xunliu commented on code in PR #7197: URL: https://github.com/apache/gravitino/pull/7197#discussion_r2101543897
########## server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java: ########## @@ -0,0 +1,159 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * http://www.apache.org/licenses/LICENSE-2.0 + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.authorization.jcasbin; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.core.type.TypeReference; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.google.common.base.Preconditions; +import java.io.IOException; +import java.io.InputStream; +import java.nio.charset.StandardCharsets; +import java.security.Principal; +import java.util.List; +import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; +import org.apache.commons.io.IOUtils; +import org.apache.gravitino.MetadataObject; +import org.apache.gravitino.auth.AuthConstants; +import org.apache.gravitino.authorization.Privilege; +import org.apache.gravitino.server.authorization.GravitinoAuthorizer; +import org.apache.gravitino.server.authorization.MetadataIdConverter; +import org.apache.gravitino.server.web.ObjectMapperProvider; +import org.apache.gravitino.storage.relational.po.RolePO; +import org.apache.gravitino.storage.relational.po.SecurableObjectPO; +import org.apache.gravitino.storage.relational.service.MetalakeMetaService; +import org.apache.gravitino.storage.relational.service.RoleMetaService; +import org.apache.gravitino.storage.relational.service.UserMetaService; +import org.casbin.jcasbin.main.Enforcer; +import org.casbin.jcasbin.model.Model; + +/** The Jcasbin implementation of GravitinoAuthorizer. */ +public class JcasbinAuthorizer implements GravitinoAuthorizer { + + /** Jcasbin enforcer is used for metadata authorize */ + private Enforcer enforcer; + + /** + * loadedRoles is used to cache roles that have loaded permissions. When the permissions of a role + * are updated, they should be removed from it + */ + private Set<Long> loadedRoles = ConcurrentHashMap.newKeySet(); + + @Override + public void initialize() { + try (InputStream modelStream = + JcasbinAuthorizer.class.getResourceAsStream("/jcasbin_model.conf")) { + Preconditions.checkNotNull(modelStream, "Jcasbin model file can not found."); + String modelString = IOUtils.toString(modelStream, StandardCharsets.UTF_8); Review Comment: Maybe `modelData` is better than `modelString`? ########## server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java: ########## @@ -0,0 +1,159 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * http://www.apache.org/licenses/LICENSE-2.0 + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.authorization.jcasbin; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.core.type.TypeReference; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.google.common.base.Preconditions; +import java.io.IOException; +import java.io.InputStream; +import java.nio.charset.StandardCharsets; +import java.security.Principal; +import java.util.List; +import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; +import org.apache.commons.io.IOUtils; +import org.apache.gravitino.MetadataObject; +import org.apache.gravitino.auth.AuthConstants; +import org.apache.gravitino.authorization.Privilege; +import org.apache.gravitino.server.authorization.GravitinoAuthorizer; +import org.apache.gravitino.server.authorization.MetadataIdConverter; +import org.apache.gravitino.server.web.ObjectMapperProvider; +import org.apache.gravitino.storage.relational.po.RolePO; +import org.apache.gravitino.storage.relational.po.SecurableObjectPO; +import org.apache.gravitino.storage.relational.service.MetalakeMetaService; +import org.apache.gravitino.storage.relational.service.RoleMetaService; +import org.apache.gravitino.storage.relational.service.UserMetaService; +import org.casbin.jcasbin.main.Enforcer; +import org.casbin.jcasbin.model.Model; + +/** The Jcasbin implementation of GravitinoAuthorizer. */ +public class JcasbinAuthorizer implements GravitinoAuthorizer { + + /** Jcasbin enforcer is used for metadata authorize */ + private Enforcer enforcer; + + /** + * loadedRoles is used to cache roles that have loaded permissions. When the permissions of a role + * are updated, they should be removed from it + */ + private Set<Long> loadedRoles = ConcurrentHashMap.newKeySet(); + + @Override + public void initialize() { + try (InputStream modelStream = + JcasbinAuthorizer.class.getResourceAsStream("/jcasbin_model.conf")) { + Preconditions.checkNotNull(modelStream, "Jcasbin model file can not found."); + String modelString = IOUtils.toString(modelStream, StandardCharsets.UTF_8); + Model model = new Model(); + model.loadModelFromText(modelString); + enforcer = new Enforcer(model, new IgnoreAdapter()); + } catch (IOException e) { + throw new RuntimeException(e); + } + } + + @Override + public boolean authorize( + Principal principal, + String metalake, + MetadataObject metadataObject, + Privilege.Name privilege) { + return authorizeInternal(principal, metalake, metadataObject, privilege.name()); + } + + @Override + public boolean isOwner(Principal principal, String metalake, MetadataObject metadataObject) { + return authorizeInternal(principal, metalake, metadataObject, AuthConstants.OWNER); + } + + @Override + public void handleRolePrivilegeChange(Long roleId) { + loadedRoles.remove(roleId); + enforcer.deleteRole(String.valueOf(roleId)); + } + + @Override + public void close() throws IOException {} + + private boolean authorizeInternal( + Principal principal, String metalake, MetadataObject metadataObject, String privilege) { + String username = principal.getName(); + Long metalakeId = MetalakeMetaService.getInstance().getMetalakeIdByName(metalake); + Long userId = UserMetaService.getInstance().getUserIdByMetalakeIdAndName(metalakeId, username); + // When Jcasbin authentication fails, load the permissions from the db + return authorizeByJcasbin(userId, metadataObject, privilege) + || loadPrivilegeAndAuthorize(userId, metadataObject, privilege); + } + + private boolean authorizeByJcasbin(long userId, MetadataObject metadataObject, String privilege) { Review Comment: Maybe we need to use `Long` type for userId? and other functions `long` type. ########## server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/IgnoreAdapter.java: ########## @@ -0,0 +1,54 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * http://www.apache.org/licenses/LICENSE-2.0 + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.gravitino.server.authorization.jcasbin; + +import java.util.List; +import org.casbin.jcasbin.model.Model; +import org.casbin.jcasbin.persist.Adapter; + +/** + * The {@link Adapter} in Jcasbin is used to load the policy from the Adpater when initializing the + * {@link org.casbin.jcasbin.main.Enforcer} , and to persist the policy when the method of executing + * the Enforcer changes the policy + * + * <p>GravitinoAdapter will not perform any actions because there is no need to persist Privilege. + * All Privileges will be temporarily loaded into the Jcasbin cache when a user requests them. + */ +public class IgnoreAdapter implements Adapter { + + /** Gravitino does not require an initialization strategy when an Enforcer is instantiated */ + @Override + public void loadPolicy(Model model) {} + + /** Gravitino does not need persistent Policy when modifying the permission policy */ + @Override + public void savePolicy(Model model) {} + + /** Gravitino does not need persistent Policy when modifying the permission policy */ + @Override + public void addPolicy(String sec, String ptype, List<String> rule) {} + + /** Gravitino does not need persistent Policy when modifying the permission policy */ + @Override + public void removePolicy(String sec, String ptype, List<String> rule) {} + + /** Gravitino does not need persistent Policy when modifying the permission policy */ + @Override + public void removeFilteredPolicy( + String sec, String ptype, int fieldIndex, String... fieldValues) {} Review Comment: Please give a better name for `sec`, `ptype`, `fieldIndex`, and `fieldValues`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
