github-actions[bot] commented on code in PR #70130:
URL: https://github.com/apache/doris/pull/70130#discussion_r4475209768
##########
fe/fe-core/src/main/java/org/apache/doris/load/routineload/RoutineLoadJob.java:
##########
@@ -2110,6 +2110,29 @@ public void gsonPostProcess() throws IOException {
public abstract void modifyProperties(AlterRoutineLoadCommand command)
throws UserException;
+ /**
+ * Checks the workload group an ALTER leaves the job with, in the compute
group the ALTER leaves the job in, as
+ * CREATE does and as every task resolves it ({@code
KafkaTaskInfo#rePlan}): as the owner, whom the tasks run
+ * as. One that group does not have, or the owner may not use, would
otherwise fail every task with the
+ * retryable CREATE_TASKS_ERR, which auto resume repeats for good. Only an
ALTER that sets a workload group or
+ * declares a compute group changes what the tasks look up; a workload
group it does not set is the one the
+ * job keeps. Called on the statement thread under the job's write lock,
so that of two ALTERs running at once
+ * the later one checks what the earlier one left; never when an ALTER is
replayed.
+ */
+ protected void checkAlteredWorkloadGroup(Map<String, String>
alteredJobProperties) throws UserException {
+ String declaredComputeGroup = alteredJobProperties.get(COMPUTE_GROUP);
+ String alteredWorkloadGroup = alteredJobProperties.get(WORKLOAD_GROUP);
+ if (StringUtils.isEmpty(declaredComputeGroup) &&
StringUtils.isEmpty(alteredWorkloadGroup)) {
+ return;
+ }
+ String workloadGroup = StringUtils.isEmpty(alteredWorkloadGroup) ?
getWorkloadGroup() : alteredWorkloadGroup;
+ if (StringUtils.isEmpty(workloadGroup)) {
+ return;
+ }
+ CreateRoutineLoadInfo.checkWorkloadGroup(getUserIdentity(),
workloadGroup,
Review Comment:
[P1] Guard the legacy null owner before calling `checkWorkloadGroup`.
`RoutineLoadJob.userIdentity` is documented as null for jobs created before
v1.1, and an authorized ALTER can still reach this helper. Passing null into
`CreateRoutineLoadInfo.checkWorkloadGroup` creates a context whose
authorization path dereferences the identity (`AccessTranslation.subjectOf` /
`Auth.getRolesByUserWithLdap`), so a workload-group-only ALTER throws an
uncaught NullPointerException instead of a `UserException`. Reject this case
with a controlled error (or apply an established legacy owner fallback) and
cover it with a regression test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
