This is an automated email from the ASF dual-hosted git repository.
shuwenwei pushed a commit to branch AuthEnhance
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/AuthEnhance by this push:
new 4988039cd6e add it
4988039cd6e is described below
commit 4988039cd6e1953419115ce1cb1ee1a9f74e4662
Author: shuwenwei <[email protected]>
AuthorDate: Thu Sep 18 12:06:53 2025 +0800
add it
---
.../org/apache/iotdb/db/it/auth/IoTDBAuthIT.java | 71 ++++++++++++++++++++++
.../iotdb/db/it/auth/IoTDBClusterAuthorityIT.java | 17 +++---
2 files changed, 81 insertions(+), 7 deletions(-)
diff --git
a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
index 4fe7849e769..095ea86c6b6 100644
---
a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
+++
b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
@@ -94,6 +94,16 @@ public class IoTDBAuthIT {
Assert.assertThrows(
SQLException.class,
() -> userStmt.execute("GRANT WRITE_SCHEMA ON root.a TO USER
tempuser"));
+ Assert.assertThrows(
+ SQLException.class, () -> userStmt.execute("LIST PRIVILEGES OF
USER root"));
+
+ ResultSet resultSet = userStmt.executeQuery("LIST USER");
+ Assert.assertTrue(resultSet.next());
+ Assert.assertEquals("tempuser", resultSet.getString(1));
+ Assert.assertFalse(resultSet.next());
+
+ resultSet = userStmt.executeQuery("LIST PRIVILEGES OF USER tempuser");
+ Assert.assertFalse(resultSet.next());
// 2. admin grant all privileges to user tempuser, So tempuser can do
anything.
adminStmt.execute("GRANT ALL ON root.** TO USER tempuser");
@@ -1586,4 +1596,65 @@ public class IoTDBAuthIT {
fail(e.getMessage());
}
}
+
+ @Test
+ public void testSecurityPrivilege() {
+ try (Connection connection = EnvFactory.getEnv().getConnection();
+ Statement statement = connection.createStatement()) {
+ statement.execute("CREATE USER security_user 'abcdef123456'");
+ statement.execute("CREATE USER common_user 'abcdef123456'");
+ try (Connection userCon =
EnvFactory.getEnv().getConnection("security_user", "abcdef123456");
+ Statement userStatement = userCon.createStatement()) {
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.execute("GRANT SYSTEM ON root.** TO USER
common_user"));
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.execute("REVOKE SYSTEM ON root.** FROM USER
common_user"));
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.executeQuery("LIST PRIVILEGES OF USER
common_user"));
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.execute("CREATE USER common_user2
'abcdef123456'"));
+ Assert.assertThrows(
+ SQLException.class, () -> userStatement.execute("CREATE ROLE
common_role"));
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.execute("GRANT SYSTEM ON root.** TO ROLE
common_role"));
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.execute("REVOKE SYSTEM ON root.** FROM ROLE
common_role"));
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.execute("GRANT ROLE common_role TO
common_user"));
+ Assert.assertThrows(
+ SQLException.class,
+ () -> userStatement.execute("REVOKE ROLE common_role FROM
common_user"));
+ Assert.assertThrows(
+ SQLException.class, () -> userStatement.execute("DROP USER
common_user2"));
+ Assert.assertThrows(
+ SQLException.class, () -> userStatement.execute("DROP ROLE
common_role"));
+ }
+ statement.execute("GRANT SECURITY ON root.** TO USER security_user");
+ try (Connection userCon =
EnvFactory.getEnv().getConnection("security_user", "abcdef123456");
+ Statement userStatement = userCon.createStatement()) {
+ userStatement.execute("GRANT SYSTEM ON root.** TO USER common_user");
+ userStatement.execute("REVOKE SYSTEM ON root.** FROM USER
common_user");
+ ResultSet resultSet = userStatement.executeQuery("LIST PRIVILEGES OF
USER common_user");
+ Assert.assertFalse(resultSet.next());
+ userStatement.execute("CREATE USER common_user2 'abcdef123456'");
+ userStatement.execute("CREATE ROLE common_role");
+ userStatement.execute("GRANT SYSTEM ON root.** TO ROLE common_role");
+ userStatement.execute("REVOKE SYSTEM ON root.** FROM ROLE
common_role");
+ userStatement.execute("GRANT ROLE common_role TO common_user");
+ userStatement.execute("REVOKE ROLE common_role FROM common_user");
+ userStatement.execute("DROP USER common_user2");
+ userStatement.execute("DROP ROLE common_role");
+ }
+ } catch (SQLException e) {
+ e.printStackTrace();
+ fail(e.getMessage());
+ }
+ }
}
diff --git
a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBClusterAuthorityIT.java
b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBClusterAuthorityIT.java
index b867160dd45..cbaa0690114 100644
---
a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBClusterAuthorityIT.java
+++
b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBClusterAuthorityIT.java
@@ -465,16 +465,19 @@ public class IoTDBClusterAuthorityIT {
.size());
assertEquals(
PrivilegeType.getPrivilegeCount(PrivilegeModelType.SYSTEM),
-
authorizerResp.getPermissionInfo().getUserInfo().getPermissionInfo().getSysPriSet().size()
- + 3);
+ authorizerResp
+ .getPermissionInfo()
+ .getUserInfo()
+ .getPermissionInfo()
+ .getSysPriSet()
+ .size());
assertEquals(
PrivilegeType.getPrivilegeCount(PrivilegeModelType.SYSTEM),
authorizerResp
- .getPermissionInfo()
- .getUserInfo()
- .getPermissionInfo()
- .getSysPriSetGrantOptSize()
- + 3);
+ .getPermissionInfo()
+ .getUserInfo()
+ .getPermissionInfo()
+ .getSysPriSetGrantOptSize());
authorizerReq =
new TAuthorizerReq(
