dosubot[bot] commented on issue #3020: URL: https://github.com/apache/hugegraph/issues/3020#issuecomment-4412106933
<!-- Answer --> @neoblackcap 关于你的问题，以下是基于代码分析的回答： **结论：standalone 模式下理论上可以为非 admin 用户授予 schema 创建权限，但存在已知的实现限制。** ### `/auth/manager` 不可用的原因 `/auth/manager` 接口仅适用于分布式 PD 模式，standalone 模式会直接返回 400 错误："GraphSpace management is not supported in standalone mode" [[1]](https://github.com/apache/hugegraph/blob/9126c80e414c073b60fc074361b211cfb409e0eb/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/API.java)。这是设计上的限制，因为 space manager/member 概念只在多图空间的分布式部署中有意义。 ### Standalone 模式下的权限管理方式 Standalone 模式仍然有完整的 RBAC 系统，通过以下 API 操作（**不需要** `/auth/manager`）： 1. **创建用户**: `POST /graphspaces/{graphspace}/auth/users` 2. **创建用户组**: `POST /graphspaces/{graphspace}/auth/groups` 3. **创建资源目标 (Target)**: `POST /graphspaces/{graphspace}/auth/targets` — 指定目标图和资源类型（如 `VERTEX_LABEL`、`EDGE_LABEL`） 4. **分配权限 (Access)**: `POST /graphspaces/{graphspace}/auth/accesses` — 将用户组关联到 Target，授予 WRITE 权限 5. **将用户加入组**: 通过 Belong 关系关联 权限模型为：User → Group → Access → Target(Resource) [[2]](https://github.com/apache/hugegraph/blob/9126c80e414c073b60fc074361b211cfb409e0eb/hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/auth/StandardAuthManager.java) [[3]](https://github.com/apache/hugegraph/blob/9126c80e414c073b60fc074361b211cfb409e0eb/hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/auth/HugePermission.java) Schema 操作所需的权限类型为 [[4]](https://github.com/apache/hugegraph/blob/9126c80e414c073b60fc074361b211cfb409e0eb/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/VertexLabelAPI.java) [[5]](https://github.com/apache/hugegraph/blob/9126c80e414c073b60fc074361b211cfb409e0eb/hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/schema/EdgeLabelAPI.java)： - VertexLabel 创建：`vertex_label_write` - EdgeLabel 创建：`edge_label_write` - IndexLabel 创建：`index_label_write` ### 已知问题 不过，有历史 issue 报告过类似问题——即使通过 RBAC 授予了权限，非 admin 用户在 standalone 模式下仍可能遇到 permission denied [[6]](https://github.com/apache/hugegraph/issues/918)。这可能与 API 端点同时要求 `space_member` 角色有关，而 standalone 模式下 space member 相关方法均为 no-op 实现（始终返回 false/空）[[2]](https://github.com/apache/hugegraph/blob/9126c80e414c073b60fc074361b211cfb409e0eb/hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/auth/StandardAuthManager.java)。 **所以实际情况是：当前 standalone 模式下，虽然 RBAC API 可用，但由于 `space_member` 角色检查在 standalone 模式下可能无法正常通过，非 admin 用户的 schema 操作大概率仍会被拒绝（403）。** 如果你需要完整的细粒度权限控制，可能需要考虑使用分布式 PD 模式部署。 如果你想尝试在 standalone 模式下配置 RBAC 权限来验证是否可行，我可以提供具体步骤。 <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fhugegraph).* --- Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fhugegraph). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fhugegraph&message_id=537758d5-e00c-412e-8fe5-a6bdc94a991f) [](https://github.dosu.com/apache/hugegraph?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fhugegraph) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fhugegraph) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
