You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "Yicong-Huang (via GitHub)" <gi...@apache.org> on 2026/06/06 07:51:44 UTC
[PR] fix(auth): make JwtAuthFilter eager-401 with @PermitAll opt-out (re-attempt of #4903) [texera]
Yicong-Huang opened a new pull request, #5404:
URL: https://github.com/apache/texera/pull/5404
### What changes were proposed in this PR?
Replaces the lazy pass-through behavior in `common/auth/JwtAuthFilter` with an RFC 6750 eager 401 + `WWW-Authenticate` challenge. Missing `Authorization` throws the bare `Bearer` challenge; an invalid token throws `error="invalid_token"` so a well-behaved client can distinguish "please log in" from "your stored token is invalid, discard it". Valid tokens populate a `SecurityContext` exactly as before.
Endpoints that need to serve anonymous traffic opt out with `@PermitAll` (JSR-250). This PR audits every resource method in the 5 microservices and applies `@PermitAll` where the lazy filter previously made it implicit:
- 5x `HealthCheckResource` (liveness probes)
- `AccessControlResource` `/auth/*` (routing proxy that authenticates itself via `parseToken` in the resource body)
- `LiteLLMProxyResource` `/chat/*`, `LiteLLMModelsResource` `/models` (preserve current "gated only by `guiWorkflowWorkspaceCopilotEnabled`" behavior; whether these should require an authenticated user is a separate hardening decision)
- `DatasetResource`: 5 endpoints with `/public-*` or `/publicVersion` paths, plus `/{did}/cover` and `/{did}/cover-url` which already take `@Auth Optional[SessionUser]` for opt-in user context
`UnauthorizedException` + `UnauthorizedExceptionMapper` carry the `WWW-Authenticate` challenge to the JAX-RS edge. The exception extends `RuntimeException` (not `WebApplicationException`) so unit tests can run without a Jersey `RuntimeDelegate` on the classpath, and is constructed with `writableStackTrace=false` to avoid `fillInStackTrace` cost on the auth hot path.
### Any related issues, documentation, discussions?
Closes #4901. The earlier attempt at this fix, #4903, was reverted in #5025 because expired tokens from `localStorage` were piggy-backed onto `/api/config/gui` and broke the login page (#5026). PR #5392 has since fixed the frontend to drop expired tokens client-side (`skipWhenExpired: true`) and clear the session reactively on 401, so this PR can now ship safely.
### How was this PR tested?
Added `JwtAuthFilterSpec` (header-missing / non-Bearer / invalid-token / valid-token; method- and class-level `@PermitAll`; resource-info-absent fallback) and `UnauthorizedExceptionMapperSpec`. Updated existing service specs to expect 401 (from the filter) instead of 403 (from the role filter) for missing-Authorization scenarios, and `*ServiceRunSpec` mocks verify the new `UnauthorizedExceptionMapper` registration. `sbt Auth/test` + 4 service specs all green; `sbt scalafmtCheckAll` clean.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Opus 4.7)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): make JwtAuthFilter eager-401 with @PermitAll opt-out (re-attempt of #4903) [texera]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #5404:
URL: https://github.com/apache/texera/pull/5404#issuecomment-4637876818
## [Codecov](https://app.codecov.io/gh/apache/texera/pull/5404?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 51.63%. Comparing base ([`749798d`](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`7fc7edb`](https://app.codecov.io/gh/apache/texera/commit/7fc7edb18b58864da4f1da598d1d46dd524f011f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #5404 +/- ##
=========================================
Coverage 51.63% 51.63%
Complexity 2422 2422
=========================================
Files 1057 1057
Lines 41069 41070 +1
Branches 4415 4415
=========================================
+ Hits 21206 21207 +1
Misses 18623 18623
Partials 1240 1240
```
| [Flag](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | | *Carryforward flag |
|---|---|---|---|
| [access-control-service](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.89% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [agent-service](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `33.76% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [amber](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `52.25% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [computing-unit-managing-service](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `1.38% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [config-service](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `55.38% <100.00%> (+0.69%)` | :arrow_up: | |
| [file-service](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `38.42% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [frontend](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `46.36% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [pyamber](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.69% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [python](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.84% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [workflow-compiling-service](https://app.codecov.io/gh/apache/texera/pull/5404/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `58.39% <ø> (ø)` | | Carriedforward from [749798d](https://app.codecov.io/gh/apache/texera/commit/749798d8214a5999b2870ebcf3f62fefd609edfa?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
*This pull request uses carry forward flags. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/texera/pull/5404?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): make JwtAuthFilter eager-401 with @PermitAll opt-out [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on PR #5404:
URL: https://github.com/apache/texera/pull/5404#issuecomment-4640811418
thanks! merging now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): make JwtAuthFilter eager-401 with @PermitAll opt-out [texera]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #5404:
URL: https://github.com/apache/texera/pull/5404#issuecomment-4640836925
Backport to [`release/v1.2`](https://github.com/apache/texera/tree/release/v1.2) succeeded as [`fb315d6`](https://github.com/apache/texera/commit/fb315d62a6e02374b75289c8f3d2804d0463edc9). [Run](https://github.com/apache/texera/actions/runs/27077427376)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): make JwtAuthFilter eager-401 with @PermitAll opt-out [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on PR #5404:
URL: https://github.com/apache/texera/pull/5404#issuecomment-4640802016
coverage needs to be filled from individual services. will cover them later to keep this PR smaller.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): make JwtAuthFilter eager-401 with @PermitAll opt-out [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on PR #5404:
URL: https://github.com/apache/texera/pull/5404#issuecomment-4640320422
also this one @xuang7
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): make JwtAuthFilter eager-401 with @PermitAll opt-out [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang merged PR #5404:
URL: https://github.com/apache/texera/pull/5404
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org