HTHou opened a new pull request, #18351: URL: https://github.com/apache/iotdb/pull/18351
## Summary - Record Table-model `CREATE FUNCTION` and `DROP FUNCTION` authorization audit entries as `DDL`. - Keep the required global privilege as `SYSTEM` while allowing the statement operation type and audit object to be supplied explicitly. - Record the function name as the audit object for both root and non-root users. - Preserve the existing default `CONTROL` classification for other `SYSTEM` privilege checks. ## Root cause The Table-model function statements used the generic global `SYSTEM` privilege check. That check derived the audit operation from `TableModelPrivilege.SYSTEM`, which maps to `CONTROL`. The Tree-model path already classifies function creation and deletion explicitly as `DDL`, so the two SQL dialects produced inconsistent audit records. ## Impact Audit filters and reports now classify function metadata changes consistently as DDL without changing function-management authorization requirements or the classification of unrelated system-control operations. ## Validation - `mvn test -pl iotdb-core/datanode -Dtest=AuthTest -DfailIfNoTests=false` - Checkstyle passed as part of the Maven run. - Spotless check passed as part of the Maven run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
