From 516f49064c53ac0969c26913ec214f280b80454d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adil=20Burak=20=C5=9Een?=
 <56400880+adilburaksen@users.noreply.github.com>
Date: Thu, 11 Jun 2026 12:05:58 +0300
Subject: [PATCH] Enforce namespace authorization on draft read endpoints

---
 .../java/io/cdap/cdap/datapipeline/service/DraftHandler.java    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java b/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java
index f130b7b7e192..17f3792afc79 100644
--- a/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java
+++ b/cdap-app-templates/cdap-etl/cdap-data-pipeline-base/src/main/java/io/cdap/cdap/datapipeline/service/DraftHandler.java
@@ -83,6 +83,7 @@ public void listDrafts(HttpServiceRequest request, HttpServiceResponder responde
                          @QueryParam("sortOrder") @DefaultValue("ASC") String sortOrder,
                          @QueryParam("filter") @Nullable String filter) {
 
+    contextAccessEnforcer.enforce(new NamespaceId(namespaceName), StandardPermission.LIST);
     respond(namespaceName, responder, (namespace) -> {
       if (!draftService.fieldExists(sortBy)) {
         throw new IllegalArgumentException(String.format(
@@ -103,6 +104,7 @@ public void listDrafts(HttpServiceRequest request, HttpServiceResponder responde
   public void getDraft(HttpServiceRequest request, HttpServiceResponder responder,
                        @PathParam("context") String namespaceName,
                        @PathParam("draft") String draftId) {
+    contextAccessEnforcer.enforce(new NamespaceId(namespaceName), StandardPermission.GET);
     respond(namespaceName, responder, (namespace) -> {
       String userId = "";
       DraftId id = new DraftId(namespace, draftId, userId);