raghav-reglobe commented on PR #67672: URL: https://github.com/apache/doris/pull/67672#issuecomment-5680268686
Rebased onto current master (28577df9f6). The session-layer refactors (#67883, #67900) removed the block next to our forwarded-narrowing hook in `ConnectProcessor`; the rebase keeps only `applyForwardedSessionNarrowing` there, and `ConnectProcessorFlightForwardOutcomeTest` went away together with the method it tested. One new commit on top. The authorization plugin SPI (#66770) resolves every privilege check through `AccessTranslation`, which refuses a privilege that has no access action at class-initialization time, so `PROXY_PRIV` needed one. It now maps to a new `AccessAction.PROXY`. That is a recorded-surface change, so the plugin API major moves to 2.0 in the same commit (surface baseline, pom, and the test literal). The Doris Ranger service has no access type for switching the session, so `DorisAccessType` answers PROXY with ADMIN: a Ranger-authorized cluster grants SU to its administrators and to nobody else, which is what the engine's own predicate (ADMIN_PRIV implies PROXY_PRIV) already says. The access-control behaviour baseline gains the PROXY column wherever ADMIN is answered, since no fixture user holds PROXY_PRIV. Gate on this head, built from the branch on top of current master: FE build and checkstyle clean; the SU suites plus `AccessTranslationTest`, `AccessControlBehaviorBaselineTest` and `AuthorizationPluginSurfaceTest` all green (91 tests: 88 in fe-core, 3 in the SPI module). If you would rather not carry an API major bump inside this PR, the alternatives are a dedicated Ranger access type for PROXY or folding it under an existing action. Happy to go either way. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
