing `path_log_max_size` setting (default: 100) when
formatting path lists for audit logs. Logs keep the first N distinct paths and
append `...` when truncated; small-list formatting is unchanged.
- Add lazy path and device streams for insert statements, including rows of
one device, multiple rows, tablets, and multiple tablets. Root-user audit
handling no longer materializes complete flattened path/device lists.
- Keep the complete distinct path list for non-root authorization checks and
truncate only the audit representation, so paths after the log threshold cannot
bypass permission checks.
- Preserve the existing protection that rejects external writes to
`root.__audit`, using a streaming first-match scan.
### Impact and compatibility
This bounds audit-record growth by the configured path count without
changing the audit schema or adding configuration. Authorization semantics are
unchanged.
### Validation
- `mvn spotless:apply -pl iotdb-core/datanode`
- `mvn test -pl iotdb-core/datanode
-Dtest=AuthorityCheckerTest,TreeAccessTest`
- 8 tests passed, 0 failures/errors/skips
- Checkstyle and Spotless checks passed
- Independent code review completed with no blocker/P1/P2 findings.
<hr>
This PR has:
- [x] been self-reviewed.
- [x] added unit tests or modified existing tests to cover new code paths,
ensuring the threshold for code coverage.
- [x] added comments explaining the "why" and the intent of the code
wherever it would not be obvious to an unfamiliar reader.
<hr>
##### Key changed/added classes (or packages if there are too many classes)
in this PR
- `AuthorityChecker`
- `TreeAccessCheckVisitor`
- `InsertBaseStatement`
- `InsertRowsStatement`
- `InsertMultiTabletsStatement`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
