[GitHub] [pulsar] sijie commented on a change in pull request #7587: Use Consume/Produce/Lookup interfaces for specific operations in allowTopicOperation

[GitBox <gi...@apache.org>]

sijie commented on a change in pull request #7587:
URL: https://github.com/apache/pulsar/pull/7587#discussion_r456711979



##########
File path: pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationService.java
##########
@@ -486,7 +486,16 @@ public Boolean allowNamespacePolicyOperation(NamespaceName namespaceName, Policy
         }
 
         if (provider != null) {
-            return provider.allowTopicOperationAsync(topicName, originalRole, role, operation, authData);
+            switch (operation) {
+                case PRODUCE:
+                    return canProduceAsync(topicName, role, authData);
+                case CONSUME:
+                    return canConsumeAsync(topicName, role, authData, null);
+                case LOOKUP:
+                    return canLookupAsync(topicName, role, authData);
+                default:
+                    return provider.allowTopicOperationAsync(topicName, originalRole, role, operation, authData);

Review comment:
       I think it is better to change the default implementation in the AuthorizationProvider interface instead of here. 
   
   ```
       /**
        * Grant authorization-action permission on a topic to the given client
        * @param topic
        * @param originalRole role not overriden by proxy role if request do pass through proxy
        * @param role originalRole | proxyRole if the request didn't pass through proxy
        * @param operation
        * @param authData
        * @return CompletableFuture<Boolean>
        */
       default CompletableFuture<Boolean> allowTopicOperationAsync(TopicName topic, String originalRole, String role,
                                                                TopicOperation operation,
                                                                AuthenticationDataSource authData) {
   switch (operation) {
                   case PRODUCE:
                       return canProduceAsync(topicName, role, authData);
                   case CONSUME:
                       return canConsumeAsync(topicName, role, authData, null);
                   case LOOKUP:
                       return canLookupAsync(topicName, role, authData);
                   default:
                        return FutureUtil.failedFuture(new IllegalStateException("TopicOperation is not supported by the Authorization provider you are using."));
       }
   ```




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org