This is an automated email from the ASF dual-hosted git repository.
jackietien pushed a commit to branch auth
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/auth by this push:
new f3e417cf9a0 Fix create user and grant
new 1092065e4f5 Merge branch 'auth' of https://github.com/apache/iotdb
into auth
f3e417cf9a0 is described below
commit f3e417cf9a015574d75d776f5416cae717cd851f
Author: JackieTien97 <[email protected]>
AuthorDate: Wed Aug 30 21:26:05 2023 +0800
Fix create user and grant
---
.../org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4 | 8 +++---
.../statemachine/ConfigRegionStateMachine.java | 4 +--
.../confignode/manager/PermissionManager.java | 2 +-
.../iotdb/confignode/manager/ProcedureManager.java | 2 +-
.../iotdb/confignode/persistence/AuthorInfo.java | 1 +
.../persistence/executor/ConfigPlanExecutor.java | 2 +-
.../impl/sync/AuthOperationProcedure.java | 31 ++++++++++++++--------
.../{ => auth}/AuthOperationProcedureState.java | 2 +-
.../procedure/store/ProcedureFactory.java | 2 ++
.../iotdb/db/auth/ClusterAuthorityFetcher.java | 2 +-
.../db/queryengine/plan/parser/ASTVisitor.java | 4 +--
.../plan/statement/sys/AuthorStatement.java | 8 +++---
.../apache/iotdb/commons/conf/CommonConfig.java | 6 ++---
13 files changed, 42 insertions(+), 32 deletions(-)
diff --git
a/iotdb-core/antlr/src/main/antlr4/org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4
b/iotdb-core/antlr/src/main/antlr4/org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4
index dfd70655a6d..381c1b48fbd 100644
---
a/iotdb-core/antlr/src/main/antlr4/org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4
+++
b/iotdb-core/antlr/src/main/antlr4/org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4
@@ -846,12 +846,12 @@ alterUser
// Grant User Privileges
grantUser
- : GRANT USER userName=identifier PRIVILEGES privileges (ON prefixPath
(COMMA prefixPath)*)? (grantOpt)?
+ : GRANT privileges ON prefixPath (COMMA prefixPath)* TO USER
userName=identifier (grantOpt)?
;
// Grant Role Privileges
grantRole
- : GRANT ROLE roleName=identifier PRIVILEGES privileges (ON prefixPath
(COMMA prefixPath)*)? (grantOpt)?
+ : GRANT privileges ON prefixPath (COMMA prefixPath)* TO ROLE
roleName=identifier (grantOpt)?
;
// Grant Option
@@ -866,12 +866,12 @@ grantRoleToUser
// Revoke User Privileges
revokeUser
- : REVOKE USER userName=identifier PRIVILEGES privileges (ON prefixPath
(COMMA prefixPath)*)?
+ : REVOKE privileges ON prefixPath (COMMA prefixPath)* FROM USER
userName=identifier
;
// Revoke Role Privileges
revokeRole
- : REVOKE ROLE roleName=identifier PRIVILEGES privileges (ON prefixPath
(COMMA prefixPath)*)?
+ : REVOKE privileges ON prefixPath (COMMA prefixPath)* FROM ROLE
roleName=identifier
;
// Revoke Role From User
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/statemachine/ConfigRegionStateMachine.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/statemachine/ConfigRegionStateMachine.java
index fdec21c1c00..6367655516f 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/statemachine/ConfigRegionStateMachine.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/consensus/statemachine/ConfigRegionStateMachine.java
@@ -115,7 +115,7 @@ public class ConfigRegionStateMachine
TSStatus result;
try {
result = executor.executeNonQueryPlan(plan);
- } catch (UnknownPhysicalPlanTypeException | AuthException e) {
+ } catch (UnknownPhysicalPlanTypeException e) {
LOGGER.error(e.getMessage());
result = new
TSStatus(TSStatusCode.INTERNAL_SERVER_ERROR.getStatusCode());
}
@@ -334,7 +334,7 @@ public class ConfigRegionStateMachine
ConfigPhysicalPlan nextPlan = logReader.next();
try {
executor.executeNonQueryPlan(nextPlan);
- } catch (UnknownPhysicalPlanTypeException | AuthException e) {
+ } catch (UnknownPhysicalPlanTypeException e) {
LOGGER.error(e.getMessage());
}
}
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/PermissionManager.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/PermissionManager.java
index 961e9396b62..cd849a7e311 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/PermissionManager.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/PermissionManager.java
@@ -68,7 +68,7 @@ public class PermissionManager {
} else {
List<TDataNodeConfiguration> allDataNodes =
configManager.getNodeManager().getRegisteredDataNodes();
- tsStatus =
configManager.getProcedureManager().OperateAuthPlan(authorPlan, allDataNodes);
+ tsStatus =
configManager.getProcedureManager().operateAuthPlan(authorPlan, allDataNodes);
}
return tsStatus;
} catch (ConsensusException e) {
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/ProcedureManager.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/ProcedureManager.java
index a2af9bb6b85..a5b4045c565 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/ProcedureManager.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/ProcedureManager.java
@@ -886,7 +886,7 @@ public class ProcedureManager {
}
}
- public TSStatus OperateAuthPlan(AuthorPlan authorPlan,
List<TDataNodeConfiguration> dns) {
+ public TSStatus operateAuthPlan(AuthorPlan authorPlan,
List<TDataNodeConfiguration> dns) {
try {
final long procedureId =
executor.submitProcedure(new AuthOperationProcedure(authorPlan,
dns));
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
index cd0d5bd402b..75fcca3ed1e 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
@@ -563,6 +563,7 @@ public class AuthorInfo implements SnapshotProcessor {
tUserResp.setPrivilegeList(userPrivilegeList);
tUserResp.setRoleList(user.getRoleList());
tUserResp.setSysPriSet(user.getSysPrivilege());
+ tUserResp.setSysPriSetGrantOpt(user.getSysPriGrantOpt());
}
// Permission information for roles owned by users
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/executor/ConfigPlanExecutor.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/executor/ConfigPlanExecutor.java
index 2e226cd05b8..81dc6364350 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/executor/ConfigPlanExecutor.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/executor/ConfigPlanExecutor.java
@@ -293,7 +293,7 @@ public class ConfigPlanExecutor {
}
public TSStatus executeNonQueryPlan(ConfigPhysicalPlan physicalPlan)
- throws UnknownPhysicalPlanTypeException, AuthException {
+ throws UnknownPhysicalPlanTypeException {
switch (physicalPlan.getType()) {
case RegisterDataNode:
return nodeInfo.registerDataNode((RegisterDataNodePlan) physicalPlan);
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/impl/sync/AuthOperationProcedure.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/impl/sync/AuthOperationProcedure.java
index bf3edcedf8b..56e70ad1475 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/impl/sync/AuthOperationProcedure.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/impl/sync/AuthOperationProcedure.java
@@ -31,8 +31,8 @@ import
org.apache.iotdb.confignode.consensus.request.ConfigPhysicalPlan;
import org.apache.iotdb.confignode.consensus.request.auth.AuthorPlan;
import org.apache.iotdb.confignode.procedure.env.ConfigNodeProcedureEnv;
import org.apache.iotdb.confignode.procedure.exception.ProcedureException;
-import
org.apache.iotdb.confignode.procedure.impl.statemachine.StateMachineProcedure;
-import org.apache.iotdb.confignode.procedure.state.AuthOperationProcedureState;
+import org.apache.iotdb.confignode.procedure.impl.node.AbstractNodeProcedure;
+import
org.apache.iotdb.confignode.procedure.state.auth.AuthOperationProcedureState;
import org.apache.iotdb.confignode.procedure.store.ProcedureType;
import org.apache.iotdb.consensus.exception.ConsensusException;
import org.apache.iotdb.mpp.rpc.thrift.TInvalidatePermissionCacheReq;
@@ -49,11 +49,11 @@ import java.nio.ByteBuffer;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
+import java.util.Objects;
-import static
org.apache.iotdb.confignode.procedure.state.AuthOperationProcedureState.DATANODE_AUTHCACHE_INVALIDING;
+import static
org.apache.iotdb.confignode.procedure.state.auth.AuthOperationProcedureState.DATANODE_AUTHCACHE_INVALIDING;
-public class AuthOperationProcedure
- extends StateMachineProcedure<ConfigNodeProcedureEnv,
AuthOperationProcedureState> {
+public class AuthOperationProcedure extends
AbstractNodeProcedure<AuthOperationProcedureState> {
private static final Logger LOGGER =
LoggerFactory.getLogger(AuthOperationProcedure.class);
private String user;
@@ -61,7 +61,7 @@ public class AuthOperationProcedure
private AuthorPlan plan;
- private int timeoutMS;
+ private long timeoutMS;
private static final String CONSENSUS_WRITE_ERROR =
"Failed in the write API executing the consensus layer due to: ";
@@ -99,14 +99,15 @@ public class AuthOperationProcedure
req.setRoleName(role);
Iterator<Pair<TDataNodeConfiguration, Long>> it =
dataNodesToInvalid.iterator();
while (it.hasNext()) {
- if (it.next().getRight() + this.timeoutMS <
System.currentTimeMillis()) {
+ Pair<TDataNodeConfiguration, Long> pair = it.next();
+ if (pair.getRight() + this.timeoutMS < System.currentTimeMillis())
{
it.remove();
continue;
}
status =
SyncDataNodeClientPool.getInstance()
.sendSyncRequestToDataNodeWithRetry(
-
it.next().getLeft().getLocation().getInternalEndPoint(),
+ pair.getLeft().getLocation().getInternalEndPoint(),
req,
DataNodeRequestType.INVALIDATE_PERMISSION_CACHE);
if (status.getCode() ==
TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
@@ -123,7 +124,7 @@ public class AuthOperationProcedure
} catch (Exception e) {
if (isRollbackSupported(state)) {
LOGGER.error("Fail when execute {} ", plan);
- setFailure(new ProcedureException(e.getMessage()));
+ setFailure(new ProcedureException(e));
} else {
LOGGER.error("Retrievable error trying to execute plan {}, state: {}",
plan, state, e);
if (getCycles() > RETRY_THRESHOLD) {
@@ -203,7 +204,7 @@ public class AuthOperationProcedure
ThriftCommonsSerDeUtils.deserializeTDataNodeConfiguration(byteBuffer);
this.datanodes.add(datanode);
}
- this.timeoutMS = ReadWriteIOUtils.readInt(byteBuffer);
+ this.timeoutMS = ReadWriteIOUtils.readLong(byteBuffer);
try {
ReadWriteIOUtils.readInt(byteBuffer);
this.plan = (AuthorPlan) ConfigPhysicalPlan.Factory.create(byteBuffer);
@@ -221,6 +222,14 @@ public class AuthOperationProcedure
return false;
}
AuthOperationProcedure that = (AuthOperationProcedure) o;
- return plan.equals(that.plan) && datanodes.equals(that.datanodes);
+ return timeoutMS == that.timeoutMS
+ && Objects.equals(plan, that.plan)
+ && Objects.equals(dataNodesToInvalid, that.dataNodesToInvalid)
+ && Objects.equals(datanodes, that.datanodes);
+ }
+
+ @Override
+ public int hashCode() {
+ return Objects.hash(plan, timeoutMS, dataNodesToInvalid, datanodes);
}
}
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/state/AuthOperationProcedureState.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/state/auth/AuthOperationProcedureState.java
similarity index 93%
rename from
iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/state/AuthOperationProcedureState.java
rename to
iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/state/auth/AuthOperationProcedureState.java
index 5e75c726159..0bc263ad7ed 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/state/AuthOperationProcedureState.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/state/auth/AuthOperationProcedureState.java
@@ -17,7 +17,7 @@
* under the License.
*/
-package org.apache.iotdb.confignode.procedure.state;
+package org.apache.iotdb.confignode.procedure.state.auth;
public enum AuthOperationProcedureState {
INIT,
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/store/ProcedureFactory.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/store/ProcedureFactory.java
index 1f1f7e50217..997bbbbb8a4 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/store/ProcedureFactory.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/store/ProcedureFactory.java
@@ -238,6 +238,8 @@ public class ProcedureFactory implements IProcedureFactory {
return ProcedureType.DELETE_LOGICAL_VIEW_PROCEDURE;
} else if (procedure instanceof AlterLogicalViewProcedure) {
return ProcedureType.ALTER_LOGICAL_VIEW_PROCEDURE;
+ } else if (procedure instanceof AuthOperationProcedure) {
+ return ProcedureType.AUTH_OPERATE_PROCEDURE;
}
return null;
}
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
index 762dc4156f6..91893146fd8 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
@@ -305,7 +305,7 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
TSStatus tsStatus = configNodeClient.operatePermission(authorizerReq);
// Get response or throw exception
if (TSStatusCode.SUCCESS_STATUS.getStatusCode() != tsStatus.getCode()) {
- logger.error(
+ logger.warn(
"Failed to execute {} in config node, status is {}.",
AuthorType.values()[authorizerReq.getAuthorType()].toString().toLowerCase(Locale.ROOT),
tsStatus);
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
index aab5770c0f9..700789dfa7e 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
@@ -2200,7 +2200,7 @@ public class ASTVisitor extends
IoTDBSqlParserBaseVisitor<Statement> {
authorStatement.setUserName(parseIdentifier(ctx.userName.getText()));
authorStatement.setPrivilegeList(privileges);
authorStatement.setNodeNameList(nodeNameList);
- authorStatement.setGrantOpt(!ctx.grantOpt().isEmpty());
+ authorStatement.setGrantOpt(ctx.grantOpt() != null);
return authorStatement;
}
@@ -2220,7 +2220,7 @@ public class ASTVisitor extends
IoTDBSqlParserBaseVisitor<Statement> {
authorStatement.setRoleName(parseIdentifier(ctx.roleName.getText()));
authorStatement.setPrivilegeList(privileges);
authorStatement.setNodeNameList(nodeNameList);
- authorStatement.setGrantOpt(!ctx.grantOpt().isEmpty());
+ authorStatement.setGrantOpt(ctx.grantOpt() != null);
return authorStatement;
}
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
index 8bfbbc56861..dead54cd781 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
@@ -220,7 +220,7 @@ public class AuthorStatement extends Statement implements
IConfigStatement {
case CREATE_USER:
TSStatus status =
AuthorityChecker.getTSStatus(
- AuthorityChecker.SUPER_USER.equals(this.userName),
+ !AuthorityChecker.SUPER_USER.equals(this.userName),
"Cannot create user has same name with admin user");
if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
return status;
@@ -252,6 +252,8 @@ public class AuthorStatement extends Statement implements
IConfigStatement {
case DROP_ROLE:
case LIST_ROLE:
case LIST_ROLE_PRIVILEGE:
+ case GRANT_USER_ROLE:
+ case REVOKE_USER_ROLE:
if (AuthorityChecker.SUPER_USER.equals(userName)) {
return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
}
@@ -269,10 +271,6 @@ public class AuthorStatement extends Statement implements
IConfigStatement {
return AuthorityChecker.getTSStatus(
AuthorityChecker.checkGrantOption(userName, privilegeList,
nodeNameList, authorType),
"Has no permission to " + authorType);
- case GRANT_USER_ROLE:
- case REVOKE_USER_ROLE:
- // TODO ?
- return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
default:
throw new IllegalArgumentException("Unknown authorType: " +
authorType);
}
diff --git
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonConfig.java
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonConfig.java
index 509e9d329c0..dc03e905cb3 100644
---
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonConfig.java
+++
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonConfig.java
@@ -195,7 +195,7 @@ public class CommonConfig {
// maximum number of Cluster Databases allowed
private int databaseLimitThreshold = -1;
- private int datanodeTokenTimeoutMS = 180 * 1000; // 3 minutes
+ private long datanodeTokenTimeoutMS = 180 * 1000; // 3 minutes
CommonConfig() {
// Empty constructor
@@ -755,11 +755,11 @@ public class CommonConfig {
this.databaseLimitThreshold = databaseLimitThreshold;
}
- public int getDatanodeTokenTimeoutMS() {
+ public long getDatanodeTokenTimeoutMS() {
return datanodeTokenTimeoutMS;
}
- public void setDatanodeTokenTimeoutMS(int timeoutMS) {
+ public void setDatanodeTokenTimeoutMS(long timeoutMS) {
this.datanodeTokenTimeoutMS = timeoutMS;
}
}
