From 0b6ae2673ec6a1f0af0bfa7c57a54f72add5a27e Mon Sep 17 00:00:00 2001 From: Sam Tunnicliffe Date: Wed, 5 Feb 2025 12:29:00 +0000 Subject: [PATCH] Minimize expensive reads during authz flow in 3.0/3.11 Patch by Sam Tunnicliffe; reviewed by Francisco Guerrero for CASSANDRA-20293 --- CHANGES.txt | 1 + src/java/org/apache/cassandra/service/ClientState.java | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index 38d003acf6..1ae082009c 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,4 +1,5 @@ 3.0.32 +* Minimise expensive reads during authz flow in 3.0/3.11 (CASSANDRA-20293) 3.0.31 diff --git a/src/java/org/apache/cassandra/service/ClientState.java b/src/java/org/apache/cassandra/service/ClientState.java index 8ab6887c5b..9fefb7c141 100644 --- a/src/java/org/apache/cassandra/service/ClientState.java +++ b/src/java/org/apache/cassandra/service/ClientState.java @@ -364,9 +364,9 @@ public class ClientState if (((FunctionResource)resource).getKeyspace().equals(SystemKeyspace.NAME)) return; - if (resource instanceof DataResource && !(user.isSuper() || user.isSystem())) + if (resource instanceof DataResource) { - DataResource dataResource = (DataResource)resource; + DataResource dataResource = (DataResource) resource; if (!dataResource.isRootLevel()) { String keyspace = dataResource.getKeyspace(); @@ -376,7 +376,8 @@ public class ClientState // see the Permission enum for details. if (Schema.isSystemKeyspace(keyspace)) { - ensurePermissionOnResourceChain(perm, Resources.chain(dataResource, IResource::hasParent)); + if (!(user.isSystem() || user.isSuper())) + ensurePermissionOnResourceChain(perm, Resources.chain(dataResource, IResource::hasParent)); return; } }