Move password history under __audit (apache#16496)

CRZbulabula · web-flow · commit 4b2913050c7d · 2025-09-27T09:48:10.000+08:00
diff --git a/integration-test/src/test/java/org/apache/iotdb/confignode/it/load/IoTDBMultiDBRegionGroupLeaderDistributionIT.java b/integration-test/src/test/java/org/apache/iotdb/confignode/it/load/IoTDBMultiDBRegionGroupLeaderDistributionIT.java
@@ -113,7 +113,8 @@ public void testMultiDatabaseLeaderDistribution()
         TShowRegionResp showRegionResp = client.showRegion(new TShowRegionReq());
         showRegionResp
             .getRegionInfoList()
-            .removeIf(r -> r.database.startsWith("root." + SystemConstant.SYSTEM_PREFIX_KEY));
+            // Skip AUDIT database
+            .removeIf(r -> r.database.startsWith(SystemConstant.AUDIT_DATABASE));
         showRegionResp
             .getRegionInfoList()
             .forEach(
diff --git a/integration-test/src/test/java/org/apache/iotdb/confignode/it/partition/IoTDBAutoRegionGroupExtensionIT.java b/integration-test/src/test/java/org/apache/iotdb/confignode/it/partition/IoTDBAutoRegionGroupExtensionIT.java
@@ -189,7 +189,7 @@ private void checkRegionDistribution(
                   .merge(regionInfo.getDataNodeId(), 1, Integer::sum);
             });
     // The number of RegionGroups should not less than the testMinRegionGroupNum for each database
-    // +1 for system database
+    // +1 for AUDIT database
     Assert.assertEquals(TEST_DATABASE_NUM + 1, databaseRegionCounter.size());
     databaseRegionCounter.forEach(
         (database, regionCount) ->
diff --git a/integration-test/src/test/java/org/apache/iotdb/confignode/it/partition/IoTDBPartitionGetterIT.java b/integration-test/src/test/java/org/apache/iotdb/confignode/it/partition/IoTDBPartitionGetterIT.java
@@ -535,7 +535,7 @@ public void testGetSchemaNodeManagementPartition() throws Exception {
       nodeManagementResp = client.getSchemaNodeManagementPartition(nodeManagementReq);
       Assert.assertEquals(
           TSStatusCode.SUCCESS_STATUS.getStatusCode(), nodeManagementResp.getStatus().getCode());
-      // +1 for SYSTEM database
+      // +1 for AUDIT database
       Assert.assertEquals(storageGroupNum + 1, nodeManagementResp.getMatchedNodeSize());
       Assert.assertNotNull(nodeManagementResp.getSchemaRegionMap());
       Assert.assertEquals(0, nodeManagementResp.getSchemaRegionMapSize());
diff --git a/integration-test/src/test/java/org/apache/iotdb/confignode/it/regionmigration/pass/commit/IoTDBRegionGroupExpandAndShrinkForIoTV1IT.java b/integration-test/src/test/java/org/apache/iotdb/confignode/it/regionmigration/pass/commit/IoTDBRegionGroupExpandAndShrinkForIoTV1IT.java
@@ -94,7 +94,7 @@ public void singleRegionTest() throws Exception {
       Set<Integer> allDataNodeId = getAllDataNodes(statement);
 
       // expect one data region, one schema region
-      // plus one system data region, one system schema region
+      // plus one AUDIT data region, one AUDIT schema region
       Assert.assertEquals(4, regionMap.size());
 
       // expand
@@ -217,7 +217,7 @@ public void multiRegionNormalTest() throws Exception {
       Set<Integer> allDataNodeId = getAllDataNodes(statement);
 
       // expect one data region, one schema region
-      // plus one system data region, one system schema region
+      // plus one AUDIT data region, one AUDIT schema region
       Assert.assertEquals(4, regionMap.size());
 
       // select multiple regions for testing
diff --git a/integration-test/src/test/java/org/apache/iotdb/db/it/IoTDBMiscIT.java b/integration-test/src/test/java/org/apache/iotdb/db/it/IoTDBMiscIT.java
@@ -55,7 +55,7 @@ public void testCompressionRatioFile() throws SQLException {
         Statement statement = connection.createStatement()) {
       statement.execute("insert into root.comprssion_ratio_file.d1(timestamp,s1) values(1,1.0)");
       statement.execute("flush");
-      // one global file and two data region file (including one system region)
+      // one global file and two data region file (including one AUDIT region)
       assertEquals(3, collectCompressionRatioFiles(nodeWrapper).size());
 
       statement.execute("drop database root.comprssion_ratio_file");
diff --git a/integration-test/src/test/java/org/apache/iotdb/db/it/audit/IoTDBAuditLogBasicIT.java b/integration-test/src/test/java/org/apache/iotdb/db/it/audit/IoTDBAuditLogBasicIT.java
@@ -165,20 +165,6 @@ public static void tearDown() {
               "null",
               "null",
               "Successfully start the Audit service with configurations (auditableOperationType [DDL, DML, QUERY, CONTROL], auditableOperationLevel GLOBAL, auditableOperationResult SUCCESS,FAIL)"),
-          // Create password history TODO: @Hongzhi Gao move password history under __audit
-          Arrays.asList(
-              "node_1",
-              "u_0",
-              "root",
-              "",
-              "OBJECT_AUTHENTICATION",
-              "DDL",
-              "null",
-              "null",
-              "true",
-              "root.__system",
-              "null",
-              "User root (ID=0) requests authority on object root.__system with result true"),
           // Show audit database TODO: Fix typo in tree model
           Arrays.asList(
               "node_1",
diff --git a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
@@ -50,6 +50,7 @@
 import java.util.Set;
 import java.util.concurrent.Callable;
 
+import static org.apache.iotdb.db.audit.DNAuditLogger.PREFIX_PASSWORD_HISTORY;
 import static org.apache.iotdb.db.it.utils.TestUtils.createUser;
 import static org.apache.iotdb.db.it.utils.TestUtils.resultSetEqualTest;
 import static org.junit.Assert.assertEquals;
@@ -1519,7 +1520,7 @@ public void testPasswordHistoryCreateAndDrop(Statement statement) throws SQLExce
 
     try (ResultSet resultSet =
         statement.executeQuery(
-            "select last password from root.__system.password_history.`_userA`")) {
+            String.format("select last password from %s.`_userA`", PREFIX_PASSWORD_HISTORY))) {
       if (!resultSet.next()) {
         fail("Password history not found");
       }
@@ -1528,7 +1529,7 @@ public void testPasswordHistoryCreateAndDrop(Statement statement) throws SQLExce
 
     try (ResultSet resultSet =
         statement.executeQuery(
-            "select last oldPassword from root.__system.password_history.`_userA`")) {
+            String.format("select last oldPassword from %s.`_userA`", PREFIX_PASSWORD_HISTORY))) {
       if (!resultSet.next()) {
         fail("Password history not found");
       }
@@ -1539,13 +1540,13 @@ public void testPasswordHistoryCreateAndDrop(Statement statement) throws SQLExce
 
     try (ResultSet resultSet =
         statement.executeQuery(
-            "select last password from root.__system.password_history.`_userA`")) {
+            String.format("select last password from %s.`_userA`", PREFIX_PASSWORD_HISTORY))) {
       assertFalse(resultSet.next());
     }
 
     try (ResultSet resultSet =
         statement.executeQuery(
-            "select last oldPassword from root.__system.password_history.`_userA`")) {
+            String.format("select last oldPassword from %s.`_userA`", PREFIX_PASSWORD_HISTORY))) {
       assertFalse(resultSet.next());
     }
   }
@@ -1556,7 +1557,7 @@ public void testPasswordHistoryAlter(Statement statement) throws SQLException {
 
     try (ResultSet resultSet =
         statement.executeQuery(
-            "select last password from root.__system.password_history.`_userA`")) {
+            String.format("select last password from %s.`_userA`", PREFIX_PASSWORD_HISTORY))) {
       if (!resultSet.next()) {
         fail("Password history not found");
       }
@@ -1565,13 +1566,15 @@ public void testPasswordHistoryAlter(Statement statement) throws SQLException {
 
     try (ResultSet resultSet =
         statement.executeQuery(
-            "select oldPassword from root.__system.password_history.`_userA` order by time desc limit 1")) {
+            String.format(
+                "select oldPassword from %s.`_userA` order by time desc limit 1",
+                PREFIX_PASSWORD_HISTORY))) {
       if (!resultSet.next()) {
         fail("Password history not found");
       }
       assertEquals(
           AuthUtils.encryptPassword("abcdef123456"),
-          resultSet.getString("root.__system.password_history._userA.oldPassword"));
+          resultSet.getString(String.format("%s._userA.oldPassword", PREFIX_PASSWORD_HISTORY)));
     }
   }
 
diff --git a/integration-test/src/test/java/org/apache/iotdb/db/it/schema/IoTDBDeleteDatabaseIT.java b/integration-test/src/test/java/org/apache/iotdb/db/it/schema/IoTDBDeleteDatabaseIT.java
@@ -159,7 +159,8 @@ public void testDeleteAllDatabases() throws Exception {
           result.add(resultSet.getString(1));
         }
       }
-      assertEquals(0, result.size());
+      // One for un-deletable AUDIT database
+      assertEquals(1, result.size());
     }
   }
 
diff --git a/integration-test/src/test/java/org/apache/iotdb/relational/it/schema/IoTDBDatabaseIT.java b/integration-test/src/test/java/org/apache/iotdb/relational/it/schema/IoTDBDatabaseIT.java
@@ -804,6 +804,7 @@ public void testMixedDatabase() throws SQLException {
 
     try (final Connection connection = EnvFactory.getEnv().getConnection();
         final Statement statement = connection.createStatement()) {
+      // One for AUDIT database
       TestUtils.assertResultSetSize(statement.executeQuery("show databases"), 2);
     }
   }
diff --git a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/impl/schema/DeleteTimeSeriesProcedure.java b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/procedure/impl/schema/DeleteTimeSeriesProcedure.java
@@ -141,7 +141,7 @@ protected Flow executeFromState(
   // Return the total num of timeSeries in schemaEngine black list
   private long constructBlackList(final ConfigNodeProcedureEnv env) {
     final Map<TConsensusGroupId, TRegionReplicaSet> targetSchemaRegionGroup =
-        env.getConfigManager().getRelatedSchemaRegionGroup(patternTree, false);
+        env.getConfigManager().getRelatedSchemaRegionGroup(patternTree, true);
     if (targetSchemaRegionGroup.isEmpty()) {
       return 0;
     }
@@ -260,7 +260,7 @@ private void deleteTimeSeriesSchema(final ConfigNodeProcedureEnv env) {
         new DeleteTimeSeriesRegionTaskExecutor<>(
             "delete time series in schema engine",
             env,
-            env.getConfigManager().getRelatedSchemaRegionGroup(patternTree, false),
+            env.getConfigManager().getRelatedSchemaRegionGroup(patternTree, true),
             CnToDnAsyncRequestType.DELETE_TIMESERIES,
             ((dataNodeLocation, consensusGroupIdList) ->
                 new TDeleteTimeSeriesReq(consensusGroupIdList, patternTreeBytes)
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/audit/DNAuditLogger.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/audit/DNAuditLogger.java
@@ -81,9 +81,7 @@
 import static org.apache.iotdb.db.pipe.receiver.protocol.legacy.loader.ILoader.SCHEMA_FETCHER;
 
 public class DNAuditLogger extends AbstractAuditLogger {
-  // TODO: @Hongzhi Gao move this path under __audit
-  public static final String PREFIX_PASSWORD_HISTORY =
-      "root." + SystemConstant.SYSTEM_PREFIX_KEY + ".password_history";
+  public static final String PREFIX_PASSWORD_HISTORY = "root.__audit.password_history";
   private static final Logger logger = LoggerFactory.getLogger(DNAuditLogger.class);
 
   // TODO: @zhujt20 Optimize the following stupid retry
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/protocol/session/SessionManager.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/protocol/session/SessionManager.java
@@ -153,8 +153,8 @@ public Long checkPasswordExpiration(String username, String password) {
           new SessionInfo(
               0,
               new UserEntity(
-                  AuthorityChecker.SUPER_USER_ID,
-                  AuthorityChecker.SUPER_USER,
+                  AuthorityChecker.INTERNAL_AUDIT_USER_ID,
+                  AuthorityChecker.INTERNAL_AUDIT_USER,
                   IoTDBDescriptor.getInstance().getConfig().getInternalAddress()),
               ZoneId.systemDefault());
 
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java
@@ -978,8 +978,11 @@ protected TSStatus checkCreateOrAlterDatabasePermission(
         .setDatabase(databaseName.getFullPath())
         .setPrivilegeType(PrivilegeType.MANAGE_DATABASE)
         .setAuditLogOperation(AuditLogOperation.DDL);
-    // root.__audit can never be created or alter
     if (TREE_MODEL_AUDIT_DATABASE_PATH.equals(databaseName)) {
+      if (AuthorityChecker.INTERNAL_AUDIT_USER.equals(auditEntity.getUsername())) {
+        // root.__audit can never be created or alter by other users
+        return SUCCEED;
+      }
       recordObjectAuthenticationAuditLog(auditEntity.setResult(false), databaseName::getFullPath);
       return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
           .setMessage(String.format(READ_ONLY_DB_ERROR_MSG, TREE_MODEL_AUDIT_DATABASE));

Original file line number	Diff line number	Diff line change
`@@ -159,7 +159,8 @@ public void testDeleteAllDatabases() throws Exception {`
`159`	`159`	`result.add(resultSet.getString(1));`
`160`	`160`	`}`
`161`	`161`	`}`
`162`		`- assertEquals(0, result.size());`
	`162`	`+ // One for un-deletable AUDIT database`
	`163`	`+ assertEquals(1, result.size());`
`163`	`164`	`}`
`164`	`165`	`}`
`165`	`166`
Original file line number	Diff line number	Diff line change
`@@ -804,6 +804,7 @@ public void testMixedDatabase() throws SQLException {`
`804`	`804`
`805`	`805`	`try (final Connection connection = EnvFactory.getEnv().getConnection();`
`806`	`806`	`final Statement statement = connection.createStatement()) {`
	`807`	`+ // One for AUDIT database`
`807`	`808`	`TestUtils.assertResultSetSize(statement.executeQuery("show databases"), 2);`
`808`	`809`	`}`
`809`	`810`	`}`