You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "adutra (via GitHub)" <gi...@apache.org> on 2025/10/02 10:36:06 UTC
[PR] Cleanup RealmContextFilter [polaris]
adutra opened a new pull request, #2747:
URL: https://github.com/apache/polaris/pull/2747
Summary of changes:
1. Remove the call to `ContextLocals` (context: https://github.com/apache/polaris/pull/2720#discussion_r2392709683).
2. Don't include the exception's message in the response as it can leak details about Polaris internals.
3. Add a small test for success and failure cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "adnanhemani (via GitHub)" <gi...@apache.org>.
adnanhemani commented on code in PR #2747:
URL: https://github.com/apache/polaris/pull/2747#discussion_r2400165712
##########
runtime/service/src/test/java/org/apache/polaris/service/context/RealmContextFilterTest.java:
##########
@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.polaris.service.context;
+
+import static io.restassured.RestAssured.given;
+import static org.hamcrest.CoreMatchers.is;
+
+import io.quarkus.test.common.http.TestHTTPEndpoint;
+import io.quarkus.test.junit.QuarkusTest;
+import io.quarkus.test.junit.QuarkusTestProfile;
+import io.quarkus.test.junit.TestProfile;
+import io.restassured.http.ContentType;
+import io.restassured.specification.RequestSpecification;
+import jakarta.ws.rs.core.Response;
+import java.util.Map;
+import org.apache.polaris.service.catalog.api.IcebergRestOAuth2Api;
+import org.junit.jupiter.api.Test;
+
+@QuarkusTest
+@TestHTTPEndpoint(IcebergRestOAuth2Api.class)
+@TestProfile(RealmContextFilterTest.Profile.class)
+@SuppressWarnings("UastIncorrectHttpHeaderInspection")
+class RealmContextFilterTest {
+
+ public static class Profile implements QuarkusTestProfile {
+ @Override
+ public Map<String, String> getConfigOverrides() {
+ return Map.of(
+ "polaris.realm-context.header-name",
+ REALM_HEADER,
+ "polaris.realm-context.realms",
+ "realm1,realm2",
+ "polaris.bootstrap.credentials",
+ "realm1,client1,secret1;realm2,client2,secret2");
+ }
+ }
+
+ private static final String REALM_HEADER = "test-header-r123";
+
+ @Test
+ public void testInvalidRealmHeaderValue() {
+ givenTokenRequest("client1", "secret1")
+ .header(REALM_HEADER, "INVALID")
+ .when()
+ .post()
+ .then()
+ .statusCode(Response.Status.NOT_FOUND.getStatusCode())
+ .body("error.message", is("Missing or invalid realm"))
+ .body("error.type", is("MissingOrInvalidRealm"))
+ .body("error.code", is(Response.Status.NOT_FOUND.getStatusCode()));
+ }
+
+ @Test
+ public void testNoRealmHeader() {
+ givenTokenRequest("client2", "secret2")
+ .header("irrelevant-header", "fake-realm")
+ .when()
+ .post()
+ .then()
+ .statusCode(Response.Status.UNAUTHORIZED.getStatusCode());
+ }
+
+ @Test
+ public void testDefaultRealm() {
+ givenTokenRequest("client1", "secret1")
Review Comment:
What's the difference between this test and the one above it? Per what I'm seeing, it's the exact same request for different users who both have correct credentials as per L51.
I don't see the `require-header` variable changing between the two so I'm confused whether this is testing the default header properly or not, as the test names suggest? And if the default header was triggering the `IllegalArgumentException`, wouldn't that be a `400 Bad Request` error code rather than `Unauthorized`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain merged PR #2747:
URL: https://github.com/apache/polaris/pull/2747
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on PR #2747:
URL: https://github.com/apache/polaris/pull/2747#issuecomment-3368488016
Thanks a lot for working on it @adutra ! Thanks @snazy @dimas-b @adnanhemani for the review!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on PR #2747:
URL: https://github.com/apache/polaris/pull/2747#issuecomment-3361149115
> just a few now failing test assertions
Whoops there were tests for that already 😅 I didn't know.
I will merge the two test classes together.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on PR #2747:
URL: https://github.com/apache/polaris/pull/2747#issuecomment-3360424711
cc @flyrain @adnanhemani @dimas-b
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on code in PR #2747:
URL: https://github.com/apache/polaris/pull/2747#discussion_r2402387638
##########
runtime/service/src/test/java/org/apache/polaris/service/context/RealmContextFilterTest.java:
##########
@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.polaris.service.context;
+
+import static io.restassured.RestAssured.given;
+import static org.hamcrest.CoreMatchers.is;
+
+import io.quarkus.test.common.http.TestHTTPEndpoint;
+import io.quarkus.test.junit.QuarkusTest;
+import io.quarkus.test.junit.QuarkusTestProfile;
+import io.quarkus.test.junit.TestProfile;
+import io.restassured.http.ContentType;
+import io.restassured.specification.RequestSpecification;
+import jakarta.ws.rs.core.Response;
+import java.util.Map;
+import org.apache.polaris.service.catalog.api.IcebergRestOAuth2Api;
+import org.junit.jupiter.api.Test;
+
+@QuarkusTest
+@TestHTTPEndpoint(IcebergRestOAuth2Api.class)
+@TestProfile(RealmContextFilterTest.Profile.class)
+@SuppressWarnings("UastIncorrectHttpHeaderInspection")
+class RealmContextFilterTest {
+
+ public static class Profile implements QuarkusTestProfile {
+ @Override
+ public Map<String, String> getConfigOverrides() {
+ return Map.of(
+ "polaris.realm-context.header-name",
+ REALM_HEADER,
+ "polaris.realm-context.realms",
+ "realm1,realm2",
+ "polaris.bootstrap.credentials",
+ "realm1,client1,secret1;realm2,client2,secret2");
+ }
+ }
+
+ private static final String REALM_HEADER = "test-header-r123";
+
+ @Test
+ public void testInvalidRealmHeaderValue() {
+ givenTokenRequest("client1", "secret1")
+ .header(REALM_HEADER, "INVALID")
+ .when()
+ .post()
+ .then()
+ .statusCode(Response.Status.NOT_FOUND.getStatusCode())
+ .body("error.message", is("Missing or invalid realm"))
+ .body("error.type", is("MissingOrInvalidRealm"))
+ .body("error.code", is(Response.Status.NOT_FOUND.getStatusCode()));
+ }
+
+ @Test
+ public void testNoRealmHeader() {
+ givenTokenRequest("client2", "secret2")
+ .header("irrelevant-header", "fake-realm")
+ .when()
+ .post()
+ .then()
+ .statusCode(Response.Status.UNAUTHORIZED.getStatusCode());
+ }
+
+ @Test
+ public void testDefaultRealm() {
+ givenTokenRequest("client1", "secret1")
Review Comment:
The behavior is different because the default realm is `realm1`.
In the original test class there were comments explaining this, which I forgot to port over. I will add them now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #2747:
URL: https://github.com/apache/polaris/pull/2747#discussion_r2402807154
##########
runtime/service/src/main/java/org/apache/polaris/service/context/RealmContextFilter.java:
##########
@@ -46,19 +50,20 @@ public Uni<Response> resolveRealmContext(ContainerRequestContext rc) {
rc.getHeaders()::getFirst))
.onItem()
.invoke(realmContext -> rc.setProperty(REALM_CONTEXT_KEY, realmContext))
+ // ContextLocals is used by RealmIdTagContributor to add the realm id to metrics
.invoke(realmContext -> ContextLocals.put(REALM_CONTEXT_KEY, realmContext))
Review Comment:
Trying to understand why `RealmIdTagContributor` cannot read from the `ContainerRequestContext` instead of relying on `ContextLocals` to pass around any object needed for a `HttpServerMetricsTagsContributor`. Or would it be reasonable to copy the whole `rc` into a `ContextLocals` by default? So that any operation on the `ContextLocals` can use the `ContainerRequestContext`. Would you mind sharing your thought on it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Cleanup RealmContextFilter [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #2747:
URL: https://github.com/apache/polaris/pull/2747#discussion_r2402807154
##########
runtime/service/src/main/java/org/apache/polaris/service/context/RealmContextFilter.java:
##########
@@ -46,19 +50,20 @@ public Uni<Response> resolveRealmContext(ContainerRequestContext rc) {
rc.getHeaders()::getFirst))
.onItem()
.invoke(realmContext -> rc.setProperty(REALM_CONTEXT_KEY, realmContext))
+ // ContextLocals is used by RealmIdTagContributor to add the realm id to metrics
.invoke(realmContext -> ContextLocals.put(REALM_CONTEXT_KEY, realmContext))
Review Comment:
Trying to understand why `RealmIdTagContributor` cannot read from the `ContainerRequestContext` instead of relying on `ContextLocals` to pass around any object needed for a `HttpServerMetricsTagsContributor`. Or would it be reasonable to copy the whole `rc` into a `ContextLocals` by default? Would you mind sharing your thought on it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org