[Bug] Tree-model SHOW QUERIES / KILL QUERY not restricted to current user for unprivileged users

[wenwei shu <s1...@gmail.com>]

Hi all,

I'd like to share a bug fix introduced by the following PR:

   - Master: https://github.com/apache/iotdb/pull/18359

This bug affects the tree-model SHOW QUERIES and KILL QUERY statements: an
unprivileged user (one who does not pass the MAINTAIN authorization check)
could view or kill *other* users' queries, while a privileged user was
conversely restricted to only their own queries.

The root cause is an inverted condition in TreeAccessCheckVisitor:

   - visitShowQueries and visitKillQuery called
   statement.setAllowedUsername(context.getUsername()) when the MAINTAIN
    check *succeeded* instead of when it *failed*.
   - As a result, a user who failed the MAINTAIN check got no
   allowedUsername filter (and could see/kill everyone's queries), while a
   user who passed it was unnecessarily scoped to their own queries only.

The fix negates the condition, so the intended rules now apply:

   - If the MAINTAIN check fails, the statement is restricted to the
   current user's queries (allowedUsername is set).
   - If the check succeeds, no restriction is applied (view/kill all users'
   queries).
   - Users with the SYSTEM privilege (which contains the deprecated
MAINTAIN privilege)
   can view and kill queries from all users.

Main changes include:

   - Fix the inverted condition in TreeAccessCheckVisitor.visitShowQueries
    and visitKillQuery.
   - Add IoTDBShowQueriesIT with showQueriesAuthTest and killQueryAuthTest,
   using queries that remain active across Session fetches (result sets left
   unconsumed), and verifying visibility/kill permissions before and after
   granting SYSTEM (without granting deprecated MAINTAIN directly).

Feedback and suggestions are welcome.

大家好， 我想分享以下 PR 中修复的一个权限过滤问题：

   - Master：https://github.com/apache/iotdb/pull/18359

该问题影响树模型的 SHOW QUERIES 与 KILL QUERY 语句：未通过 MAINTAIN 权限检查的普通用户可以查看或终止*其他用户*
的查询，而拥有权限的用户反而被限制为只能查看自己的查询。

根本原因是 TreeAccessCheckVisitor 中条件写反了：

   - visitShowQueries 与 visitKillQuery 在 MAINTAIN 权限检查*通过*时才调用
   statement.setAllowedUsername(context.getUsername())，而不是在*失败*时调用。
   - 因此，未通过检查的用户没有得到 allowedUsername
    过滤（可以看到/终止所有人的查询），而通过检查的用户反而被不必要地限制为只能查看自己的查询。

本次修复将条件取反，使预期规则正确生效：

   - 若 MAINTAIN 检查失败，则限制为仅当前用户的查询（设置 allowedUsername）。
   - 若检查通过，则不做限制（可查看/终止所有用户的查询）。
   - 拥有 SYSTEM 权限（其中包含已废弃的 MAINTAIN 权限）的用户可以查看和终止所有用户的查询。

主要修改包括：

   - 修复 TreeAccessCheckVisitor.visitShowQueries 与 visitKillQuery 中写反的条件。
   - 新增 IoTDBShowQueriesIT，包含 showQueriesAuthTest 与 killQueryAuthTest，使用跨
   Session 拉取仍保持活跃的查询（结果集不消费完），并在授予 SYSTEM 权限前后验证可见性与终止权限（不直接授予已废弃的 MAINTAIN
   ）。

欢迎大家提出反馈和建议。

Best regards, Wenwei Shu