agali-09 opened a new pull request, #20687: URL: https://github.com/apache/druid/pull/20687
### Description Lookup HTTP endpoints currently use `CONFIG:CONFIG`, which also grants access to cluster configuration endpoints. This PR adds the `LOOKUP` resource type and the default-false `druid.auth.enableLookupAuthorization` setting. With the setting disabled, lookup endpoints retain their existing authorization behavior. When enabled, requests for a named lookup check `LOOKUP:tier/lookup_name`. Bulk GET responses omit lookups without `READ` authorization. Bulk writes check `WRITE` on every affected lookup before making changes. Deleting an empty tier checks its tier name. An empty write checks `LOOKUP:LOOKUP`. The resource filter handles names present in the route. For bulk requests, resource methods pass parsed request bodies or fetched results to the filter once the lookup names are available. Other CONFIG endpoints and lookup use during query execution are unchanged. #### Release note Administrators can enable lookup-specific HTTP permissions with `druid.auth.enableLookupAuthorization`. The setting is disabled by default, preserving existing authorization behavior on upgrade. ##### Key changed/added classes in this PR * `LookupResourceFilter` * `ResourceType` * `AuthConfig` * `LookupCoordinatorResource` * `LookupIntrospectionResource` * `LookupListeningResource` This PR has: - [x] been self-reviewed. - [x] added documentation for new or modified features or behaviors. - [x] a release note entry in the PR description. - [x] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links. - [ ] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md) - [x] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader. - [ ] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met. - [ ] added integration tests. - [ ] been tested in a test Druid cluster. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
