Caideyipi commented on code in PR #13158:
URL: https://github.com/apache/iotdb/pull/13158#discussion_r1924616057
##########
iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java:
##########
@@ -525,53 +592,49 @@ private boolean checkRoleFromConfigNode(String username,
String rolename) {
/** Cache user. */
public User cacheUser(TPermissionInfoResp tPermissionInfoResp) {
User user = new User();
- List<TPathPrivilege> privilegeList =
tPermissionInfoResp.getUserInfo().getPrivilegeList();
- List<PathPrivilege> pathPrivilegeList = new ArrayList<>();
- user.setName(tPermissionInfoResp.getUserInfo().getUsername());
+ List<TPathPrivilege> privilegeList =
+
tPermissionInfoResp.getUserInfo().getPermissionInfo().getPrivilegeList();
+
user.setName(tPermissionInfoResp.getUserInfo().getPermissionInfo().getName());
user.setPassword(tPermissionInfoResp.getUserInfo().getPassword());
- for (TPathPrivilege tPathPrivilege : privilegeList) {
- try {
- PathPrivilege pathPri = new PathPrivilege();
- pathPri.setPath(new PartialPath(tPathPrivilege.getPath()));
- pathPri.setPrivileges(tPathPrivilege.getPriSet());
- pathPri.setGrantOpt(tPathPrivilege.getPriGrantOpt());
- pathPrivilegeList.add(pathPri);
- } catch (MetadataException e) {
- LOGGER.error("Failed to parse path {}.", tPathPrivilege.getPath(), e);
- }
- }
+ user.loadRelationalPrivilegeInfo(
+
tPermissionInfoResp.getUserInfo().getPermissionInfo().getDbPrivilegeMap());
+ user.setAnyScopePrivilegeSetInt(
+
tPermissionInfoResp.getUserInfo().getPermissionInfo().getAnyScopeSet());
+ user.setAnyScopePrivilegeGrantOptSetInt(
+
tPermissionInfoResp.getUserInfo().getPermissionInfo().getAnyScopeGrantSet());
user.setOpenIdUser(tPermissionInfoResp.getUserInfo().isIsOpenIdUser());
- user.setPrivilegeList(pathPrivilegeList);
- user.setRoleList(tPermissionInfoResp.getUserInfo().getRoleList());
- user.setSysPrivilegeSet(tPermissionInfoResp.getUserInfo().getSysPriSet());
-
user.setSysPriGrantOpt(tPermissionInfoResp.getUserInfo().getSysPriSetGrantOpt());
- for (String roleName : tPermissionInfoResp.getRoleInfo().keySet()) {
- iAuthorCache.putRoleCache(roleName, cacheRole(roleName,
tPermissionInfoResp));
+ user.setRoleSet(tPermissionInfoResp.getUserInfo().getRoleSet());
+ user.setSysPrivilegeSetInt(
+ tPermissionInfoResp.getUserInfo().getPermissionInfo().getSysPriSet());
+ user.setSysPriGrantOptInt(
+
tPermissionInfoResp.getUserInfo().getPermissionInfo().getSysPriSetGrantOpt());
+ try {
+ user.loadPathPrivilegeInfo(privilegeList);
+ } catch (MetadataException e) {
+ LOGGER.error("cache user's path privileges error", e);
+ }
+ if (tPermissionInfoResp.isSetRoleInfo()) {
+ for (String roleName : tPermissionInfoResp.getRoleInfo().keySet()) {
+ iAuthorCache.putRoleCache(roleName, cacheRole(roleName,
tPermissionInfoResp));
+ }
}
return user;
}
/** Cache role. */
public Role cacheRole(String roleName, TPermissionInfoResp
tPermissionInfoResp) {
- Role role = new Role();
- List<TPathPrivilege> privilegeList =
- tPermissionInfoResp.getRoleInfo().get(roleName).getPrivilegeList();
- List<PathPrivilege> pathPrivilegeList = new ArrayList<>();
-
role.setName(tPermissionInfoResp.getRoleInfo().get(roleName).getRoleName());
- for (TPathPrivilege tPathPrivilege : privilegeList) {
- try {
- PathPrivilege pathPri = new PathPrivilege();
- pathPri.setPath(new PartialPath(tPathPrivilege.getPath()));
- pathPri.setPrivileges(tPathPrivilege.getPriSet());
- pathPri.setGrantOpt(tPathPrivilege.getPriGrantOpt());
- pathPrivilegeList.add(pathPri);
- } catch (MetadataException e) {
- LOGGER.error("Failed to parse path {}.", tPathPrivilege.getPath(), e);
- }
+ TRoleResp resp = tPermissionInfoResp.getRoleInfo().get(roleName);
+ Role role = new Role(resp.getName());
+
+ role.loadRelationalPrivilegeInfo(resp.getDbPrivilegeMap());
Review Comment:
Where is the "anyScope"....
##########
iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/ClusterAuthorityFetcher.java:
##########
@@ -81,9 +85,61 @@ public ClusterAuthorityFetcher(IAuthorCache iAuthorCache) {
this.iAuthorCache = iAuthorCache;
}
+ /** -- check user privileges SYSTEM, TREE, RELATIONAL-- * */
+ private TSStatus checkPrivilege(
+ String username,
+ PrivilegeUnion union,
+ BiFunction<Role, PrivilegeUnion, Boolean> privilegeCheck,
+ TCheckUserPrivilegesReq req) {
+ User user = iAuthorCache.getUserCache(username);
+ if (user != null) {
+ if (privilegeCheck.apply(user, union)) {
+ return RpcUtils.getStatus(TSStatusCode.SUCCESS_STATUS);
+ }
+ boolean remoteCheck = false;
+ for (String rolename : user.getRoleSet()) {
+ Role role = iAuthorCache.getRoleCache(rolename);
+ if (role == null) {
+ remoteCheck = true;
Review Comment:
Can check all the roles and then fetch remote, rather than stop retrying at
the first "null".
##########
iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/PrivilegeType.java:
##########
@@ -24,59 +24,61 @@
/** This enum class contains all available privileges in IoTDB. */
public enum PrivilegeType {
- READ_DATA(true),
- WRITE_DATA(true),
- READ_SCHEMA(true),
- WRITE_SCHEMA(true),
- MANAGE_USER,
- MANAGE_ROLE,
- USE_TRIGGER,
+ READ_DATA(PrivilegeModelType.TREE),
+ WRITE_DATA(PrivilegeModelType.TREE),
+ READ_SCHEMA(PrivilegeModelType.TREE),
+ WRITE_SCHEMA(PrivilegeModelType.TREE),
+ MANAGE_USER(PrivilegeModelType.SYSTEM),
+ MANAGE_ROLE(PrivilegeModelType.SYSTEM),
+ USE_TRIGGER(PrivilegeModelType.SYSTEM),
+ USE_UDF(PrivilegeModelType.SYSTEM),
+ USE_CQ(PrivilegeModelType.SYSTEM),
+ USE_PIPE(PrivilegeModelType.SYSTEM),
+ USE_MODEL(PrivilegeModelType.SYSTEM),
- USE_UDF,
+ EXTEND_TEMPLATE(PrivilegeModelType.SYSTEM),
+ MANAGE_DATABASE(PrivilegeModelType.SYSTEM),
+ MAINTAIN(PrivilegeModelType.SYSTEM),
+ CREATE(PrivilegeModelType.RELATIONAL),
+ DROP(PrivilegeModelType.RELATIONAL),
+ ALTER(PrivilegeModelType.RELATIONAL),
+ SELECT(PrivilegeModelType.RELATIONAL),
+ INSERT(PrivilegeModelType.RELATIONAL),
+ DELETE(PrivilegeModelType.RELATIONAL);
- USE_CQ,
- USE_PIPE,
- USE_MODEL,
+ private final PrivilegeModelType modelType;
- EXTEND_TEMPLATE,
- MANAGE_DATABASE,
- MAINTAIN;
-
- private static final int PRIVILEGE_COUNT = values().length;
-
- private final boolean isPathRelevant;
-
- PrivilegeType() {
- this.isPathRelevant = false;
+ PrivilegeType(PrivilegeModelType modelType) {
+ this.modelType = modelType;
}
- PrivilegeType(boolean isPathRelevant) {
- this.isPathRelevant = isPathRelevant;
+ public boolean isPathPrivilege() {
+ return this.modelType == PrivilegeModelType.TREE;
}
- public boolean isPathRelevant() {
- return isPathRelevant;
+ public boolean isSystemPrivilege() {
+ return this.modelType == PrivilegeModelType.SYSTEM;
}
- public static boolean isPathRelevant(int ordinal) {
- return ordinal < 4;
- }
-
- public static int getSysPriCount() {
- int size = 0;
- for (PrivilegeType item : PrivilegeType.values()) {
- if (!item.isPathRelevant()) {
- size++;
- }
- }
- return size;
+ public boolean isRelationalPrivilege() {
+ return this.modelType == PrivilegeModelType.RELATIONAL;
}
- public static int getPathPriCount() {
+ public static int getPrivilegeCount(PrivilegeModelType type) {
int size = 0;
for (PrivilegeType item : PrivilegeType.values()) {
- if (item.isPathRelevant()) {
- size++;
+ switch (type) {
+ case TREE:
+ size += item.isPathPrivilege() ? 1 : 0;
+ break;
+ case SYSTEM:
+ size += item.isSystemPrivilege() ? 1 : 0;
+ break;
+ case RELATIONAL:
+ size += item.isRelationalPrivilege() ? 1 : 0;
+ break;
+ default:
+ //
Review Comment:
Use break instead
##########
iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/TablePrivilege.java:
##########
@@ -0,0 +1,166 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.iotdb.commons.auth.entity;
+
+import org.apache.iotdb.commons.utils.AuthUtils;
+import org.apache.iotdb.commons.utils.SerializeUtils;
+
+import org.apache.tsfile.utils.ReadWriteIOUtils;
+
+import java.io.DataOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+
+// This class contain table's privileges.
+public class TablePrivilege {
+ private String tableName;
+ private Set<PrivilegeType> privileges;
+ private Set<PrivilegeType> grantOption;
+
+ public TablePrivilege(String tableName) {
+ this.tableName = tableName;
+ this.privileges = new HashSet<>();
+ this.grantOption = new HashSet<>();
+ }
+
+ public TablePrivilege() {
+ // this construction just used for deserialize.
+ }
+
+ public String getTableName() {
+ return this.tableName;
+ }
+
+ public Set<PrivilegeType> getPrivileges() {
+ return this.privileges;
+ }
+
+ public Set<PrivilegeType> getGrantOption() {
+ return this.grantOption;
+ }
+
+ public Set<Integer> getPrivilegesIntSet() {
+ Set<Integer> res = new HashSet<>();
+ for (PrivilegeType type : privileges) {
+ res.add(type.ordinal());
+ }
+ return res;
+ }
+
+ public Set<Integer> getGrantOptionIntSet() {
+ Set<Integer> res = new HashSet<>();
+ for (PrivilegeType type : grantOption) {
+ res.add(type.ordinal());
+ }
+ return res;
+ }
+
+ public void grantPrivilege(PrivilegeType priv) {
+ this.privileges.add(priv);
+ }
+
+ public void revokePrivilege(PrivilegeType priv) {
+ this.privileges.remove(priv);
+ }
+
+ public void grantOption(PrivilegeType priv) {
+ this.grantOption.add(priv);
+ }
+
+ public void revokeGrantOption(PrivilegeType priv) {
+ this.grantOption.remove(priv);
+ }
+
+ public void setPrivileges(int mask) {
+ final int PRI_SIZE =
PrivilegeType.getPrivilegeCount(PrivilegeModelType.RELATIONAL);
+ for (int i = 0; i < PRI_SIZE; i++) {
+ if (((1 << i) & mask) != 0) {
+ this.privileges.add(AuthUtils.posToObjPri(i));
+ if (((1 << (i + 16)) & mask) != 0) {
+ this.grantOption.add(AuthUtils.posToObjPri(i));
+ }
+ }
+ }
+ }
+
+ public int getAllPrivileges() {
+ int privilege = 0;
+ for (PrivilegeType pri : privileges) {
+ privilege |= 1 << AuthUtils.objPriToPos(pri);
+ }
+ for (PrivilegeType pri : grantOption) {
+ privilege |= 1 << (AuthUtils.objPriToPos(pri) + 16);
+ }
+ return privilege;
+ }
+
+ public boolean equals(Object o) {
+ if (this == o) {
+ return true;
+ }
+ if (o == null || getClass() != o.getClass()) {
+ return false;
+ }
+ TablePrivilege that = (TablePrivilege) o;
+ return tableName.equals(that.tableName)
+ && privileges.equals(that.privileges)
+ && grantOption.equals(that.grantOption);
+ }
+
+ public int hashCode() {
+ return Objects.hash(tableName, privileges, grantOption);
+ }
+
+ public String toString() {
+ StringBuilder builder = new StringBuilder();
+ builder.append(this.tableName).append("(");
+ List<PrivilegeType> privs = new ArrayList<>(this.privileges);
+ Collections.sort(privs);
+ for (PrivilegeType type : privs) {
+ builder.append(type);
+ if (grantOption.contains(type)) {
+ builder.append("_with_grant_option");
+ }
+ builder.append(",");
+ }
+ builder.append(")");
+ return builder.toString();
+ }
+
+ public void serialize(OutputStream outputStream) throws IOException {
+ ReadWriteIOUtils.write(this.tableName, outputStream);
+ SerializeUtils.serializePrivilegeTypeSet(this.privileges,
(DataOutputStream) outputStream);
+ SerializeUtils.serializePrivilegeTypeSet(this.grantOption,
(DataOutputStream) outputStream);
+ }
+
+ public void deserialize(ByteBuffer byteBuffer) {
+ this.privileges = new HashSet<>();
+ this.grantOption = new HashSet<>();
+ this.tableName = SerializeUtils.deserializeString(byteBuffer);
Review Comment:
Better use ReadWriteIOUtils.readString(Bytebuffer) here.. Though currently
using this is also correct....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
