This is an automated email from the ASF dual-hosted git repository.
jackietien pushed a commit to branch auth
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/auth by this push:
new eed42670c65 Fix some
eed42670c65 is described below
commit eed42670c6556d386e37924eb5938019a8ab56eb
Author: Weihao Li <[email protected]>
AuthorDate: Fri Sep 1 08:45:33 2023 +0800
Fix some
---
.../iotdb/confignode/persistence/AuthorInfo.java | 55 ++++++++---------
.../org/apache/iotdb/db/auth/AuthorityChecker.java | 52 +++-------------
.../iotdb/db/auth/ClusterAuthorityFetcher.java | 71 ++++++++++------------
.../apache/iotdb/db/auth/IAuthorityFetcher.java | 2 +-
.../plan/statement/sys/AuthorStatement.java | 38 +++++++++---
.../db/queryengine/plan/analyze/AnalyzeTest.java | 11 +++-
.../iotdb/commons/auth/entity/PrivilegeType.java | 4 ++
.../iotdb/commons/auth/user/BasicUserManager.java | 2 +-
.../org/apache/iotdb/commons/utils/AuthUtils.java | 61 ++++++++++---------
9 files changed, 143 insertions(+), 153 deletions(-)
diff --git
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
index 75fcca3ed1e..1f8082631c7 100644
---
a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
+++
b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java
@@ -125,20 +125,19 @@ public class AuthorInfo implements SnapshotProcessor {
List<Integer> failedList = new ArrayList<>();
try {
if (paths.isEmpty()) {
- if (authorizer.checkUserPrivileges(username, null, permission)) {
- status = true;
+ status = authorizer.checkUserPrivileges(username, null, permission);
+ } else {
+ int pos = 0;
+ for (PartialPath path : paths) {
+ if (!checkOnePath(username, path, permission)) {
+ failedList.add(pos);
+ continue;
+ }
+ pos++;
}
- }
- int pos = 0;
- for (PartialPath path : paths) {
- if (!checkOnePath(username, path, permission)) {
- failedList.add(pos);
- continue;
+ if (failedList.size() == paths.size()) {
+ status = false;
}
- pos++;
- }
- if (failedList.size() == paths.size()) {
- status = false;
}
} catch (AuthException e) {
status = false;
@@ -199,24 +198,24 @@ public class AuthorInfo implements SnapshotProcessor {
authorizer.deleteRole(roleName);
break;
case GrantRole:
- for (int i : permissions) {
- if (nodeNameList == null) {
- authorizer.grantPrivilegeToRole(roleName, null, i, grantOpt);
+ for (int permission : permissions) {
+ if (!PrivilegeType.isPathRelevant(permission)) {
+ authorizer.grantPrivilegeToRole(roleName, null, permission,
grantOpt);
continue;
}
for (PartialPath path : nodeNameList) {
- authorizer.grantPrivilegeToRole(roleName, path, i, grantOpt);
+ authorizer.grantPrivilegeToRole(roleName, path, permission,
grantOpt);
}
}
break;
case GrantUser:
- for (int i : permissions) {
- if (nodeNameList == null) {
- authorizer.grantPrivilegeToUser(userName, null, i, grantOpt);
+ for (int permission : permissions) {
+ if (!PrivilegeType.isPathRelevant(permission)) {
+ authorizer.grantPrivilegeToUser(userName, null, permission,
grantOpt);
continue;
}
for (PartialPath path : nodeNameList) {
- authorizer.grantPrivilegeToUser(userName, path, i, grantOpt);
+ authorizer.grantPrivilegeToUser(userName, path, permission,
grantOpt);
}
}
break;
@@ -224,24 +223,24 @@ public class AuthorInfo implements SnapshotProcessor {
authorizer.grantRoleToUser(roleName, userName);
break;
case RevokeUser:
- for (int i : permissions) {
- if (nodeNameList == null) {
- authorizer.revokePrivilegeFromUser(userName, null, i);
+ for (int permission : permissions) {
+ if (!PrivilegeType.isPathRelevant(permission)) {
+ authorizer.revokePrivilegeFromUser(userName, null, permission);
continue;
}
for (PartialPath path : nodeNameList) {
- authorizer.revokePrivilegeFromUser(userName, path, i);
+ authorizer.revokePrivilegeFromUser(userName, path, permission);
}
}
break;
case RevokeRole:
- for (int i : permissions) {
- if (nodeNameList == null) {
- authorizer.revokePrivilegeFromRole(roleName, null, i);
+ for (int permission : permissions) {
+ if (!PrivilegeType.isPathRelevant(permission)) {
+ authorizer.revokePrivilegeFromRole(roleName, null, permission);
continue;
}
for (PartialPath path : nodeNameList) {
- authorizer.revokePrivilegeFromRole(roleName, path, i);
+ authorizer.revokePrivilegeFromRole(roleName, path, permission);
}
}
break;
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java
index 28f95a0468e..166102dc6d3 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java
@@ -30,7 +30,6 @@ import org.apache.iotdb.db.protocol.session.IClientSession;
import org.apache.iotdb.db.queryengine.common.header.ColumnHeader;
import org.apache.iotdb.db.queryengine.common.header.DatasetHeader;
import org.apache.iotdb.db.queryengine.plan.execution.config.ConfigTaskResult;
-import org.apache.iotdb.db.queryengine.plan.statement.AuthorType;
import org.apache.iotdb.db.queryengine.plan.statement.Statement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.AuthorStatement;
import org.apache.iotdb.rpc.TSStatusCode;
@@ -41,7 +40,6 @@ import org.apache.iotdb.tsfile.utils.Binary;
import com.google.common.util.concurrent.SettableFuture;
import java.util.ArrayList;
-import java.util.Collections;
import java.util.List;
import java.util.Map;
@@ -132,32 +130,23 @@ public class AuthorityChecker {
prompt.append(", ");
prompt.append(pathList.get(noPermissionIndexList.get(i)));
}
- prompt.append(" ]");
+ prompt.append("]");
return new
TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode()).setMessage(prompt.toString());
}
public static boolean checkFullPathPermission(
String userName, PartialPath fullPath, int permission) {
long startTime = System.nanoTime();
- if (SUPER_USER.equals(userName)) {
- return true;
- }
List<PartialPath> path = new ArrayList<>();
path.add(fullPath);
List<Integer> failIndex =
authorityFetcher.checkUserPathPrivileges(userName, path, permission);
PERFORMANCE_OVERVIEW_METRICS.recordAuthCost(System.nanoTime() - startTime);
- if (failIndex.isEmpty()) {
- return true;
- }
- return false;
+ return failIndex.isEmpty();
}
public static List<Integer> checkFullPathListPermission(
String userName, List<PartialPath> fullPaths, int permission) {
long startTime = System.nanoTime();
- if (SUPER_USER.equals(userName)) {
- Collections.emptyList();
- }
List<Integer> failIndex =
authorityFetcher.checkUserPathPrivileges(userName, fullPaths,
permission);
PERFORMANCE_OVERVIEW_METRICS.recordAuthCost(System.nanoTime() - startTime);
@@ -167,55 +156,30 @@ public class AuthorityChecker {
public static List<Integer> checkPatternPermission(
String userName, List<PartialPath> pathPatterns, int permission) {
long startTime = System.nanoTime();
- if (SUPER_USER.equals(userName)) {
- Collections.emptyList();
- }
List<Integer> failIndex =
authorityFetcher.checkUserPathPrivileges(userName, pathPatterns,
permission);
PERFORMANCE_OVERVIEW_METRICS.recordAuthCost(System.nanoTime() - startTime);
return failIndex;
}
- public static boolean checkUserPrivilegeGrantOpt(
- String username, List<PartialPath> paths, int permission) {
- long startTime = System.nanoTime();
- if (SUPER_USER.equals(username)) {
- return true;
- }
- return authorityFetcher.checkUserPrivilegeGrantOpt(username, paths,
permission);
- }
-
public static PathPatternTree getAuthorizedPathTree(String userName, int
permission)
throws AuthException {
- PathPatternTree pathTree =
authorityFetcher.getAuthizedPatternTree(userName, permission);
- return pathTree;
+ return authorityFetcher.getAuthorizedPatternTree(userName, permission);
}
public static boolean checkSystemPermission(String userName, int permission)
{
long startTime = System.nanoTime();
- if (SUPER_USER.equals(userName)) {
- return true;
- }
TSStatus status = authorityFetcher.checkUserSysPrivileges(userName,
permission);
PERFORMANCE_OVERVIEW_METRICS.recordAuthCost(System.nanoTime() - startTime);
- if (status.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
- return true;
- }
- return false;
+ return status.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode();
}
public static boolean checkGrantOption(
- String userName,
- String[] privilegeList,
- List<PartialPath> nodeNameList,
- AuthorType authorType) {
+ String userName, String[] privilegeList, List<PartialPath> nodeNameList)
{
long startTime = System.nanoTime();
- boolean grantOpt;
- for (int i = 0; i < privilegeList.length; i++) {
- grantOpt =
- authorityFetcher.checkUserPrivilegeGrantOpt(
- userName, nodeNameList,
PrivilegeType.valueOf(privilegeList[i]).ordinal());
- if (!grantOpt) {
+ for (String s : privilegeList) {
+ if (!authorityFetcher.checkUserPrivilegeGrantOpt(
+ userName, nodeNameList, PrivilegeType.valueOf(s).ordinal())) {
return false;
}
}
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
index 91893146fd8..1ad4256d430 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java
@@ -123,8 +123,7 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
String username, List<PartialPath> paths, int permission) {
checkCacheAvailable();
User user = iAuthorCache.getUserCache(username);
- TSStatus status;
- boolean grantOpt = false;
+ boolean grantOpt;
if (user != null) {
if (!user.isOpenIdUser()) {
if (!paths.isEmpty()) {
@@ -207,7 +206,7 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
}
@Override
- public PathPatternTree getAuthizedPatternTree(String username, int
permission)
+ public PathPatternTree getAuthorizedPatternTree(String username, int
permission)
throws AuthException {
PathPatternTree patternTree = new PathPatternTree();
User user = iAuthorCache.getUserCache(username);
@@ -253,9 +252,7 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
}
if (authizedPatternTree.getStatus().getCode() ==
TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
iAuthorCache.putUserCache(username,
cacheUser(authizedPatternTree.getPermissionInfo()));
- PathPatternTree patternTree =
-
PathPatternTree.deserialize(ByteBuffer.wrap(authizedPatternTree.getPathPatternTree()));
- return patternTree;
+ return
PathPatternTree.deserialize(ByteBuffer.wrap(authizedPatternTree.getPathPatternTree()));
} else {
throw new AuthException(
TSStatusCode.EXECUTE_STATEMENT_ERROR,
authizedPatternTree.getStatus().getMessage());
@@ -267,26 +264,24 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
checkCacheAvailable();
User user = iAuthorCache.getUserCache(username);
if (user != null) {
- if (!user.isOpenIdUser()) {
- if (!user.checkSysPrivilege(permission)) {
- if (user.getRoleList().isEmpty()) {
- return RpcUtils.getStatus(TSStatusCode.NO_PERMISSION);
- }
- boolean status = false;
- for (String rolename : user.getRoleList()) {
- Role cacheRole = iAuthorCache.getRoleCache(rolename);
- if (cacheRole == null) {
- return checkSysPriFromConfigNode(username, permission);
- }
- if (cacheRole.checkSysPrivilege(permission)) {
- status = true;
- break;
- }
+ if (!user.isOpenIdUser() && (!user.checkSysPrivilege(permission))) {
+ if (user.getRoleList().isEmpty()) {
+ return RpcUtils.getStatus(TSStatusCode.NO_PERMISSION);
+ }
+ boolean status = false;
+ for (String rolename : user.getRoleList()) {
+ Role cacheRole = iAuthorCache.getRoleCache(rolename);
+ if (cacheRole == null) {
+ return checkSysPriFromConfigNode(username, permission);
}
- if (!status) {
- return RpcUtils.getStatus(TSStatusCode.NO_PERMISSION);
+ if (cacheRole.checkSysPrivilege(permission)) {
+ status = true;
+ break;
}
}
+ if (!status) {
+ return RpcUtils.getStatus(TSStatusCode.NO_PERMISSION);
+ }
}
return RpcUtils.getStatus(TSStatusCode.SUCCESS_STATUS);
} else {
@@ -366,12 +361,12 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
}
public void refreshToken() {
- long currnetTime = System.currentTimeMillis();
+ long currentTime = System.currentTimeMillis();
if (heartBeatTimeStamp == 0) {
- heartBeatTimeStamp = currnetTime;
+ heartBeatTimeStamp = currentTime;
return;
}
- if (currnetTime - heartBeatTimeStamp > config.getDatanodeTokenTimeoutMS())
{
+ if (currentTime - heartBeatTimeStamp > config.getDatanodeTokenTimeoutMS())
{
cacheOutDate = true;
}
}
@@ -440,10 +435,8 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
}
if (permissionInfoResp.getStatus().getCode() ==
TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
iAuthorCache.putUserCache(username, cacheUser(permissionInfoResp));
- return permissionInfoResp.getStatus();
- } else {
- return permissionInfoResp.getStatus();
}
+ return permissionInfoResp.getStatus();
}
private List<Integer> checkPathFromConfigNode(
@@ -476,15 +469,15 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
List<PathPrivilege> pathPrivilegeList = new ArrayList<>();
user.setName(tPermissionInfoResp.getUserInfo().getUsername());
user.setPassword(tPermissionInfoResp.getUserInfo().getPassword());
- for (int i = 0; i < privilegeList.size(); i++) {
+ for (TPathPrivilege tPathPrivilege : privilegeList) {
try {
PathPrivilege pathPri = new PathPrivilege();
- pathPri.setPath(new PartialPath(privilegeList.get(i).getPath()));
- pathPri.setPrivileges(privilegeList.get(i).getPriSet());
- pathPri.setGrantOpt(privilegeList.get(i).getPriGrantOpt());
+ pathPri.setPath(new PartialPath(tPathPrivilege.getPath()));
+ pathPri.setPrivileges(tPathPrivilege.getPriSet());
+ pathPri.setGrantOpt(tPathPrivilege.getPriGrantOpt());
pathPrivilegeList.add(pathPri);
} catch (MetadataException e) {
- logger.error("Failed to parse path {}.",
privilegeList.get(i).getPath(), e);
+ logger.error("Failed to parse path {}.", tPathPrivilege.getPath(), e);
}
}
user.setOpenIdUser(tPermissionInfoResp.getUserInfo().isIsOpenIdUser());
@@ -505,15 +498,15 @@ public class ClusterAuthorityFetcher implements
IAuthorityFetcher {
tPermissionInfoResp.getRoleInfo().get(roleName).getPrivilegeList();
List<PathPrivilege> pathPrivilegeList = new ArrayList<>();
role.setName(tPermissionInfoResp.getRoleInfo().get(roleName).getRoleName());
- for (int i = 0; i < privilegeList.size(); i++) {
+ for (TPathPrivilege tPathPrivilege : privilegeList) {
try {
PathPrivilege pathPri = new PathPrivilege();
- pathPri.setPath(new PartialPath(privilegeList.get(i).getPath()));
- pathPri.setPrivileges(privilegeList.get(i).getPriSet());
- pathPri.setGrantOpt(privilegeList.get(i).getPriGrantOpt());
+ pathPri.setPath(new PartialPath(tPathPrivilege.getPath()));
+ pathPri.setPrivileges(tPathPrivilege.getPriSet());
+ pathPri.setGrantOpt(tPathPrivilege.getPriGrantOpt());
pathPrivilegeList.add(pathPri);
} catch (MetadataException e) {
- logger.error("Failed to parse path {}.",
privilegeList.get(i).getPath(), e);
+ logger.error("Failed to parse path {}.", tPathPrivilege.getPath(), e);
}
}
role.setSysPriGrantOpt(tPermissionInfoResp.getRoleInfo().get(roleName).getSysPriSetGrantOpt());
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/IAuthorityFetcher.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/IAuthorityFetcher.java
index c40c0810626..8700ed40950 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/IAuthorityFetcher.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/IAuthorityFetcher.java
@@ -40,7 +40,7 @@ public interface IAuthorityFetcher {
boolean checkUserPrivilegeGrantOpt(String username, List<PartialPath> paths,
int permission);
- PathPatternTree getAuthizedPatternTree(String username, int permission)
throws AuthException;
+ PathPatternTree getAuthorizedPatternTree(String username, int permission)
throws AuthException;
SettableFuture<ConfigTaskResult> operatePermission(AuthorStatement
authorStatement);
diff --git
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
index dead54cd781..53b13dba4af 100644
---
a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
+++
b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/sys/AuthorStatement.java
@@ -218,12 +218,9 @@ public class AuthorStatement extends Statement implements
IConfigStatement {
public TSStatus checkPermissionBeforeProcess(String userName) {
switch (authorType) {
case CREATE_USER:
- TSStatus status =
- AuthorityChecker.getTSStatus(
- !AuthorityChecker.SUPER_USER.equals(this.userName),
- "Cannot create user has same name with admin user");
- if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
- return status;
+ if (AuthorityChecker.SUPER_USER.equals(this.userName)) {
+ return AuthorityChecker.getTSStatus(
+ false, "Cannot create user has same name with admin user");
}
if (AuthorityChecker.SUPER_USER.equals(userName)) {
return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
@@ -231,15 +228,28 @@ public class AuthorStatement extends Statement implements
IConfigStatement {
return AuthorityChecker.getTSStatus(
AuthorityChecker.checkSystemPermission(userName,
PrivilegeType.MANAGE_USER.ordinal()),
PrivilegeType.MANAGE_USER);
+
case UPDATE_USER:
+ // users can change passwords of themselves
if (AuthorityChecker.SUPER_USER.equals(userName) ||
this.userName.equals(userName)) {
return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
}
return AuthorityChecker.getTSStatus(
AuthorityChecker.checkSystemPermission(userName,
PrivilegeType.MANAGE_USER.ordinal()),
PrivilegeType.MANAGE_USER);
- case LIST_USER:
+
case DROP_USER:
+ if (AuthorityChecker.SUPER_USER.equals(this.userName) ||
this.userName.equals(userName)) {
+ return AuthorityChecker.getTSStatus(false, "Cannot drop admin user
or yourself");
+ }
+ if (AuthorityChecker.SUPER_USER.equals(userName)) {
+ return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
+ }
+ return AuthorityChecker.getTSStatus(
+ AuthorityChecker.checkSystemPermission(userName,
PrivilegeType.MANAGE_USER.ordinal()),
+ PrivilegeType.MANAGE_USER);
+
+ case LIST_USER:
case LIST_USER_PRIVILEGE:
if (AuthorityChecker.SUPER_USER.equals(userName)) {
return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
@@ -261,15 +271,25 @@ public class AuthorStatement extends Statement implements
IConfigStatement {
AuthorityChecker.checkSystemPermission(userName,
PrivilegeType.MANAGE_ROLE.ordinal()),
PrivilegeType.MANAGE_ROLE);
- case GRANT_USER:
case REVOKE_USER:
+ if (AuthorityChecker.SUPER_USER.equals(this.userName)) {
+ return AuthorityChecker.getTSStatus(false, "Cannot revoke privileges
of admin user");
+ }
+ if (AuthorityChecker.SUPER_USER.equals(userName)) {
+ return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
+ }
+ return AuthorityChecker.getTSStatus(
+ AuthorityChecker.checkGrantOption(userName, privilegeList,
nodeNameList),
+ "Has no permission to " + authorType);
+
+ case GRANT_USER:
case GRANT_ROLE:
case REVOKE_ROLE:
if (AuthorityChecker.SUPER_USER.equals(userName)) {
return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
}
return AuthorityChecker.getTSStatus(
- AuthorityChecker.checkGrantOption(userName, privilegeList,
nodeNameList, authorType),
+ AuthorityChecker.checkGrantOption(userName, privilegeList,
nodeNameList),
"Has no permission to " + authorType);
default:
throw new IllegalArgumentException("Unknown authorType: " +
authorType);
diff --git
a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/analyze/AnalyzeTest.java
b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/analyze/AnalyzeTest.java
index 0a12f59c498..b163b5a2fa8 100644
---
a/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/analyze/AnalyzeTest.java
+++
b/iotdb-core/datanode/src/test/java/org/apache/iotdb/db/queryengine/plan/analyze/AnalyzeTest.java
@@ -19,12 +19,14 @@
package org.apache.iotdb.db.queryengine.plan.analyze;
+import org.apache.iotdb.common.rpc.thrift.TEndPoint;
import org.apache.iotdb.common.rpc.thrift.TSeriesPartitionSlot;
import org.apache.iotdb.commons.exception.IllegalPathException;
import org.apache.iotdb.commons.path.MeasurementPath;
import org.apache.iotdb.commons.path.PartialPath;
import org.apache.iotdb.db.queryengine.common.MPPQueryContext;
import org.apache.iotdb.db.queryengine.common.QueryId;
+import org.apache.iotdb.db.queryengine.common.SessionInfo;
import org.apache.iotdb.db.queryengine.common.header.ColumnHeader;
import org.apache.iotdb.db.queryengine.common.header.DatasetHeader;
import org.apache.iotdb.db.queryengine.plan.expression.Expression;
@@ -57,6 +59,7 @@ import
org.apache.ratis.thirdparty.com.google.common.collect.Sets;
import org.junit.Assert;
import org.junit.Test;
+import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.util.ArrayList;
import java.util.Arrays;
@@ -1041,7 +1044,13 @@ public class AnalyzeTest {
try {
Statement statement =
StatementGenerator.createStatement(sql,
ZonedDateTime.now().getOffset());
- MPPQueryContext context = new MPPQueryContext(new QueryId("test_query"));
+ MPPQueryContext context =
+ new MPPQueryContext(
+ "",
+ new QueryId("test_query"),
+ new SessionInfo(0, "test", ZoneId.systemDefault().getId()),
+ new TEndPoint(),
+ new TEndPoint());
Analyzer analyzer =
new Analyzer(context, new FakePartitionFetcherImpl(), new
FakeSchemaFetcherImpl());
return analyzer.analyze(statement);
diff --git
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/PrivilegeType.java
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/PrivilegeType.java
index 3ebb5ca8f2a..532dd02cd32 100644
---
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/PrivilegeType.java
+++
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/PrivilegeType.java
@@ -54,6 +54,10 @@ public enum PrivilegeType {
return isPathRelevant;
}
+ public static boolean isPathRelevant(int ordinal) {
+ return ordinal < 4;
+ }
+
public static int getSysPriCount() {
int size = 0;
for (PrivilegeType item : PrivilegeType.values()) {
diff --git
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java
index e639ba5d66e..dedd5f4b41a 100644
---
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java
+++
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java
@@ -128,7 +128,7 @@ public abstract class BasicUserManager implements
IUserManager {
@Override
public boolean grantPrivilegeToUser(
String username, PartialPath path, int privilegeId, boolean grantOpt)
throws AuthException {
- AuthUtils.validatePrivilege(path, privilegeId);
+ // AuthUtils.validatePrivilege(path, privilegeId);
lock.writeLock(username);
try {
User user = getUser(username);
diff --git
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/utils/AuthUtils.java
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/utils/AuthUtils.java
index 58bb16d8a88..96266071713 100644
---
a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/utils/AuthUtils.java
+++
b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/utils/AuthUtils.java
@@ -150,6 +150,15 @@ public class AuthUtils {
}
}
+ public static void validateSystemPermissionPath(String path) throws
AuthException {
+ if (!path.equalsIgnoreCase("root.**")) {
+ throw new AuthException(
+ TSStatusCode.ILLEGAL_PARAMETER,
+ String.format(
+ "Illegal seriesPath %s, seriesPath of system permission must be
'root.**'", path));
+ }
+ }
+
public static void validatePatternPath(PartialPath path) throws
AuthException {
if (!path.hasWildcard()) {
return;
@@ -182,36 +191,28 @@ public class AuthUtils {
public static void validatePrivilege(PartialPath path, int privilegeId)
throws AuthException {
validatePrivilege(privilegeId);
PrivilegeType type = PrivilegeType.values()[privilegeId];
- if (path != null) {
- validatePath(path);
- switch (type) {
- case READ_SCHEMA:
- case WRITE_SCHEMA:
- case READ_DATA:
- case WRITE_DATA:
- return;
- default:
- throw new AuthException(
- TSStatusCode.UNKNOWN_AUTH_PRIVILEGE,
- String.format("Illegal privilege %s on seriesPath", type));
- }
- } else {
- switch (type) {
- case MANAGE_DATABASE:
- case MANAGE_USER:
- case MANAGE_ROLE:
- case USE_TRIGGER:
- case USE_CQ:
- case USE_PIPE:
- case USE_UDF:
- case EXTEND_TEMPLATE:
- case MAINTAIN:
- case AUDIT:
- return;
- default:
- throw new AuthException(
- TSStatusCode.UNKNOWN_AUTH_PRIVILEGE, String.format("Illegal
privilege %s", type));
- }
+ switch (type) {
+ case READ_SCHEMA:
+ case WRITE_SCHEMA:
+ case READ_DATA:
+ case WRITE_DATA:
+ validatePath(path);
+ return;
+ case MANAGE_DATABASE:
+ case MANAGE_USER:
+ case MANAGE_ROLE:
+ case USE_TRIGGER:
+ case USE_CQ:
+ case USE_PIPE:
+ case USE_UDF:
+ case EXTEND_TEMPLATE:
+ case MAINTAIN:
+ case AUDIT:
+ validateSystemPermissionPath(path.getFullPath());
+ return;
+ default:
+ throw new AuthException(
+ TSStatusCode.UNKNOWN_AUTH_PRIVILEGE, String.format("Illegal
privilege %s", type));
}
}
