[hotfix] Add missing authentication for CoordinatorService RPC calls

[LiebingYu]

Purpose

Linked issue: close #xxx

Brief change log

Add missing authentication for RPC calls in CoordinatorService. Mainly for lake related RPC calls and simplify the rebalance authentication.

Tests

API and Format

Documentation

[LiebingYu]

Hi @luoyuxia @swuferhong. Could you help review this?

[Copilot]

Pull request overview

This hotfix adds missing authentication checks for CoordinatorService RPC calls, specifically targeting lake-related operations and internal server-to-server communications. The PR introduces two new helper methods to standardize authorization patterns across the codebase.

Changes:

• Added authorizeInternal() method to restrict certain RPC calls to internal connections only (server-to-server communication)
• Added authorizeCluster() method to simplify cluster-level authorization checks
• Applied authentication to previously unprotected lake-related RPC endpoints (prepareLakeTableSnapshot, commitLakeTableSnapshot, lakeTieringHeartbeat)
• Applied authentication to internal RPC endpoints (adjustIsr, commitKvSnapshot, commitRemoteLogManifest, controlledShutdown)
• Simplified existing authorization code by replacing inline checks with helper method calls

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
fluss-server/src/main/java/org/apache/fluss/server/RpcServiceBase.java	Added two new authorization helper methods: authorizeCluster() for cluster-level operations and authorizeInternal() for internal-only requests
fluss-server/src/main/java/org/apache/fluss/server/coordinator/CoordinatorService.java	Applied authentication to 7 RPC methods: 3 internal operations, 3 lake operations, and simplified 4 existing authorization checks
fluss-client/src/test/java/org/apache/fluss/client/security/acl/FlussAuthorizationITCase.java	Added comprehensive test coverage for all newly protected RPC endpoints, verifying both rejection of unauthorized requests and successful authorized access

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.