[GitHub] [pulsar] nicoloboschi commented on pull request #18718: [fix][txn] Enable client without system topics permission to use transactions

[GitBox <gi...@apache.org>]

nicoloboschi commented on PR #18718:
URL: https://github.com/apache/pulsar/pull/18718#issuecomment-1337019340

   Thank you folks for the feedbacks. I agree this is a tricky hack and it may leads to security issues and concerns. 
   
   As suggested I will proceed implementing my custom PulsarAuthorizationProvider
   
   ```
   public class PulsarTransactionsAuthorizationProvider extends PulsarAuthorizationProvider {
   
       @Override
       public CompletableFuture<Boolean> canLookupAsync(TopicName topicName, String role,
                                                        AuthenticationDataSource authenticationData) {
           if (SystemTopicNames.isTransactionCoordinatorAssign(topicName))
               return CompletableFuture.completedFuture(true);
           }
           return super.canLookupAsync(topicName, role, authenticationData);
       }
   }
   ```
   
   I will start a discussion on dev@ to discuss about the transactions isolation design and possible improvements.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org