Skip to content

Fix table function audit operation type - #18351

Open
HTHou wants to merge 1 commit into
masterfrom
codex/fix-table-function-audit-ddl
Open

Fix table function audit operation type#18351
HTHou wants to merge 1 commit into
masterfrom
codex/fix-table-function-audit-ddl

Conversation

@HTHou

@HTHou HTHou commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Record Table-model CREATE FUNCTION and DROP FUNCTION authorization audit entries as DDL.
  • Keep the required global privilege as SYSTEM while allowing the statement operation type and audit object to be supplied explicitly.
  • Record the function name as the audit object for both root and non-root users.
  • Preserve the existing default CONTROL classification for other SYSTEM privilege checks.

Root cause

The Table-model function statements used the generic global SYSTEM privilege check. That check derived the audit operation from TableModelPrivilege.SYSTEM, which maps to CONTROL. The Tree-model path already classifies function creation and deletion explicitly as DDL, so the two SQL dialects produced inconsistent audit records.

Impact

Audit filters and reports now classify function metadata changes consistently as DDL without changing function-management authorization requirements or the classification of unrelated system-control operations.

Validation

  • mvn test -pl iotdb-core/datanode -Dtest=AuthTest -DfailIfNoTests=false
  • Checkstyle passed as part of the Maven run.
  • Spotless check passed as part of the Maven run.

@HTHou
HTHou marked this pull request as ready for review July 29, 2026 08:51
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@codecov

codecov Bot commented Jul 29, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 47.82609% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 43.16%. Comparing base (4861027) to head (9a0fd4e).
⚠️ Report is 6 commits behind head on master.

Files with missing lines Patch % Lines
...lan/relational/security/ITableAuthCheckerImpl.java 35.29% 11 Missing ⚠️
...lan/relational/security/AllowAllAccessControl.java 0.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##             master   #18351      +/-   ##
============================================
+ Coverage     43.14%   43.16%   +0.02%     
  Complexity      374      374              
============================================
  Files          5364     5364              
  Lines        382623   382678      +55     
  Branches      49749    49755       +6     
============================================
+ Hits         165077   165198     +121     
+ Misses       217546   217480      -66     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant