Skip to content

security: add authorization checks to UsageHandler #16158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adilburaksen wants to merge 1 commit into
base: develop
Choose a base branch
from
+8 −1
Open

security: add authorization checks to UsageHandler #16158

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion cdap-app-fabric/src/main/java/io/cdap/cdap/gateway/handlers/UsageHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@
import io.cdap.cdap.proto.id.ApplicationId;
import io.cdap.cdap.proto.id.DatasetId;
import io.cdap.cdap.proto.id.ProgramId;
import io.cdap.cdap.proto.security.StandardPermission;
import io.cdap.cdap.security.spi.authorization.ContextAccessEnforcer;
import io.cdap.http.AbstractHttpHandler;
import io.cdap.http.HttpResponder;
import io.netty.handler.codec.http.HttpRequest;
Expand All @@ -41,10 +43,12 @@ public class UsageHandler extends AbstractHttpHandler {

private static final Gson GSON = new Gson();
private final UsageRegistry registry;
private final ContextAccessEnforcer contextAccessEnforcer;

@Inject
public UsageHandler(UsageRegistry registry) {
public UsageHandler(UsageRegistry registry, ContextAccessEnforcer contextAccessEnforcer) {
this.registry = registry;
this.contextAccessEnforcer = contextAccessEnforcer;
}

@GET
Expand All @@ -53,6 +57,7 @@ public void getAppDatasetUsage(HttpRequest request, HttpResponder responder,
@PathParam("namespace-id") String namespaceId,
@PathParam("app-id") String appId) {
final ApplicationId id = new ApplicationId(namespaceId, appId);
contextAccessEnforcer.enforce(id, StandardPermission.GET);

@gemini-code-assist gemini-code-assist Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The contextAccessEnforcer.enforce method throws AccessException, which is a checked exception. Since the getAppDatasetUsage method does not declare throws Exception (or throws AccessException) in its signature, this will result in a compilation error. Please update the method signature to declare throws Exception.

Set<DatasetId> ids = registry.getDatasets(id);
responder.sendJson(HttpResponseStatus.OK, GSON.toJson(ids));
}
Expand All @@ -66,6 +71,7 @@ public void getProgramDatasetUsage(HttpRequest request, HttpResponder responder,
@PathParam("program-id") String programId) {
ProgramType type = ProgramType.valueOfCategoryName(programType);
final ProgramId id = new ProgramId(namespaceId, appId, type, programId);
contextAccessEnforcer.enforce(id, StandardPermission.GET);

@gemini-code-assist gemini-code-assist Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The contextAccessEnforcer.enforce method throws AccessException, which is a checked exception. Since the getProgramDatasetUsage method does not declare throws Exception (or throws AccessException) in its signature, this will result in a compilation error. Please update the method signature to declare throws Exception.

Set<DatasetId> ids = registry.getDatasets(id);
responder.sendJson(HttpResponseStatus.OK, GSON.toJson(ids));
}
Expand All @@ -77,6 +83,7 @@ public void getDatasetAppUsage(HttpRequest request, HttpResponder responder,
@PathParam("namespace-id") String namespaceId,
@PathParam("dataset-id") String datasetId) {
final DatasetId id = new DatasetId(namespaceId, datasetId);
contextAccessEnforcer.enforce(id, StandardPermission.GET);

@gemini-code-assist gemini-code-assist Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The contextAccessEnforcer.enforce method throws AccessException, which is a checked exception. Since the getDatasetAppUsage method does not declare throws Exception (or throws AccessException) in its signature, this will result in a compilation error. Please update the method signature to declare throws Exception.

Set<ProgramId> ids = registry.getPrograms(id);
responder.sendJson(HttpResponseStatus.OK, GSON.toJson(ids));
}
Expand Down