(nifi) branch main updated: NIFI-15403 Removed Read Authorization from Current User method

[pv...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

pvillard pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git


The following commit(s) were added to refs/heads/main by this push:
     new a8d21f24fe NIFI-15403 Removed Read Authorization from Current User method
a8d21f24fe is described below

commit a8d21f24fea0c10753711d6d9eba9e8e082bdf0a
Author: exceptionfactory <ex...@apache.org>
AuthorDate: Mon Dec 29 15:13:57 2025 -0600

    NIFI-15403 Removed Read Authorization from Current User method
    
    - Added unit test verifying getCurrentUser method does not invoke the authorizeAccess method
    
    Signed-off-by: Pierre Villard <pi...@gmail.com>
    
    This closes #10707.
---
 .../src/main/java/org/apache/nifi/web/api/FlowResource.java |  8 +-------
 .../test/java/org/apache/nifi/web/api/TestFlowResource.java | 13 +++++++++++++
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java
index d1406f2bfb..29f487fdf8 100644
--- a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java
+++ b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java
@@ -412,15 +412,9 @@ public class FlowResource extends ApplicationResource {
     @Path("current-user")
     @Operation(
             summary = "Retrieves the user identity of the user making the request",
-            responses = @ApiResponse(content = @Content(schema = @Schema(implementation = CurrentUserEntity.class))),
-            security = {
-                    @SecurityRequirement(name = "Read - /flow")
-            }
+            responses = @ApiResponse(content = @Content(schema = @Schema(implementation = CurrentUserEntity.class)))
     )
     public Response getCurrentUser() {
-
-        authorizeFlow();
-
         final CurrentUserEntity entity;
         if (isReplicateRequest()) {
             try (Response replicatedResponse = replicate(HttpMethod.GET)) {
diff --git a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/TestFlowResource.java b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/TestFlowResource.java
index 40476c4e76..6724dbfdd2 100644
--- a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/TestFlowResource.java
+++ b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/TestFlowResource.java
@@ -65,6 +65,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.net.HttpURLConnection;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -90,6 +91,8 @@ import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
@@ -502,6 +505,16 @@ public class TestFlowResource {
         assertEquals(expectedServicesIds, serviceIds);
     }
 
+    @Test
+    public void testGetCurrentUser() {
+        final Response response = resource.getCurrentUser();
+
+        assertNotNull(response);
+        assertEquals(HttpURLConnection.HTTP_OK, response.getStatus());
+
+        verify(serviceFacade, never()).authorizeAccess(any());
+    }
+
     private void setUpGetVersionDifference() {
         doReturn(getDifferences()).when(serviceFacade).getVersionDifference(anyString(), any(FlowVersionLocation.class), any(FlowVersionLocation.class));
     }