ruanwenjun opened a new pull request, #18718:
URL: https://github.com/apache/dolphinscheduler/pull/18718
## Was this PR generated or assisted by AI?
YES. The implementation, UI, schema upgrades, tests and documentation were
generated or assisted by AI.
## Purpose of the pull request
Implements DSIP-104: users receive explicit operation permissions within a
project, and shared resources are granted to projects. Project operations
require the relevant permission and resource grants.
Closes #17923.
```mermaid
flowchart LR
U[User] -->|Project operation permissions| P[Project]
R[Shared resources] -->|Resource-use grants| P
P --> C{Permission AND resource grant}
C --> A[Allow project operation]
```
## Brief change log
- Add separate user-project permission and project-resource authorization
tables, assignment APIs and project management UI. System administrators grant
resources; project member managers assign permissions within their project.
- Scope resource queries in SQL and enforce project permissions at
configuration, publication and manual execution/rerun entry points, including
nested subworkflows. Resolve actual instance projects and return non-sensitive
metadata from project resource selectors.
- Cover datasources, worker groups, tenants, queues, environments, alert
groups, Kubernetes namespaces and task groups. Resource files are deferred.
- Add MySQL/PostgreSQL 3.5.0 upgrade scripts and English/Chinese upgrade
notes. Legacy authorization tables and data are retained without migration or
authorization fallback; administrators must reassign project member permissions
and resource grants.
Resource grant revocation does not recheck existing running/queued
instances, scheduled triggers or automatic retries, and does not disable
existing schedules.
## Verify this pull request
Local validation:
- All 43 changed/new backend, DAO and upgrade test suites: **450 passed, 7
existing skips, 0 failures/errors**.
- Real MySQL 8 and PostgreSQL 16 upgrade/DAO tests verify empty new grant
tables, preserved legacy permissions and execution/schedule records, safe
repeated upgrades, exact resource-key matching and string round trips.
- UI production build (including TypeScript checks), ESLint and Prettier
checks passed.
- Diff whitespace checks passed. Browser E2E tests were not run.
## Pull Request Notice
[Pull Request
Notice](https://github.com/apache/dolphinscheduler/blob/dev/docs/docs/en/contribute/join/pull-request.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
