This is an automated email from the ASF dual-hosted git repository.
SbloodyS pushed a commit to branch dev
in repository https://gitbox.apache.org/repos/asf/dolphinscheduler.git
The following commit(s) were added to refs/heads/dev by this push:
new 17ce56905b [Improvement-17933][api] Restrict audit logs for non-admin
users (#18368)
17ce56905b is described below
commit 17ce56905b3f7760636dc4b7f1a719c9abb137c7
Author: Yanjun Qiu <[email protected]>
AuthorDate: Wed Jul 1 10:04:33 2026 +0800
[Improvement-17933][api] Restrict audit logs for non-admin users (#18368)
---
.../api/controller/AuditLogController.java | 1 +
.../dolphinscheduler/api/service/AuditService.java | 5 ++-
.../api/service/impl/AuditServiceImpl.java | 9 +++--
.../api/service/AuditServiceTest.java | 38 +++++++++++++++++++++-
.../dao/mapper/AuditLogMapper.java | 1 +
.../dolphinscheduler/dao/mapper/AuditLogMapper.xml | 3 ++
.../dao/mapper/AuditLogMapperTest.java | 10 +++++-
7 files changed, 62 insertions(+), 5 deletions(-)
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/AuditLogController.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/AuditLogController.java
index afa418ebb6..a090453e2a 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/AuditLogController.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/AuditLogController.java
@@ -93,6 +93,7 @@ public class AuditLogController extends BaseController {
@RequestParam(value = "modelName", required = false) String modelName) {
checkPageParams(pageNo, pageSize);
PageInfo<AuditDto> auditDtoPageInfo = auditService.queryLogListPaging(
+ loginUser,
modelTypes,
operationTypes,
startDate,
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/AuditService.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/AuditService.java
index 8fb99eaf73..8f929fb8ee 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/AuditService.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/AuditService.java
@@ -20,6 +20,7 @@ package org.apache.dolphinscheduler.api.service;
import org.apache.dolphinscheduler.api.dto.AuditDto;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.dao.entity.AuditLog;
+import org.apache.dolphinscheduler.dao.entity.User;
/**
* audit information service
@@ -36,6 +37,7 @@ public interface AuditService {
/**
* query audit log list
*
+ * @param loginUser login user
* @param modelTypes model types
* @param modelName model name
* @param operationTypes operation types
@@ -46,7 +48,8 @@ public interface AuditService {
* @param pageSize page size
* @return audit log string
*/
- PageInfo<AuditDto> queryLogListPaging(String modelTypes,
+ PageInfo<AuditDto> queryLogListPaging(User loginUser,
+ String modelTypes,
String operationTypes, String
startTime,
String endTime, String userName,
String modelName,
Integer pageNo, Integer pageSize);
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AuditServiceImpl.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AuditServiceImpl.java
index c51f2e2de6..e9abd50b48 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AuditServiceImpl.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/AuditServiceImpl.java
@@ -22,7 +22,9 @@ import org.apache.dolphinscheduler.api.service.AuditService;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.common.enums.AuditModelType;
import org.apache.dolphinscheduler.common.enums.AuditOperationType;
+import org.apache.dolphinscheduler.common.enums.UserType;
import org.apache.dolphinscheduler.dao.entity.AuditLog;
+import org.apache.dolphinscheduler.dao.entity.User;
import org.apache.dolphinscheduler.dao.mapper.AuditLogMapper;
import java.util.ArrayList;
@@ -59,6 +61,7 @@ public class AuditServiceImpl extends BaseServiceImpl
implements AuditService {
/**
* query audit log paging
*
+ * @param loginUser login user
* @param modelTypes object types
* @param operationTypes operation types
* @param startDate start time
@@ -70,7 +73,8 @@ public class AuditServiceImpl extends BaseServiceImpl
implements AuditService {
* @return audit log string data
*/
@Override
- public PageInfo<AuditDto> queryLogListPaging(String modelTypes,
+ public PageInfo<AuditDto> queryLogListPaging(User loginUser,
+ String modelTypes,
String operationTypes,
String startDate,
String endDate,
@@ -83,10 +87,11 @@ public class AuditServiceImpl extends BaseServiceImpl
implements AuditService {
Date start = checkAndParseDateParameters(startDate);
Date end = checkAndParseDateParameters(endDate);
+ Integer userId = loginUser.getUserType() == UserType.ADMIN_USER ? null
: loginUser.getId();
IPage<AuditLog> logIPage =
auditLogMapper.queryAuditLog(new Page<>(pageNo, pageSize),
objectTypeCodeList, operationTypeCodeList,
- userName, modelName, start, end);
+ userId, userName, modelName, start, end);
List<AuditDto> auditDtos =
logIPage.getRecords().stream().map(this::transformAuditLog).collect(Collectors.toList());
diff --git
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/AuditServiceTest.java
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/AuditServiceTest.java
index 463ebaf1aa..50e55f132f 100644
---
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/AuditServiceTest.java
+++
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/AuditServiceTest.java
@@ -18,13 +18,16 @@
package org.apache.dolphinscheduler.api.service;
import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import org.apache.dolphinscheduler.api.service.impl.AuditServiceImpl;
import org.apache.dolphinscheduler.common.enums.AuditModelType;
import org.apache.dolphinscheduler.common.enums.AuditOperationType;
+import org.apache.dolphinscheduler.common.enums.UserType;
import org.apache.dolphinscheduler.common.utils.DateUtils;
import org.apache.dolphinscheduler.dao.entity.AuditLog;
+import org.apache.dolphinscheduler.dao.entity.User;
import org.apache.dolphinscheduler.dao.mapper.AuditLogMapper;
import java.util.ArrayList;
@@ -59,11 +62,13 @@ public class AuditServiceTest {
IPage<AuditLog> page = new Page<>(1, 10);
page.setRecords(getLists());
page.setTotal(1L);
- when(auditLogMapper.queryAuditLog(Mockito.any(Page.class),
Mockito.any(), Mockito.any(), Mockito.eq(""),
+ when(auditLogMapper.queryAuditLog(Mockito.any(Page.class),
Mockito.any(), Mockito.any(), Mockito.isNull(),
+ Mockito.eq(""),
Mockito.eq(""),
eq(start), eq(end))).thenReturn(page);
Assertions.assertDoesNotThrow(() -> {
auditService.queryLogListPaging(
+ getUser(1, "admin", UserType.ADMIN_USER),
"",
"",
"2020-11-01 00:00:00",
@@ -75,6 +80,29 @@ public class AuditServiceTest {
});
}
+ @Test
+ public void testQueryLogListPagingRestrictsGeneralUserToOwnAuditLogs() {
+ IPage<AuditLog> page = new Page<>(1, 10);
+ page.setRecords(getLists());
+ page.setTotal(1L);
+ when(auditLogMapper.queryAuditLog(Mockito.any(Page.class),
Mockito.any(), Mockito.any(), Mockito.eq(10),
+ Mockito.eq("otherUser"), Mockito.eq(""), Mockito.isNull(),
Mockito.isNull())).thenReturn(page);
+
+ auditService.queryLogListPaging(
+ getUser(10, "generalUser", UserType.GENERAL_USER),
+ "",
+ "",
+ null,
+ null,
+ "otherUser",
+ "",
+ 1,
+ 10);
+
+ verify(auditLogMapper).queryAuditLog(Mockito.any(Page.class),
Mockito.any(), Mockito.any(), Mockito.eq(10),
+ Mockito.eq("otherUser"), Mockito.eq(""), Mockito.isNull(),
Mockito.isNull());
+ }
+
private List<AuditLog> getLists() {
List<AuditLog> list = new ArrayList<>();
list.add(getAuditLog());
@@ -88,4 +116,12 @@ public class AuditServiceTest {
auditLog.setModelType(AuditModelType.PROJECT.getName());
return auditLog;
}
+
+ private User getUser(Integer id, String userName, UserType userType) {
+ User user = new User();
+ user.setId(id);
+ user.setUserName(userName);
+ user.setUserType(userType);
+ return user;
+ }
}
diff --git
a/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.java
b/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.java
index 3cc95a76d1..243313f75d 100644
---
a/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.java
+++
b/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.java
@@ -35,6 +35,7 @@ public interface AuditLogMapper extends BaseMapper<AuditLog> {
IPage<AuditLog> queryAuditLog(IPage<AuditLog> page,
@Param("modelTypeList") List<String>
modelTypeList,
@Param("operationTypeList") List<String>
operationTypeList,
+ @Param("userId") Integer userId,
@Param("userName") String userName,
@Param("modelName") String modelName,
@Param("startDate") Date startDate,
diff --git
a/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.xml
b/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.xml
index 63adb57c34..0c08bc467d 100644
---
a/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.xml
+++
b/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/AuditLogMapper.xml
@@ -50,6 +50,9 @@
#{operation_type}
</foreach>
</if>
+ <if test="userId != null">
+ and log.user_id = #{userId}
+ </if>
<if test="userName != null and userName != ''">
and u.user_name like concat ('%', #{userName}, '%')
</if>
diff --git
a/dolphinscheduler-dao/src/test/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapperTest.java
b/dolphinscheduler-dao/src/test/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapperTest.java
index 92418193b8..8bca8b1f34 100644
---
a/dolphinscheduler-dao/src/test/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapperTest.java
+++
b/dolphinscheduler-dao/src/test/java/org/apache/dolphinscheduler/dao/mapper/AuditLogMapperTest.java
@@ -80,7 +80,15 @@ public class AuditLogMapperTest extends BaseDaoTest {
List<String> operationTypeList =
Lists.newArrayList(AuditOperationType.CREATE.getName());
IPage<AuditLog> logIPage =
- logMapper.queryAuditLog(page, objectTypeList,
operationTypeList, "", "", null, null);
+ logMapper.queryAuditLog(page, objectTypeList,
operationTypeList, null, "", "", null, null);
Assertions.assertNotEquals(0, logIPage.getTotal());
+
+ IPage<AuditLog> userLogPage =
+ logMapper.queryAuditLog(new Page<>(1, 3), objectTypeList,
operationTypeList, 1, "", "", null, null);
+ Assertions.assertNotEquals(0, userLogPage.getTotal());
+
+ IPage<AuditLog> otherUserLogPage =
+ logMapper.queryAuditLog(new Page<>(1, 3), objectTypeList,
operationTypeList, 2, "", "", null, null);
+ Assertions.assertEquals(0, otherUserLogPage.getTotal());
}
}
