(incubator-streampark) branch dev-2.1.4 updated: [Improve] api access permission improvement

[benjobs]

This is an automated email from the ASF dual-hosted git repository.

benjobs pushed a commit to branch dev-2.1.4
in repository https://gitbox.apache.org/repos/asf/incubator-streampark.git


The following commit(s) were added to refs/heads/dev-2.1.4 by this push:
     new 076f3b63b [Improve] api access permission improvement
076f3b63b is described below

commit 076f3b63b4d10f8a2520ff631f7e2f68ca315dcb
Author: benjobs <benj...@gmail.com>
AuthorDate: Tue Apr 16 14:38:18 2024 +0800

    [Improve] api access permission improvement
---
 .../streampark/console/core/controller/FlinkSqlController.java       | 2 +-
 .../streampark/console/system/controller/AccessTokenController.java  | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git 
a/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/core/controller/FlinkSqlController.java
 
b/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/core/controller/FlinkSqlController.java
index 3abef9bcf..3ea82241f 100644
--- 
a/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/core/controller/FlinkSqlController.java
+++ 
b/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/core/controller/FlinkSqlController.java
@@ -121,7 +121,7 @@ public class FlinkSqlController {
 
   @Operation(summary = "List the applications sql histories")
   @PostMapping("history")
-  @PermissionScope(app = "#app.id", team = "app.teamId")
+  @PermissionScope(app = "#app.id", team = "#app.teamId")
   public RestResponse sqlhistory(Application app) {
     List<FlinkSql> sqlList = flinkSqlService.history(app);
     return RestResponse.success(sqlList);
diff --git 
a/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/controller/AccessTokenController.java
 
b/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/controller/AccessTokenController.java
index 81b9fe928..62434c62b 100644
--- 
a/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/controller/AccessTokenController.java
+++ 
b/streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/system/controller/AccessTokenController.java
@@ -21,6 +21,7 @@ import org.apache.streampark.common.util.CURLBuilder;
 import org.apache.streampark.console.base.domain.RestRequest;
 import org.apache.streampark.console.base.domain.RestResponse;
 import org.apache.streampark.console.base.exception.InternalException;
+import org.apache.streampark.console.core.annotation.PermissionScope;
 import org.apache.streampark.console.core.enums.AccessTokenState;
 import org.apache.streampark.console.core.service.ServiceHelper;
 import org.apache.streampark.console.system.entity.AccessToken;
@@ -152,9 +153,11 @@ public class AccessTokenController {
    * fixed interfaces
    */
   @Operation(summary = "Generate api with token")
+  @PermissionScope(app = "#appId", team = "#teamId")
   @PostMapping(value = "curl")
   public RestResponse copyRestApiCurl(
       @NotBlank(message = "{required}") String appId,
+      @NotBlank(message = "{required}") String teamId,
       @NotBlank(message = "{required}") String baseUrl,
       @NotBlank(message = "{required}") String path) {
     String resultCURL = null;
@@ -171,12 +174,14 @@ public class AccessTokenController {
               .addFormData("allowNonRestored", "false")
               .addFormData("savePoint", "")
               .addFormData("savePointed", "false")
+              .addFormData("teamId", teamId)
               .addFormData("id", appId)
               .build();
     } else if ("/flink/app/cancel".equalsIgnoreCase(path)) {
       resultCURL =
           curlBuilder
               .addFormData("id", appId)
+              .addFormData("teamId", teamId)
               .addFormData("savePointed", "false")
               .addFormData("drain", "false")
               .addFormData("savePoint", "")