sqs access rights: allow tokenless requests if EnforceUserTokenRequirement doesn't specified#34552
Conversation
|
⚪ ⚪ Ya make output | Test bloat | Test bloat
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
|
🟢 |
|
⚪
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
Run Extra TestsRun additional tests for this PR. You can customize:
|
ubyte
force-pushed
the
sqs-access-rights-LOGBROKER-10209
branch
from
4367784 to
af937ec
Compare
|
⚪
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
|
⚪ ⚪ Ya make output | Test bloat | Test bloat
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
There was a problem hiding this comment.
Pull request overview
This PR improves access control and authentication handling for SQS/Topic services by refactoring token management and adding credential requirements enforcement.
Changes:
- Refactored token handling to use
GetInternalToken()instead of manually creating tokens from serialized strings across all SQS/Topic operations - Added signature validation logic with an
Empty()method to detect and handle empty AWS signatures - Enhanced authentication enforcement by checking
RequireCredentialsInNewProtocolconfiguration in addition to existing checks - Added comprehensive test coverage for unauthenticated scenarios with new
TNoAuthFixturetest class
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| ydb/services/sqs_topic/send_message.cpp | Replaced manual token creation with GetInternalToken() for writer settings |
| ydb/services/sqs_topic/receive_message.cpp | Replaced manual token creation with GetInternalToken() for reader settings |
| ydb/services/sqs_topic/delete_message.cpp | Replaced manual token creation with GetInternalToken() for committer settings |
| ydb/services/sqs_topic/change_message_visibility.cpp | Replaced manual token creation with GetInternalToken() for deadline changer settings |
| ydb/services/sqs_topic/purge_queue.cpp | Replaced manual token creation with GetInternalToken() for purger settings |
| ydb/services/sqs_topic/list_queues.cpp | Added RequireCredentialsInNewProtocol check for authentication enforcement |
| ydb/library/http_proxy/authorization/signature.h | Added Empty() method declaration and Empty_ member to track signature presence |
| ydb/library/http_proxy/authorization/signature.cpp | Implemented Empty() method to detect empty signatures |
| ydb/core/http_proxy/http_req.cpp | Enhanced authentication logic to handle empty signatures and enforce credential requirements |
| ydb/core/http_proxy/ut/sqs_topic_ut.cpp | Added comprehensive tests for authenticated and unauthenticated scenarios |
| ydb/core/http_proxy/ut/datastreams_fixture/datastreams_fixture.h | Added authorization control methods and fixed access specifiers for test fixture classes |
| ydb/core/http_proxy/ut/datastreams_fixture/datastreams_fixture.cpp | Implemented authorization control and added null checks in TearDown for robustness |
ubyte
changed the title
|
⚪ ⚪ DetailsYa make output | Test bloat | Test bloat
⚪ Ya make output | Test bloat | Test bloat | Test bloat
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
|
⚪
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
|
⚪ ⚪ Ya make output | Test bloat | Test bloat
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
|
⚪
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
BackportTo backport this PR, click the button next to the target branch and then click "Run workflow" in the Run Actions UI.
|
…ement doesn't specified (ydb-platform#34552) LOGBROKER-10209
…ement doesn't specified (ydb-platform#34552) LOGBROKER-10209
Changelog entry
...
Changelog category
Description for reviewers
LOGBROKER-10209