yuqi1129 commented on code in PR #12288: URL: https://github.com/apache/gravitino/pull/12288#discussion_r3749571828
########## core/src/main/java/org/apache/gravitino/bulk/BulkManager.java: ########## @@ -0,0 +1,95 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.gravitino.bulk; + +import org.apache.gravitino.Config; +import org.apache.gravitino.Configs; +import org.apache.gravitino.dto.responses.BulkError; +import org.apache.gravitino.dto.responses.ErrorConstants; +import org.apache.gravitino.exceptions.AlreadyExistsException; +import org.apache.gravitino.exceptions.ForbiddenException; +import org.apache.gravitino.exceptions.NotFoundException; +import org.apache.gravitino.exceptions.NotInUseException; + +/** Manages best-effort bulk operations. */ +public class BulkManager { + + private final int bulkMaxItems; Review Comment: Is `maxBulkItems` more proper? ########## core/src/main/java/org/apache/gravitino/authorization/AccessControlManager.java: ########## @@ -88,6 +120,32 @@ public boolean removeUser(String metalake, String user) throws NoSuchMetalakeExc () -> userGroupManager.removeUser(metalake, user)); } + @Override + public List<BulkItemResult<String>> removeUsers( + String metalake, List<String> users, Optional<Owner> metalakeOwner) + throws NoSuchMetalakeException { + return TreeLockUtils.doWithTreeLock( + NameIdentifier.of(AuthorizationUtils.ofUserNamespace(metalake).levels()), + LockType.WRITE, + () -> { + List<BulkItemResult<String>> results = Lists.newArrayListWithCapacity(users.size()); + for (int index = 0; index < users.size(); index++) { + String user = users.get(index); + try { + ensureNotMetalakeOwner(metalakeOwner, metalake, user); + boolean removed = userGroupManager.removeUser(metalake, user); + if (!removed) { + throw new NoSuchUserException("User does not exist: %s", user); Review Comment: I think you can directly add a failed item to the result here. ########## docs/security/access-control.md: ########## @@ -270,6 +270,15 @@ object: the owner of the table or view, plus `CREATE_TABLE` or `CREATE_VIEW` on | Job template | `REGISTER_JOB_TEMPLATE` | `USE_JOB_TEMPLATE` | Owner | Run a job: `RUN_JOB` and `USE_JOB_TEMPLATE` | | Job | | Owner | Owner | | +Bulk user access-control APIs use the same privileges as the matching single-user operations. These +bulk operations are authorized once before processing the request. Bulk user add requests report +item-level failures in `errors`. + +| API | Required privilege | Request field | +|-----------------------------------------------------|---------------------------------------------|---------------| +| `POST /api/bulk/metalakes/{metalake}/users/add` | `OWNER` of the metalake or `MANAGE_USERS` | `users` | +| `POST /api/bulk/metalakes/{metalake}/users/remove` | `OWNER` of the metalake or `MANAGE_USERS` | `names` | Review Comment: Can you add some examples, such as curl and Java examples ########## core/src/main/java/org/apache/gravitino/authorization/AccessControlManager.java: ########## @@ -80,6 +84,34 @@ public User addUser(String metalake, String user, String externalId, boolean ena () -> userGroupExternalManager.addUser(metalake, user, externalId, enabled)); } + @Override + public List<BulkItemResult<User>> addUsers(String metalake, List<UserAdd> users) + throws NoSuchMetalakeException { + return TreeLockUtils.doWithTreeLock( + NameIdentifier.of(AuthorizationUtils.ofUserNamespace(metalake).levels()), + LockType.WRITE, + () -> { + List<BulkItemResult<User>> results = Lists.newArrayListWithCapacity(users.size()); + for (int index = 0; index < users.size(); index++) { Review Comment: What is the timeout setting between the server and client? I'm afraid that the client may receive an HTTP timeout before fetching the result. ########## server/src/main/java/org/apache/gravitino/server/web/rest/BulkOperations.java: ########## @@ -0,0 +1,178 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.gravitino.server.web.rest; + +import com.codahale.metrics.annotation.ResponseMetered; +import com.codahale.metrics.annotation.Timed; +import java.util.Arrays; +import java.util.List; +import java.util.Optional; +import java.util.stream.Collectors; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.POST; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.core.Context; +import javax.ws.rs.core.Response; +import org.apache.gravitino.Entity; +import org.apache.gravitino.GravitinoEnv; +import org.apache.gravitino.MetadataObject; +import org.apache.gravitino.MetadataObjects; +import org.apache.gravitino.authorization.AccessControlDispatcher; +import org.apache.gravitino.authorization.Owner; +import org.apache.gravitino.authorization.OwnerDispatcher; +import org.apache.gravitino.authorization.User; +import org.apache.gravitino.bulk.BulkItemResult; +import org.apache.gravitino.bulk.BulkManager; +import org.apache.gravitino.bulk.UserAdd; +import org.apache.gravitino.dto.authorization.UserDTO; +import org.apache.gravitino.dto.requests.BulkRemoveRequest; +import org.apache.gravitino.dto.requests.BulkUserAddRequest; +import org.apache.gravitino.dto.responses.BulkError; +import org.apache.gravitino.dto.responses.BulkRemoveResponse; +import org.apache.gravitino.dto.responses.BulkSummary; +import org.apache.gravitino.dto.responses.BulkUserResponse; +import org.apache.gravitino.dto.util.DTOConverters; +import org.apache.gravitino.metalake.MetalakeManager; +import org.apache.gravitino.metrics.MetricNames; +import org.apache.gravitino.server.authorization.NameBindings; +import org.apache.gravitino.server.authorization.annotations.AuthorizationExpression; +import org.apache.gravitino.server.authorization.annotations.AuthorizationMetadata; +import org.apache.gravitino.server.web.Utils; + +/** Provides best-effort bulk APIs for metalake access-control entities. */ [email protected] +@Path("/bulk/metalakes/{metalake}") +public class BulkOperations { + + private final BulkManager bulkManager; + private final AccessControlDispatcher accessControlDispatcher; + private final OwnerDispatcher ownerDispatcher; + + @Context private HttpServletRequest httpRequest; + + /** Creates a new bulk operations resource. */ + public BulkOperations() { + this.bulkManager = GravitinoEnv.getInstance().bulkManager(); + this.accessControlDispatcher = GravitinoEnv.getInstance().accessControlDispatcher(); + this.ownerDispatcher = GravitinoEnv.getInstance().ownerDispatcher(); + } + + /** + * Adds users in bulk. + * + * @param metalake The metalake name. + * @param request The bulk user add request. + * @return The bulk user response. + */ + @POST + @Path("users/add") + @Produces("application/vnd.gravitino.v1+json") + @Timed(name = "bulk-add-user." + MetricNames.HTTP_PROCESS_DURATION, absolute = true) + @ResponseMetered(name = "bulk-add-user", absolute = true) + @AuthorizationExpression(expression = "METALAKE::OWNER || METALAKE::MANAGE_USERS") + public Response addUsers( + @PathParam("metalake") @AuthorizationMetadata(type = Entity.EntityType.METALAKE) + String metalake, + BulkUserAddRequest request) { + try { + return Utils.doAs( + httpRequest, + () -> { + request.validate(); + bulkManager.checkBulkSize("users", request.getUsers().length); Review Comment: I think the first parameter, of type string, is arbitrary, and we can pass any value without checking. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
