Validate segment upload destinations

[xiangfu0]

Summary

• Establish and canonicalize the final segment destination before controller storage or metadata handling.
• Authorize the exact destination table for every v1 upload variant and reject inconsistent request, header, or segment metadata table names.
• Preserve v2 request-table promotion behavior while binding database headers and batch uploads to their authorized destinations.
• Route Purge and Refresh minion TAR uploads through v2 so reused promoted segments retain supported destination override behavior.
• Return clear client errors for missing, blank, invalid, or mismatched table inputs.

Root cause

The upload handlers did not share a canonical destination-binding step across request inputs and segment metadata. In v1, authorization could therefore complete before the final table destination was established. No-op minion conversions could also reuse promoted segment metadata while targeting the stricter v1 route.

Impact

Upload and refresh authorization now targets the same table used by all subsequent controller operations, independently of the configured access-control implementation. Existing valid v2 promotion behavior remains supported.

Regression coverage

• Exact-table authorization with permissive cluster CREATE access
• Missing and mismatched request, header, and metadata destinations
• Valid upload and refresh operations with no pre-authorization deep-store or ZooKeeper mutation
• v2 promotion and batch database-header destination binding
• Purge and Refresh minion uploads that reuse existing segment artifacts

Validation

• FineGrainedAuthUtilsTest
• PinotSegmentUploadDownloadRestletResourceTest
• PinotSegmentUploadAuthorizationTest
• RefreshSegmentTaskGeneratorTest
• PurgeMinionClusterIntegrationTest
• RefreshSegmentMinionTest
• Spotless, Checkstyle, and license checks for all affected modules
• JDK 25 warning-enabled test compilation for all affected modules

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f5fee8e) to head (d4382fe).

Additional details and impacted files

@@              Coverage Diff               @@
##             master    #19231       +/-   ##
==============================================
+ Coverage     67.12%   100.00%   +32.87%     
+ Complexity     1424         6     -1418     
==============================================
  Files          3462         3     -3459     
  Lines        220677         6   -220671     
  Branches      35255         0    -35255     
==============================================
- Hits         148136         6   -148130     
+ Misses        60708         0    -60708     
+ Partials      11833         0    -11833     

Flag	Coverage Δ
integration	100.00% <ø> (ø)
integration1	100.00% <ø> (ø)
java-25	100.00% <ø> (+32.87%)	⬆️
lane-a	100.00% <ø> (ø)
lane-b	0.00% <ø> (ø)
temurin	100.00% <ø> (+32.87%)	⬆️
unittests	?
unittests1	?
unittests2	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Canonicalizes and authorizes segment upload destinations across controller endpoints.

Changes:

• Adds destination validation and exact-table authorization.
• Routes Purge and Refresh uploads through v2.
• Adds unit and integration regression coverage.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
RefreshSegmentTaskGeneratorTest.java	Tests v2 upload URL generation.
RefreshSegmentTaskGenerator.java	Uses the v2 segment endpoint.
PurgeTaskGenerator.java	Uses the v2 segment endpoint.
FineGrainedAuthUtilsTest.java	Tests invalid and missing table parameters.
FineGrainedAuthUtils.java	Returns clear client errors for invalid tables.
PinotSegmentUploadDownloadRestletResourceTest.java	Tests destination resolution and mismatches.
PinotSegmentUploadAuthorizationTest.java	Adds end-to-end authorization coverage.
PinotSegmentUploadDownloadRestletResource.java	Canonicalizes, validates, and authorizes destinations.
AuthenticationFilter.java	Validates table inputs before authorization.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.