[Caideyipi]

Pipe metadata privilege filtering can retain an ancestor path after an unmatched authorization prefix and drop valid TTL intersections. Database-compatible TTL plans can also lose their descendant scope during filtering.

• Intersect each requested path directly with the authorized full and prefix paths. Transfer every authorized TTL intersection as a separate plan, deduplicate overlapping authorizations, and retain the requested-scope containment check. Strict privilege mode still rejects incomplete authorization.
• Treat a database-compatible TTL plan (isDataBase=true) as its descendant scope when applying both the Pipe pattern and privilege filters. Preserve the database flag when the scope is unchanged; clear it when narrowing to a device path or prefix. Ordinary exact device TTL paths keep their exact semantics. Set and unset TTL values are preserved.
• Supply all split events before reading the next source event and bind the original progress only to the final fragment. Preserve snapshot plans across privilege-check retries. SchemaRegion keeps its existing filtering behavior through the shared return-type adaptation.

Validation:

• Rebuilt the 29-project ConfigNode dependency closure, including Node Commons and DataNode, from clean source for English tests and independently for Chinese test compilation, with build caches disabled.
• Passed 61 distinct focused unit tests across ConfigNode visitors and the non-data-region source. All newly added tests ran locally.
• An initial run found three TTL-containment failures; after restoring the per-path containment guard, all 13 affected privilege visitor tests passed on a clean ConfigNode rebuild. The other 48 focused tests had already passed.
• Spotless formatting passed.
• Repository-wide English and Chinese reactor attempts were stopped during dependency preparation; full-repository validation remains incomplete.

[codecov]

Codecov Report

❌ Patch coverage is 70.58824% with 40 lines in your changes missing coverage. Please review.
✅ Project coverage is 48.80%. Comparing base (36c35f6) to head (2e5461c).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
...pe/source/PipeConfigTreePrivilegeParseVisitor.java	56.79%	35 Missing ⚠️
...e/manager/pipe/source/IoTDBConfigRegionSource.java	87.50%	2 Missing ⚠️
...e/source/schemaregion/IoTDBSchemaRegionSource.java	0.00%	2 Missing ⚠️
...pipe/source/PipeConfigTreePatternParseVisitor.java	90.90%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##             master   #19182   +/-   ##
=========================================
  Coverage     48.80%   48.80%           
  Complexity      674      674           
=========================================
  Files          5574     5574           
  Lines        412836   412893   +57     
  Branches      54448    54457    +9     
=========================================
+ Hits         201480   201511   +31     
- Misses       211356   211382   +26     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Caideyipi]

Follow-up review summary

• Reviewed starting commit: ce8a21825256a9181b01df1115cf6a8db0d3538d.
• Final local commit: 10bb7db5b595fba65678bfcfd7b35afeff11ef5f.
• Confirmed remote source branch and PR head: both 10bb7db5b595fba65678bfcfd7b35afeff11ef5f.

Fixed the two behavioral issues raised in this follow-up: all authorized TTL intersections now transfer as separate plans, and database-compatible TTL paths retain their descendant semantics through both Pipe-pattern and privilege filtering. Narrowed plans clear the database flag; ordinary exact device TTL paths remain exact. Split events preserve source order and report progress only on the final fragment, including snapshot parsing and privilege-check retries.

Validation: 61 distinct focused unit tests passed, and all newly added tests ran locally. Both locales rebuilt the required 29-project dependency closure from clean source; Chinese test compilation passed. An initial run exposed three containment failures; after restoring the requested-scope guard for every TTL intersection, a clean ConfigNode rebuild and all 13 affected privilege tests passed. The other 48 focused tests had already passed. Spotless formatting passed.

Repository-wide English and Chinese reactor validation remains incomplete: those attempts were stopped during dependency preparation. Remote CI checks were queued or running when inspected; they were not awaited.

This round made behavioral fixes, so the PR remains draft for a fresh independent review of the complete current diff.

[Caideyipi]

Independent re-review passed; no fixes were needed.

• Reviewed commit and final local commit: 2e5461cc8de313be5bab36080fcde17e5e04c5c8.
• Confirmed remote source branch and PR head: both 2e5461cc8de313be5bab36080fcde17e5e04c5c8.
• Rebased the two PR commits onto origin/master at 36c35f63b6506910b365d6e487cd8ca2700bc5d6 without conflicts. Both commits are patch-equivalent to the original series (ce8a21825256a9181b01df1115cf6a8db0d3538d, 10bb7db5b595fba65678bfcfd7b35afeff11ef5f).

Reviewed the complete current diff and relevant context, with particular attention to TTL authorization intersections, database TTL compatibility, split-event ordering and progress, snapshot parsing, privilege retries, and the shared source API's consumers. No actionable issues were found.

Validation: a clean 29-project dependency reactor build passed with build caching disabled (499 goals executed). All 37 tests in IoTDBNonDataRegionSourceTest, PipeConfigTreePrivilegeParseVisitorTest, and PipeConfigTreePatternParseVisitorTest passed with no failures, errors, or skips. The build's Spotless and Checkstyle checks passed.

Repository-wide builds, the Chinese locale, and integration tests were not run in this session. Remote CI for the rebased head is separate and has not been awaited. There are no incomplete branch-update steps.

[sonarqubecloud]

Quality Gate passed

Issues
25 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.8% Duplication on New Code

See analysis details on SonarQube Cloud