YQ-4356 supported secure script executions #26806
Conversation
|
🔴 Bugfix requires a linked issue in the changelog entry |
There was a problem hiding this comment.
Pull Request Overview
This PR implements secure script executions, adding user authentication and access control to script execution operations so that only users who created a script execution operation can access or view their operations in listings.
Key Changes
- Added user SID (Security Identifier) parameter to all script execution operation methods and events
- Introduced a new feature flag
EnableSecureScriptExecutionsto control this functionality - Modified script execution metadata tables to include access control lists when secure mode is enabled
Reviewed Changes
Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| ydb/tests/tools/kqprun/src/ydb_setup.h | Added userSID parameters to script execution method signatures |
| ydb/tests/tools/kqprun/src/ydb_setup.cpp | Implemented userSID parameter passing to internal methods |
| ydb/tests/tools/kqprun/src/kqp_runner.h | Updated method signatures to accept userSID |
| ydb/tests/tools/kqprun/src/kqp_runner.cpp | Added userSID parameter handling in script execution methods |
| ydb/tests/tools/kqprun/kqprun.cpp | Added userSID extraction helper and usage |
| ydb/library/table_creator/table_creator.h | Added newTableAcl parameter for table creation |
| ydb/library/table_creator/table_creator.cpp | Implemented ACL setting logic during table creation |
| ydb/core/viewer/viewer_query.h | Added userSID extraction helper and parameter passing |
| ydb/core/testlib/basics/feature_flags.h | Added EnableSecureScriptExecutions feature flag setter |
| ydb/core/protos/feature_flags.proto | Added EnableSecureScriptExecutions feature flag definition |
| ydb/core/kqp/ut/federated_query/s3/kqp_federated_query_ut.cpp | Added comprehensive test for secure script executions |
| ydb/core/kqp/ut/federated_query/common/common.h | Updated WaitScriptExecutionOperation to accept userSID |
| ydb/core/kqp/ut/federated_query/common/common.cpp | Implemented userSID parameter in operation waiting |
| ydb/core/kqp/proxy_service/kqp_script_executions_ut.cpp | Added test for secure script execution table creation |
| ydb/core/kqp/proxy_service/kqp_script_executions.h | Updated method signatures to include userSID parameters |
| ydb/core/kqp/proxy_service/kqp_script_executions.cpp | Implemented user access control checks and secure table creation |
| ydb/core/kqp/proxy_service/kqp_proxy_service.cpp | Updated table creator call with feature flags |
| ydb/core/kqp/gateway/behaviour/streaming_query/queries.cpp | Added userSID parameter for system operations |
| ydb/core/kqp/common/events/script_executions.h | Added userSID fields to script execution events |
| ydb/core/grpc_services/rpc_list_operations.cpp | Added userSID extraction for operation listing |
| ydb/core/grpc_services/rpc_get_operation.cpp | Added userSID extraction for operation retrieval |
| ydb/core/grpc_services/rpc_forget_operation.cpp | Added userSID extraction for operation forgetting |
| ydb/core/grpc_services/rpc_common/rpc_common.h | Added GetUserSID helper function |
| ydb/core/grpc_services/rpc_cancel_operation.cpp | Added userSID extraction for operation cancellation |
| ydb/core/grpc_services/query/rpc_fetch_script_results.cpp | Added userSID extraction for result fetching |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
|
⚪
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
GrigoriyPA
added
the
rebase-and-check
github-actions
bot
removed
the
rebase-and-check
|
⚪
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
|
⚪ ⚪ Ya make output | Test bloat | Test bloat
⚪ Ya make output | Test bloat | Test bloat | Test bloat
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
|
⚪ ⚪ Ya make output | Test bloat | Test bloat
🟢
*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation |
2 participants
Changelog entry
Supported secure script executions (only user who created script execution operation can access it and see in list result)
Changelog category
Description for reviewers