Skip to content

Improve error messages for unsupported __audit database operations#18309

Merged
CRZbulabula merged 2 commits into
masterfrom
yongzao/improve-audit-database-error-message
Jul 25, 2026
Merged

Improve error messages for unsupported __audit database operations#18309
CRZbulabula merged 2 commits into
masterfrom
yongzao/improve-audit-database-error-message

Conversation

@CRZbulabula

Copy link
Copy Markdown
Contributor

Description

Replace the misleading read-only error used for unsupported operations on the audit database with a more accurate message:

Apache IoTDB does not support this operation on database '%s'.

The message is shared by the tree-model and table-model authorization paths and is localized in both English and Chinese.

This PR also fixes the internal audit writer exemption in TreeAccessCheckVisitor. The check now compares INTERNAL_AUDIT_USER with the request username instead of the target path.

Affected operations

  • Apply the new message to tree-model write, schema, template, TTL, and database deletion checks that previously reported the audit database as read-only.
  • Apply the same message to unsupported table-model operations on __audit.
  • Keep the existing reserved-name, grant/revoke, and AUDIT-admin query messages unchanged because they already describe their restrictions precisely.
  • Preserve writes from the internal audit user while rejecting external writes to root.__audit.

Test coverage

  • Add coverage for DELETE DATABASE root.__audit and template operations in IoTDBTemplateAuthIT.
  • Update TTL coverage in IoTDBSeriesPermissionIT.
  • Add coverage for DROP DATABASE __audit in IoTDBAuthenticationTableIT.
  • Add a focused unit test for internal audit writes, external audit writes, and writes to ordinary paths.

Verified with:

  • mvn spotless:apply -pl iotdb-core/datanode
  • IoTDBTemplateAuthIT#manageDataBaseTest
  • IoTDBSeriesPermissionIT#ttlOperationsTest
  • git diff --check

This PR has:

  • been self-reviewed.
  • added comments explaining the intent where it was not obvious.
  • added or updated unit and integration tests.
  • been tested in a test IoTDB cluster.

Key changed/added classes (or packages if there are too many classes) in this PR
  • AccessControlImpl
  • ITableAuthCheckerImpl
  • TreeAccessCheckVisitor
  • DataNodeQueryMessages
  • TreeAccessTest

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
E Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@codecov

codecov Bot commented Jul 25, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 12.50000% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 42.87%. Comparing base (f7be88e) to head (93d3d65).
⚠️ Report is 8 commits behind head on master.

Files with missing lines Patch % Lines
...an/relational/security/TreeAccessCheckVisitor.java 10.00% 18 Missing ⚠️
...ne/plan/relational/security/AccessControlImpl.java 33.33% 2 Missing ⚠️
...lan/relational/security/ITableAuthCheckerImpl.java 0.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##             master   #18309      +/-   ##
============================================
+ Coverage     42.83%   42.87%   +0.04%     
  Complexity      374      374              
============================================
  Files          5362     5362              
  Lines        381409   381600     +191     
  Branches      49509    49553      +44     
============================================
+ Hits         163368   163623     +255     
+ Misses       218041   217977      -64     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@CRZbulabula
CRZbulabula merged commit 165cd4c into master Jul 25, 2026
45 of 48 checks passed
@CRZbulabula
CRZbulabula deleted the yongzao/improve-audit-database-error-message branch July 25, 2026 15:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant