This is an automated email from the ASF dual-hosted git repository. jackietien pushed a commit to branch Auth-2 in repository https://gitbox.apache.org/repos/asf/iotdb.git
commit b5b720f4c23aafb5c6b7b03ca5ade1be5ea9f3d0 Author: JackieTien97 <[email protected]> AuthorDate: Mon Sep 22 18:34:58 2025 +0800 Add auth check for show related --- .../InformationSchemaContentSupplierFactory.java | 40 +++++----- .../execution/config/TableConfigTaskVisitor.java | 92 +++++++++++----------- .../plan/relational/security/AccessControl.java | 11 ++- .../relational/security/AccessControlImpl.java | 68 ++++++++-------- .../relational/security/AllowAllAccessControl.java | 9 +-- .../relational/security/ITableAuthCheckerImpl.java | 5 +- 6 files changed, 112 insertions(+), 113 deletions(-) diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/execution/operator/source/relational/InformationSchemaContentSupplierFactory.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/execution/operator/source/relational/InformationSchemaContentSupplierFactory.java index f13092cbe60..868c1a2feb4 100644 --- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/execution/operator/source/relational/InformationSchemaContentSupplierFactory.java +++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/execution/operator/source/relational/InformationSchemaContentSupplierFactory.java @@ -143,9 +143,9 @@ public class InformationSchemaContentSupplierFactory { case InformationSchema.PIPE_PLUGINS: return new PipePluginSupplier(dataTypes); case InformationSchema.TOPICS: - return new TopicSupplier(dataTypes, userEntity.getUsername()); + return new TopicSupplier(dataTypes, userEntity); case InformationSchema.SUBSCRIPTIONS: - return new SubscriptionSupplier(dataTypes, userEntity.getUsername()); + return new SubscriptionSupplier(dataTypes, userEntity); case InformationSchema.VIEWS: return new ViewsSupplier(dataTypes, userEntity); case InformationSchema.MODELS: @@ -153,15 +153,15 @@ public class InformationSchemaContentSupplierFactory { case InformationSchema.FUNCTIONS: return new FunctionsSupplier(dataTypes); case InformationSchema.CONFIGURATIONS: - return new ConfigurationsSupplier(dataTypes, userEntity.getUsername()); + return new ConfigurationsSupplier(dataTypes, userEntity); case InformationSchema.KEYWORDS: return new KeywordsSupplier(dataTypes); case InformationSchema.NODES: - return new NodesSupplier(dataTypes, userEntity.getUsername()); + return new NodesSupplier(dataTypes, userEntity); case InformationSchema.CONFIG_NODES: - return new ConfigNodesSupplier(dataTypes, userEntity.getUsername()); + return new ConfigNodesSupplier(dataTypes, userEntity); case InformationSchema.DATA_NODES: - return new DataNodesSupplier(dataTypes, userEntity.getUsername()); + return new DataNodesSupplier(dataTypes, userEntity); default: throw new UnsupportedOperationException("Unknown table: " + tableName); } @@ -181,7 +181,7 @@ public class InformationSchemaContentSupplierFactory { super(dataTypes); queryExecutions = Coordinator.getInstance().getAllQueryExecutions(); try { - accessControl.checkUserGlobalSysPrivilege(userEntity.getUsername(), userEntity); + accessControl.checkUserGlobalSysPrivilege(userEntity); } catch (final AccessDeniedException e) { queryExecutions = queryExecutions.stream() @@ -490,7 +490,7 @@ public class InformationSchemaContentSupplierFactory { private RegionSupplier(final List<TSDataType> dataTypes, final UserEntity userEntity) throws Exception { super(dataTypes); - accessControl.checkUserIsAdmin(userEntity.getUsername()); + accessControl.checkUserGlobalSysPrivilege(userEntity); try (final ConfigNodeClient client = ConfigNodeClientManager.getInstance().borrowClient(ConfigNodeInfo.CONFIG_REGION_ID)) { iterator = @@ -640,10 +640,10 @@ public class InformationSchemaContentSupplierFactory { private static class TopicSupplier extends TsBlockSupplier { private final Iterator<TShowTopicInfo> iterator; - private TopicSupplier(final List<TSDataType> dataTypes, final String userName) + private TopicSupplier(final List<TSDataType> dataTypes, final UserEntity userEntity) throws Exception { super(dataTypes); - accessControl.checkUserIsAdmin(userName); + accessControl.checkUserGlobalSysPrivilege(userEntity); try (final ConfigNodeClient client = ConfigNodeClientManager.getInstance().borrowClient(ConfigNodeInfo.CONFIG_REGION_ID)) { iterator = @@ -673,10 +673,10 @@ public class InformationSchemaContentSupplierFactory { private static class SubscriptionSupplier extends TsBlockSupplier { private final Iterator<TShowSubscriptionInfo> iterator; - private SubscriptionSupplier(final List<TSDataType> dataTypes, final String userName) + private SubscriptionSupplier(final List<TSDataType> dataTypes, final UserEntity userEntity) throws Exception { super(dataTypes); - accessControl.checkUserIsAdmin(userName); + accessControl.checkUserGlobalSysPrivilege(userEntity); try (final ConfigNodeClient client = ConfigNodeClientManager.getInstance().borrowClient(ConfigNodeInfo.CONFIG_REGION_ID)) { iterator = @@ -955,10 +955,10 @@ public class InformationSchemaContentSupplierFactory { private static class ConfigurationsSupplier extends TsBlockSupplier { private final Iterator<Pair<Binary, Binary>> resultIterator; - private ConfigurationsSupplier(final List<TSDataType> dataTypes, final String userName) + private ConfigurationsSupplier(final List<TSDataType> dataTypes, final UserEntity userEntity) throws Exception { super(dataTypes); - accessControl.checkUserIsAdmin(userName); + accessControl.checkUserGlobalSysPrivilege(userEntity); try (final ConfigNodeClient client = ConfigNodeClientManager.getInstance().borrowClient(ConfigNodeInfo.CONFIG_REGION_ID)) { final TClusterParameters parameters = client.showVariables().getClusterParameters(); @@ -1062,10 +1062,10 @@ public class InformationSchemaContentSupplierFactory { private final Iterator<TDataNodeLocation> dataNodeIterator; private final Iterator<TAINodeLocation> aiNodeIterator; - private NodesSupplier(final List<TSDataType> dataTypes, final String userName) + private NodesSupplier(final List<TSDataType> dataTypes, final UserEntity userEntity) throws Exception { super(dataTypes); - accessControl.checkUserIsAdmin(userName); + accessControl.checkUserGlobalSysPrivilege(userEntity); try (final ConfigNodeClient client = ConfigNodeClientManager.getInstance().borrowClient(ConfigNodeInfo.CONFIG_REGION_ID)) { showClusterResp = client.showCluster(); @@ -1156,10 +1156,10 @@ public class InformationSchemaContentSupplierFactory { private static class ConfigNodesSupplier extends TsBlockSupplier { private final Iterator<TConfigNodeInfo4InformationSchema> configNodeIterator; - private ConfigNodesSupplier(final List<TSDataType> dataTypes, final String userName) + private ConfigNodesSupplier(final List<TSDataType> dataTypes, final UserEntity userEntity) throws Exception { super(dataTypes); - accessControl.checkUserIsAdmin(userName); + accessControl.checkUserGlobalSysPrivilege(userEntity); try (final ConfigNodeClient client = ConfigNodeClientManager.getInstance().borrowClient(ConfigNodeInfo.CONFIG_REGION_ID)) { configNodeIterator = @@ -1187,10 +1187,10 @@ public class InformationSchemaContentSupplierFactory { private static class DataNodesSupplier extends TsBlockSupplier { private final Iterator<TDataNodeInfo4InformationSchema> dataNodeIterator; - private DataNodesSupplier(final List<TSDataType> dataTypes, final String userName) + private DataNodesSupplier(final List<TSDataType> dataTypes, final UserEntity userEntity) throws Exception { super(dataTypes); - accessControl.checkUserIsAdmin(userName); + accessControl.checkUserGlobalSysPrivilege(userEntity); try (final ConfigNodeClient client = ConfigNodeClientManager.getInstance().borrowClient(ConfigNodeInfo.CONFIG_REGION_ID)) { dataNodeIterator = client.showDataNodes4InformationSchema().getDataNodesInfoListIterator(); diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/TableConfigTaskVisitor.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/TableConfigTaskVisitor.java index 610089c039c..3ec8fa9ff4d 100644 --- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/TableConfigTaskVisitor.java +++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/TableConfigTaskVisitor.java @@ -415,7 +415,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitShowCluster( final ShowCluster showCluster, final MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. ShowClusterStatement treeStatement = new ShowClusterStatement(); @@ -427,7 +427,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitShowRegions( final ShowRegions showRegions, final MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. final ShowRegionStatement treeStatement = new ShowRegionStatement(); @@ -444,7 +444,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitRemoveDataNode( final RemoveDataNode removeDataNode, final MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. final RemoveDataNodeStatement treeStatement = @@ -456,7 +456,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitRemoveConfigNode( final RemoveConfigNode removeConfigNode, final MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. final RemoveConfigNodeStatement treeStatement = @@ -468,7 +468,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitRemoveAINode( final RemoveAINode removeAINode, final MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. return new RemoveAINodeTask(new RemoveAINodeStatement()); @@ -478,7 +478,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitShowDataNodes( final ShowDataNodes showDataNodesStatement, final MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowDataNodesTask(); } @@ -486,7 +486,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitShowConfigNodes( final ShowConfigNodes showConfigNodesStatement, final MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowConfigNodesTask(); } @@ -494,7 +494,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitShowAINodes( final ShowAINodes showAINodesStatement, final MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowAINodesTask(); } @@ -502,7 +502,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitClearCache( final ClearCache clearCacheStatement, final MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ClearCacheTask(clearCacheStatement); } @@ -517,8 +517,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitCreateView(final CreateView node, final MPPQueryContext context) { final Pair<String, TsTable> databaseTablePair = parseTable4CreateTableOrView(node, context); final TsTable table = databaseTablePair.getRight(); - accessControl.checkCanCreateViewFromTreePath( - context.getSession().getUserName(), node.getPrefixPath(), context); + accessControl.checkCanCreateViewFromTreePath(node.getPrefixPath(), context); final String msg = TreeViewSchema.setPathPattern(table, node.getPrefixPath()); if (Objects.nonNull(msg)) { throw new SemanticException(msg); @@ -933,7 +932,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitFlush(final Flush node, final MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new FlushTask(((FlushStatement) node.getInnerTreeStatement())); } @@ -970,28 +969,28 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitStartRepairData(StartRepairData node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new StartRepairDataTask(((StartRepairDataStatement) node.getInnerTreeStatement())); } @Override protected IConfigTask visitStopRepairData(StopRepairData node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new StopRepairDataTask(((StopRepairDataStatement) node.getInnerTreeStatement())); } @Override protected IConfigTask visitLoadConfiguration(LoadConfiguration node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserIsAdmin(context.getSession().getUserName()); + accessControl.checkUserIsAdmin(context.getSession().getUserEntity()); return new LoadConfigurationTask(((LoadConfigurationStatement) node.getInnerTreeStatement())); } @Override protected IConfigTask visitSetSystemStatus(SetSystemStatus node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new SetSystemStatusTask(((SetSystemStatusStatement) node.getInnerTreeStatement())); } @@ -1043,7 +1042,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitCreatePipe(final CreatePipe node, final MPPQueryContext context) { context.setQueryType(QueryType.WRITE); final String userName = context.getSession().getUserName(); - accessControl.checkUserGlobalSysPrivilege(userName, context); + accessControl.checkUserGlobalSysPrivilege(context); final Map<String, String> extractorAttributes = node.getExtractorAttributes(); final String pipeName = node.getPipeName(); @@ -1192,7 +1191,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont context.setQueryType(QueryType.WRITE); final String userName = context.getSession().getUserName(); - accessControl.checkUserGlobalSysPrivilege(userName, context); + accessControl.checkUserGlobalSysPrivilege(context); final String pipeName = node.getPipeName(); final Map<String, String> extractorAttributes = node.getExtractorAttributes(); @@ -1237,35 +1236,35 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitDropPipe(DropPipe node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new DropPipeTask(node); } @Override protected IConfigTask visitStartPipe(StartPipe node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new StartPipeTask(node); } @Override protected IConfigTask visitStopPipe(StopPipe node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new StopPipeTask(node); } @Override protected IConfigTask visitShowPipes(ShowPipes node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowPipeTask(node, context.getSession().getUserName()); } @Override protected IConfigTask visitCreatePipePlugin(CreatePipePlugin node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); if (node.getUriString() != null && isUriTrusted(node.getUriString())) { // 1. user specified uri and that uri is trusted // 2. user doesn't specify uri @@ -1279,21 +1278,21 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitDropPipePlugin(DropPipePlugin node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new DropPipePluginTask(node); } @Override protected IConfigTask visitShowPipePlugins(ShowPipePlugins node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowPipePluginsTask(node); } @Override protected IConfigTask visitCreateTopic(CreateTopic node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // Inject table model into the topic attributes node.getTopicAttributes() @@ -1305,28 +1304,28 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitDropTopic(DropTopic node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new DropTopicTask(node); } @Override protected IConfigTask visitShowTopics(ShowTopics node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowTopicsTask(node); } @Override protected IConfigTask visitShowSubscriptions(ShowSubscriptions node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowSubscriptionsTask(node); } @Override protected IConfigTask visitDropSubscription(DropSubscription node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new DropSubscriptionTask(node); } @@ -1359,21 +1358,21 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitShowVersion(ShowVersion node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowVersionTask(); } @Override protected IConfigTask visitShowVariables(ShowVariables node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowVariablesTask(); } @Override protected IConfigTask visitShowClusterId(ShowClusterId node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowClusterIdTask(); } @@ -1413,7 +1412,8 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitKillQuery(KillQuery node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); String allowedUsername = context.getSession().getUserName(); - if (accessControl.hasGlobalPrivilege(allowedUsername, PrivilegeType.SYSTEM)) { + if (accessControl.hasGlobalPrivilege( + context.getSession().getUserEntity(), PrivilegeType.SYSTEM)) { allowedUsername = null; } return new KillQueryTask(node, allowedUsername); @@ -1422,7 +1422,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitCreateFunction(CreateFunction node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); if (node.getUriString().map(ExecutableManager::isUriTrusted).orElse(true)) { // 1. user specified uri and that uri is trusted // 2. user doesn't specify uri @@ -1442,14 +1442,14 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitDropFunction(DropFunction node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new DropFunctionTask(Model.TABLE, node.getUdfName()); } @Override protected IConfigTask visitMigrateRegion(MigrateRegion migrateRegion, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. return new MigrateRegionTask(migrateRegion); @@ -1459,7 +1459,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont protected IConfigTask visitReconstructRegion( ReconstructRegion reconstructRegion, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. return new ReconstructRegionTask(reconstructRegion); @@ -1468,7 +1468,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitExtendRegion(ExtendRegion extendRegion, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. return new ExtendRegionTask(extendRegion); @@ -1477,7 +1477,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitRemoveRegion(RemoveRegion removeRegion, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); // As the implementation is identical, we'll simply translate to the // corresponding tree-model variant and execute that. return new RemoveRegionTask(removeRegion); @@ -1486,7 +1486,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitCreateTraining(CreateTraining node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new CreateTrainingTask( node.getModelId(), node.getParameters(), node.getExistingModelId(), node.getTargetSql()); } @@ -1494,7 +1494,7 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitCreateModel(CreateModel node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); String uri = node.getUri(); if (uri != null && ExecutableManager.isUriTrusted(uri)) { // user specified uri and that uri is trusted @@ -1513,14 +1513,14 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitDropModel(DropModel node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new DropModelTask(node.getModelId()); } @Override protected IConfigTask visitShowLoadedModels(ShowLoadedModels node, MPPQueryContext context) { context.setQueryType(QueryType.READ); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new ShowLoadedModelsTask(node.getDeviceIdList()); } @@ -1533,14 +1533,14 @@ public class TableConfigTaskVisitor extends AstVisitor<IConfigTask, MPPQueryCont @Override protected IConfigTask visitLoadModel(LoadModel node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new LoadModelTask(node.getModelId(), node.getDeviceIdList()); } @Override protected IConfigTask visitUnloadModel(UnloadModel node, MPPQueryContext context) { context.setQueryType(QueryType.WRITE); - accessControl.checkUserGlobalSysPrivilege(context.getSession().getUserName(), context); + accessControl.checkUserGlobalSysPrivilege(context); return new UnloadModelTask(node.getModelId(), node.getDeviceIdList()); } } diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControl.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControl.java index 460d7e994fa..3f049c1c6cf 100644 --- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControl.java +++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControl.java @@ -175,8 +175,7 @@ public interface AccessControl { * @param auditEntity records necessary info for audit log * @throws AccessDeniedException if not allowed */ - void checkCanCreateViewFromTreePath( - final String userName, final PartialPath path, IAuditEntity auditEntity); + void checkCanCreateViewFromTreePath(final PartialPath path, IAuditEntity auditEntity); /** * Check if user can run relational author statement. @@ -191,10 +190,10 @@ public interface AccessControl { /** * Check if user is admin user * - * @param userName name of user + * @param auditEntity name of user * @throws AccessDeniedException if not allowed */ - void checkUserIsAdmin(String userName); + void checkUserIsAdmin(IAuditEntity auditEntity); /** * Check if user has global SYSTEM privilege @@ -203,7 +202,7 @@ public interface AccessControl { * @param auditEntity records necessary info for audit log * @throws AccessDeniedException if not allowed */ - void checkUserGlobalSysPrivilege(String userName, IAuditEntity auditEntity); + void checkUserGlobalSysPrivilege(IAuditEntity auditEntity); /** * Check if user has sepecified global privilege @@ -212,7 +211,7 @@ public interface AccessControl { * @param privilegeType needed privilege * @throws AccessDeniedException if not allowed */ - boolean hasGlobalPrivilege(String userName, PrivilegeType privilegeType); + boolean hasGlobalPrivilege(IAuditEntity auditEntity, PrivilegeType privilegeType); void checkMissingPrivileges( String username, Collection<PrivilegeType> privilegeTypes, IAuditEntity auditEntity); diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControlImpl.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControlImpl.java index 0eae29b5823..a410d988842 100644 --- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControlImpl.java +++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AccessControlImpl.java @@ -109,7 +109,7 @@ public class AccessControlImpl implements AccessControl { return; } checkAuditDatabase(tableName.getDatabaseName()); - if (hasGlobalPrivilege(userName, PrivilegeType.SYSTEM)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SYSTEM)) { return; } authChecker.checkTablePrivilege(userName, tableName, TableModelPrivilege.CREATE, auditEntity); @@ -120,7 +120,7 @@ public class AccessControlImpl implements AccessControl { String userName, QualifiedObjectName tableName, IAuditEntity auditEntity) { InformationSchemaUtils.checkDBNameInWrite(tableName.getDatabaseName()); checkAuditDatabase(tableName.getDatabaseName()); - if (hasGlobalPrivilege(userName, PrivilegeType.SYSTEM)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SYSTEM)) { return; } authChecker.checkTablePrivilege(userName, tableName, TableModelPrivilege.DROP, auditEntity); @@ -131,7 +131,7 @@ public class AccessControlImpl implements AccessControl { String userName, QualifiedObjectName tableName, IAuditEntity auditEntity) { InformationSchemaUtils.checkDBNameInWrite(tableName.getDatabaseName()); checkAuditDatabase(tableName.getDatabaseName()); - if (hasGlobalPrivilege(userName, PrivilegeType.SYSTEM)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SYSTEM)) { return; } authChecker.checkTablePrivilege(userName, tableName, TableModelPrivilege.ALTER, auditEntity); @@ -157,7 +157,7 @@ public class AccessControlImpl implements AccessControl { return; } if (TABLE_MODEL_AUDIT_DATABASE.equalsIgnoreCase(tableName.getDatabaseName())) { - checkCanSelectAuditTable(userName, auditEntity); + checkCanSelectAuditTable(auditEntity); } else { authChecker.checkTablePrivilege(userName, tableName, TableModelPrivilege.SELECT, auditEntity); } @@ -199,20 +199,19 @@ public class AccessControlImpl implements AccessControl { } @Override - public void checkCanCreateViewFromTreePath( - final String userName, final PartialPath path, IAuditEntity auditEntity) { - if (AuthorityChecker.SUPER_USER.equals(userName)) { + public void checkCanCreateViewFromTreePath(final PartialPath path, IAuditEntity auditEntity) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } if (includeByAuditTreeDB(path)) { - checkCanSelectAuditTable(userName, auditEntity); + checkCanSelectAuditTable(auditEntity); } TSStatus status = AuthorityChecker.getTSStatus( AuthorityChecker.checkFullPathOrPatternPermission( - userName, path, PrivilegeType.READ_SCHEMA), + auditEntity.getUsername(), path, PrivilegeType.READ_SCHEMA), PrivilegeType.READ_SCHEMA); if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) { throw new AccessDeniedException(status.getMessage()); @@ -221,7 +220,7 @@ public class AccessControlImpl implements AccessControl { status = AuthorityChecker.getTSStatus( AuthorityChecker.checkFullPathOrPatternPermission( - userName, path, PrivilegeType.READ_DATA), + auditEntity.getUsername(), path, PrivilegeType.READ_DATA), PrivilegeType.READ_DATA); if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) { throw new AccessDeniedException(status.getMessage()); @@ -234,53 +233,53 @@ public class AccessControlImpl implements AccessControl { AuthorRType type = statement.getAuthorType(); switch (type) { case CREATE_USER: - if (AuthorityChecker.SUPER_USER.equals(userName)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_USER, auditEntity); return; case DROP_USER: - if (AuthorityChecker.SUPER_USER.equals(userName)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_USER, auditEntity); return; case UPDATE_USER: case LIST_USER_PRIV: - if (AuthorityChecker.SUPER_USER.equals(userName) + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId() || statement.getUserName().equals(userName)) { return; } authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_USER, auditEntity); return; case LIST_USER: - if (!hasGlobalPrivilege(userName, PrivilegeType.MANAGE_USER)) { + if (!hasGlobalPrivilege(auditEntity, PrivilegeType.MANAGE_USER)) { statement.setUserName(userName); } return; case CREATE_ROLE: - if (AuthorityChecker.SUPER_USER.equals(userName)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_ROLE, auditEntity); return; case DROP_ROLE: - if (AuthorityChecker.SUPER_USER.equals(userName)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_ROLE, auditEntity); return; case GRANT_USER_ROLE: - if (AuthorityChecker.SUPER_USER.equals(userName)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_ROLE, auditEntity); return; case REVOKE_USER_ROLE: - if (AuthorityChecker.SUPER_USER.equals(userName)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_ROLE, auditEntity); @@ -290,12 +289,12 @@ public class AccessControlImpl implements AccessControl { authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.MANAGE_ROLE, auditEntity); return; } - if (!hasGlobalPrivilege(userName, PrivilegeType.MANAGE_ROLE)) { + if (!hasGlobalPrivilege(auditEntity, PrivilegeType.MANAGE_ROLE)) { statement.setUserName(userName); } return; case LIST_ROLE_PRIV: - if (AuthorityChecker.SUPER_USER.equals(userName)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } if (AuthorityChecker.checkRole(userName, statement.getRoleName())) { @@ -307,7 +306,7 @@ public class AccessControlImpl implements AccessControl { case GRANT_USER_ANY: case REVOKE_ROLE_ANY: case REVOKE_USER_ANY: - if (hasGlobalPrivilege(userName, PrivilegeType.SECURITY)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SECURITY)) { return; } for (PrivilegeType privilegeType : statement.getPrivilegeTypes()) { @@ -319,7 +318,7 @@ public class AccessControlImpl implements AccessControl { case REVOKE_ROLE_ALL: case GRANT_USER_ALL: case REVOKE_USER_ALL: - if (hasGlobalPrivilege(userName, PrivilegeType.SECURITY)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SECURITY)) { return; } for (TableModelPrivilege privilege : TableModelPrivilege.values()) { @@ -336,7 +335,7 @@ public class AccessControlImpl implements AccessControl { case GRANT_ROLE_DB: case REVOKE_USER_DB: case REVOKE_ROLE_DB: - if (hasGlobalPrivilege(userName, PrivilegeType.SECURITY)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SECURITY)) { return; } for (PrivilegeType privilegeType : statement.getPrivilegeTypes()) { @@ -351,7 +350,7 @@ public class AccessControlImpl implements AccessControl { case GRANT_ROLE_TB: case REVOKE_USER_TB: case REVOKE_ROLE_TB: - if (hasGlobalPrivilege(userName, PrivilegeType.SECURITY)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SECURITY)) { return; } for (PrivilegeType privilegeType : statement.getPrivilegeTypes()) { @@ -367,7 +366,7 @@ public class AccessControlImpl implements AccessControl { case GRANT_ROLE_SYS: case REVOKE_USER_SYS: case REVOKE_ROLE_SYS: - if (hasGlobalPrivilege(userName, PrivilegeType.SECURITY)) { + if (hasGlobalPrivilege(auditEntity, PrivilegeType.SECURITY)) { return; } for (PrivilegeType privilegeType : statement.getPrivilegeTypes()) { @@ -381,29 +380,30 @@ public class AccessControlImpl implements AccessControl { } @Override - public void checkUserIsAdmin(String userName) { - if (!AuthorityChecker.SUPER_USER.equals(userName)) { + public void checkUserIsAdmin(IAuditEntity entity) { + if (AuthorityChecker.SUPER_USER_ID != entity.getUserId()) { throw new AccessDeniedException(ONLY_ADMIN_ALLOWED); } } @Override - public void checkUserGlobalSysPrivilege(String userName, IAuditEntity auditEntity) { - if (!AuthorityChecker.SUPER_USER.equals(userName)) { - authChecker.checkGlobalPrivilege(userName, TableModelPrivilege.SYSTEM, auditEntity); + public void checkUserGlobalSysPrivilege(IAuditEntity auditEntity) { + if (AuthorityChecker.SUPER_USER_ID != auditEntity.getUserId()) { + authChecker.checkGlobalPrivilege( + auditEntity.getUsername(), TableModelPrivilege.SYSTEM, auditEntity); } } @Override - public boolean hasGlobalPrivilege(String userName, PrivilegeType privilegeType) { - return AuthorityChecker.SUPER_USER.equals(userName) - || AuthorityChecker.checkSystemPermission(userName, privilegeType); + public boolean hasGlobalPrivilege(IAuditEntity entity, PrivilegeType privilegeType) { + return AuthorityChecker.SUPER_USER_ID == entity.getUserId() + || AuthorityChecker.checkSystemPermission(entity.getUsername(), privilegeType); } @Override public void checkMissingPrivileges( String username, Collection<PrivilegeType> privilegeTypes, IAuditEntity auditEntity) { - if (AuthorityChecker.SUPER_USER.equals(username)) { + if (AuthorityChecker.SUPER_USER_ID == auditEntity.getUserId()) { return; } authChecker.checkGlobalPrivileges(username, privilegeTypes, auditEntity); diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AllowAllAccessControl.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AllowAllAccessControl.java index 9349cc3dd88..d7a7f680d3e 100644 --- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AllowAllAccessControl.java +++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/AllowAllAccessControl.java @@ -89,23 +89,22 @@ public class AllowAllAccessControl implements AccessControl { String userName, QualifiedObjectName tableName, IAuditEntity auditEntity) {} @Override - public void checkCanCreateViewFromTreePath( - String userName, PartialPath path, IAuditEntity auditEntity) {} + public void checkCanCreateViewFromTreePath(PartialPath path, IAuditEntity auditEntity) {} @Override public void checkUserCanRunRelationalAuthorStatement( String userName, RelationalAuthorStatement statement, IAuditEntity auditEntity) {} @Override - public void checkUserIsAdmin(String userName) { + public void checkUserIsAdmin(IAuditEntity entity) { // allow anything } @Override - public void checkUserGlobalSysPrivilege(String userName, IAuditEntity auditEntity) {} + public void checkUserGlobalSysPrivilege(IAuditEntity auditEntity) {} @Override - public boolean hasGlobalPrivilege(String userName, PrivilegeType privilegeType) { + public boolean hasGlobalPrivilege(IAuditEntity entity, PrivilegeType privilegeType) { return true; } diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java index 983778066e1..042eb47481d 100644 --- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java +++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java @@ -177,8 +177,9 @@ public class ITableAuthCheckerImpl implements ITableAuthChecker { } } - public static void checkCanSelectAuditTable(String userName, IAuditEntity auditEntity) { - if (!AuthorityChecker.SUPER_USER.equals(userName) + public static void checkCanSelectAuditTable(IAuditEntity auditEntity) { + String userName = auditEntity.getUsername(); + if (AuthorityChecker.SUPER_USER_ID != auditEntity.getUserId() && !AuthorityChecker.checkSystemPermission(userName, PrivilegeType.AUDIT)) { recordAuditLog( auditEntity
