TIKA-4764 and TIKA-4763 merge conflicts (#2910)

Author: tballison

docs/modules/ROOT/pages/using-tika/grpc/index.adoc

@@ -67,13 +67,16 @@ the server's defaults for that request. Because this can reconfigure any pipelin
 component (fetcher, parser, timeouts, ...), it is off by default. When `false`, a
 request carrying either field is rejected with `PERMISSION_DENIED`.
 
-|`allowComponentModifications`
-|When `true`, callers may add, modify, or delete fetchers and pipes iterators at
-runtime (`SaveFetcher`, `DeleteFetcher`, `SavePipesIterator`,
-`DeletePipesIterator`). Because this changes what the server can reach for all
-subsequent requests (for example, adding a fetcher that escapes a configured base
-path), it is off by default. When `false`, those RPCs are rejected with
-`PERMISSION_DENIED`.
+|`allowComponentManagement`
+|When `true`, callers may manage fetchers and pipes iterators at runtime: add,
+modify, or delete them (`SaveFetcher`, `DeleteFetcher`, `SavePipesIterator`,
+`DeletePipesIterator`), and read their stored configuration back (`GetFetcher`,
+`ListFetchers`, `GetPipesIterator`). It is off by default for two reasons:
+mutations change what the server can reach for all subsequent requests (for
+example, adding a fetcher that escapes a configured base path), and the stored
+configs returned by the read RPCs may contain secrets (passwords, access keys,
+tokens). When `false`, the mutating RPCs are rejected with `PERMISSION_DENIED`,
+and the read RPCs return only component identity (id and class), never the config.
 |===
 
 Enable these only for trusted callers over a secured channel:
@@ -83,7 +86,7 @@ Enable these only for trusted callers over a secured channel:
 {
   "grpc": {
     "allowPerRequestConfig": true,
-    "allowComponentModifications": true
+    "allowComponentManagement": true
   }
 }
 ----
@@ -149,8 +152,9 @@ automatically. Two distinct controls are involved, and both matter:
 Mesh mTLS authenticates *who opened the connection*; it does not authorize *what
 that caller may do*, so an authenticated-but-untrusted pod can still invoke
 whatever RPC surface is enabled — at minimum `FetchAndParse` against your
-configured fetchers, and the runtime-mutation RPCs too if you have set
-`allowComponentModifications`. Restricting reachability with a `NetworkPolicy` is
+configured fetchers, and the runtime component-management RPCs too (including the
+config reads that can expose stored secrets) if you have set
+`allowComponentManagement`. Restricting reachability with a `NetworkPolicy` is
 therefore required, not optional — running in Kubernetes without one leaves
 tika-grpc reachable by every pod in the cluster.
 

tika-e2e-tests/pom.xml

@@ -123,6 +123,15 @@
                     <version>3.15.0</version>
                     <configuration>
                         <release>17</release>
+                        <!-- maven-compiler-plugin 3.15 no longer auto-discovers classpath
+                             annotation processors; declare Lombok explicitly so @Slf4j runs. -->
+                        <annotationProcessorPaths>
+                            <path>
+                                <groupId>org.projectlombok</groupId>
+                                <artifactId>lombok</artifactId>
+                                <version>${lombok.version}</version>
+                            </path>
+                        </annotationProcessorPaths>
                     </configuration>
                 </plugin>
                 <plugin>

tika-e2e-tests/tika-grpc/src/test/java/org/apache/tika/pipes/filesystem/FileSystemFetcherTest.java

@@ -64,7 +64,7 @@ void testFileSystemFetcher() throws Exception {
         SaveFetcherReply saveReply = blockingStub.saveFetcher(SaveFetcherRequest
                 .newBuilder()
                 .setFetcherId(fetcherId)
-                .setFetcherClass("org.apache.tika.pipes.fetcher.fs.FileSystemFetcher")
+                .setFetcherType("file-system-fetcher")
                 .setFetcherConfigJson(configJson)
                 .build());
 

tika-e2e-tests/tika-grpc/src/test/java/org/apache/tika/pipes/filesystem/HandlerTypeTest.java

@@ -297,7 +297,7 @@ void testParseContextJson() throws Exception {
 
             SaveFetcherReply saveReply = blockingStub.saveFetcher(SaveFetcherRequest.newBuilder()
                     .setFetcherId(fetcherId)
-                    .setFetcherClass("org.apache.tika.pipes.fetcher.fs.FileSystemFetcher")
+                    .setFetcherType("file-system-fetcher")
                     .setFetcherConfigJson(ExternalTestBase.OBJECT_MAPPER.writeValueAsString(config))
                     .build());
             log.info("Fetcher created: {}", saveReply.getFetcherId());

tika-e2e-tests/tika-grpc/src/test/java/org/apache/tika/pipes/ignite/IgniteConfigStoreTest.java

@@ -409,7 +409,7 @@ void testIgniteConfigStore() throws Exception {
             SaveFetcherReply saveReply = blockingStub.saveFetcher(SaveFetcherRequest
                     .newBuilder()
                     .setFetcherId(fetcherId)
-                    .setFetcherClass("org.apache.tika.pipes.fetcher.fs.FileSystemFetcher")
+                    .setFetcherType("file-system-fetcher")
                     .setFetcherConfigJson(configJson)
                     .build());
 

tika-grpc/README.md

@@ -11,10 +11,12 @@ This server will manage a pool of Tika Pipes clients.
     * Delete
 * Fetch + Parse a given Fetch Item
 
-> **Security note:** runtime fetcher/iterator mutations (Create/Update/Delete) and
-> per-request parse configuration are **disabled by default**. Enable them
-> explicitly via `allowComponentModifications` / `allowPerRequestConfig` in the
-> `grpc` section of your tika-config. See the
+> **Security note:** runtime fetcher/iterator management — mutations (Create/Update/Delete)
+> and reading stored configs back (Read), which may contain secrets — plus per-request parse
+> configuration are **disabled by default**. Enable them explicitly via
+> `allowComponentManagement` / `allowPerRequestConfig` in the `grpc` section of your
+> tika-config; with management off, the Read RPCs return only component id and class, never
+> the config. See the
 > [Tika gRPC security configuration docs](../docs/modules/ROOT/pages/using-tika/grpc/index.adoc).
 
 ## Distribution and Maven Artifact

tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcConfig.java

@@ -32,15 +32,15 @@
  * <ul>
  *   <li>{@link #isAllowPerRequestConfig()} lets a client reconfigure any
  *   pipeline component for a single request.</li>
- *   <li>{@link #isAllowComponentModifications()} lets a client change which
- *   fetchers and iterators the server has at all.</li>
+ *   <li>{@link #isAllowComponentManagement()} lets a client change which
+ *   fetchers and iterators the server has, and read their stored configs.</li>
  * </ul>
  */
 public class TikaGrpcConfig {
 
     private boolean allowPerRequestConfig = false;
 
-    private boolean allowComponentModifications = false;
+    private boolean allowComponentManagement = false;
 
     /**
      * Loads {@link TikaGrpcConfig} from the {@code "grpc"} section of the JSON
@@ -81,22 +81,26 @@ public void setAllowPerRequestConfig(boolean allowPerRequestConfig) {
     }
 
     /**
-     * Whether clients may add, modify, or delete fetchers and pipes iterators at
-     * runtime (the SaveFetcher, DeleteFetcher, SavePipesIterator and
-     * DeletePipesIterator RPCs).
+     * Whether clients may manage fetchers and pipes iterators at runtime: add,
+     * modify, or delete them (the SaveFetcher, DeleteFetcher, SavePipesIterator
+     * and DeletePipesIterator RPCs), and read their stored configuration back
+     * (the GetFetcher, ListFetchers and GetPipesIterator RPCs).
      * <p>
-     * This is dangerous because it changes what the server can reach for all
-     * subsequent requests and clients (for example, adding a fetcher that
-     * escapes a configured base path or points at an internal host). Defaults
-     * to {@code false}; when {@code false}, those RPCs are rejected.
+     * This is dangerous on two counts. Writes change what the server can reach
+     * for all subsequent requests and clients (for example, adding a fetcher
+     * that escapes a configured base path or points at an internal host). Reads
+     * return stored component configs verbatim, which may include secrets
+     * (passwords, access keys, tokens). Defaults to {@code false}; when
+     * {@code false}, the mutating RPCs are rejected and the read RPCs return
+     * only component identity (id and class), never the config.
      *
-     * @return true if runtime component modifications are permitted
+     * @return true if runtime component management is permitted
      */
-    public boolean isAllowComponentModifications() {
-        return allowComponentModifications;
+    public boolean isAllowComponentManagement() {
+        return allowComponentManagement;
     }
 
-    public void setAllowComponentModifications(boolean allowComponentModifications) {
-        this.allowComponentModifications = allowComponentModifications;
+    public void setAllowComponentManagement(boolean allowComponentManagement) {
+        this.allowComponentManagement = allowComponentManagement;
     }
 }