@@ -611,27 +611,20 @@ namespace NYdb::NTopic::NTests {
611
611
}
612
612
613
613
Y_UNIT_TEST (DirectWriteWithoutDescribeResourcesPermission) {
614
- // It should be possible to use DirectWrite option with UpdateRow permission only.
615
- // In this test we don't grant DescribeSchema permission and check that direct write still works.
616
-
617
- auto existingTopic = GetTestParam (" existing" , " yes" ) == " yes" ;
618
- auto allowUpdateRow = GetTestParam (" update" , " allow" ) == " allow" ;
619
- auto allowDescribe = GetTestParam (" describe" ) == " allow" ;
620
- auto authToken = GetTestParam (" token" , " x-user-x@builtin" );
614
+ // The DirectWrite option makes the write session send a DescribePartitionRequest to locate the partition's node.
615
+ // Previously, it required DescribeSchema (DescribeResources) permission. However, this permission is too broad
616
+ // to be granted to anyone who needs the DirectWrite option. The DescribePartitionRequest should work when either
617
+ // UpdateRow (WriteTopic) or DescribeSchema permission is granted.
618
+ //
619
+ // In this test, we don't grant DescribeSchema permission and check that direct write works anyway.
621
620
622
621
auto setup = CreateSetup (TEST_CASE_NAME);
623
- setup-> GetServer (). EnableLogs ({NKikimrServices::TX_PROXY_SCHEME_CACHE}, NActors::NLog::PRI_TRACE) ;
622
+ auto authToken = " x-user-x@builtin " ;
624
623
625
624
{
626
- // Add UpdateRow permission.
625
+ // Allow UpdateRow only, no DescribeSchema permission.
627
626
NACLib::TDiffACL acl;
628
- if (allowUpdateRow) {
629
- acl.AddAccess (NACLib::EAccessType::Allow, NACLib::UpdateRow, authToken);
630
- }
631
- // DescribePartitionRequest should work without DescribeSchema permission.
632
- if (allowDescribe) {
633
- acl.AddAccess (NACLib::EAccessType::Allow, NACLib::DescribeSchema, authToken);
634
- }
627
+ acl.AddAccess (NACLib::EAccessType::Allow, NACLib::UpdateRow, authToken);
635
628
setup->GetServer ().AnnoyingClient ->ModifyACL (" /Root" , TEST_TOPIC, acl.SerializeAsString ());
636
629
}
637
630
@@ -642,21 +635,29 @@ namespace NYdb::NTopic::NTests {
642
635
.SetLog (CreateCompositeLogBackend ({new TStreamLogBackend (&Cerr), tracingBackend}))
643
636
.SetAuthToken (authToken);
644
637
TDriver driver (driverConfig);
645
-
646
- auto clientSettings = TTopicClientSettings ()
647
- .Database (" /Root" );
648
-
649
- TTopicClient client (driver, clientSettings);
638
+ TTopicClient client (driver);
650
639
651
640
auto sessionSettings = TWriteSessionSettings ()
652
- .Path (existingTopic ? TEST_TOPIC : " non-existent " )
641
+ .Path (TEST_TOPIC)
653
642
.ProducerId (TEST_MESSAGE_GROUP_ID)
654
643
.MessageGroupId (TEST_MESSAGE_GROUP_ID)
655
644
.DirectWriteToPartition (true );
656
645
657
646
auto writeSession = client.CreateSimpleBlockingWriteSession (sessionSettings);
658
647
UNIT_ASSERT (writeSession->Write (" message" ));
659
648
writeSession->Close ();
649
+
650
+ TExpectedTrace expected{
651
+ " InitRequest" ,
652
+ " InitResponse partition_id=0" ,
653
+ " DescribePartitionRequest partition_id=0" ,
654
+ " DescribePartitionResponse partition_id=0 pl_generation=1" ,
655
+ " PreferredPartitionLocation Generation=1" ,
656
+ " InitRequest pwg_partition_id=0 pwg_generation=1" ,
657
+ " InitResponse partition_id=0" ,
658
+ };
659
+ auto const events = tracingBackend->GetEvents ();
660
+ UNIT_ASSERT (expected.Matches (events));
660
661
}
661
662
662
663
Y_UNIT_TEST (WithoutPartitionWithSplit) {
0 commit comments