Skip to content

Commit e39c9c4

Browse files
CaideyipiCaideyipi
committed
hdx
1 parent 18adf5b commit e39c9c4

File tree

2 files changed

+69
-60
lines changed

2 files changed

+69
-60
lines changed

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/receiver/protocol/IoTDBConfigNodeReceiver.java‎

Lines changed: 37 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@
8282
import org.apache.iotdb.confignode.consensus.request.write.table.view.SetViewCommentPlan;
8383
import org.apache.iotdb.confignode.consensus.request.write.table.view.SetViewPropertiesPlan;
8484
import org.apache.iotdb.confignode.consensus.request.write.template.CommitSetSchemaTemplatePlan;
85+
import org.apache.iotdb.confignode.consensus.request.write.template.CreateSchemaTemplatePlan;
8586
import org.apache.iotdb.confignode.consensus.request.write.template.ExtendSchemaTemplatePlan;
8687
import org.apache.iotdb.confignode.consensus.request.write.trigger.DeleteTriggerInTablePlan;
8788
import org.apache.iotdb.confignode.manager.ConfigManager;
@@ -146,6 +147,7 @@
146147
import java.util.concurrent.atomic.AtomicInteger;
147148

148149
import static org.apache.iotdb.confignode.manager.pipe.source.PipeConfigTreePrivilegeParseVisitor.checkGlobalStatus;
150+
import static org.apache.iotdb.confignode.manager.pipe.source.PipeConfigTreePrivilegeParseVisitor.checkPathsStatus;
149151

150152
public class IoTDBConfigNodeReceiver extends IoTDBFileReceiver {
151153

@@ -296,6 +298,7 @@ private TSStatus checkPermission(final ConfigPhysicalPlan plan) throws IOExcepti
296298
}
297299

298300
String database;
301+
String templateName;
299302
switch (plan.getType()) {
300303
case CreateDatabase:
301304
database = ((DatabaseSchemaPlan) plan).getSchema().getName();
@@ -331,23 +334,22 @@ private TSStatus checkPermission(final ConfigPhysicalPlan plan) throws IOExcepti
331334
((ExtendSchemaTemplatePlan) plan).getTemplateExtendInfo().getTemplateName(),
332335
true);
333336
case CreateSchemaTemplate:
337+
templateName = ((CreateSchemaTemplatePlan) plan).getTemplate().getName();
338+
return checkGlobalStatus(userEntity, PrivilegeType.SYSTEM, templateName, true);
334339
case CommitSetSchemaTemplate:
340+
templateName = ((CommitSetSchemaTemplatePlan) plan).getName();
341+
return checkGlobalStatus(userEntity, PrivilegeType.SYSTEM, templateName, true);
335342
case PipeUnsetTemplate:
336-
return CommonDescriptor.getInstance().getConfig().getDefaultAdminName().equals(username)
337-
? StatusUtils.OK
338-
: new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
339-
.setMessage("Only the admin user can perform this operation");
343+
templateName = ((PipeUnsetSchemaTemplatePlan) plan).getName();
344+
return checkGlobalStatus(userEntity, PrivilegeType.SYSTEM, templateName, true);
340345
case PipeDeleteTimeSeries:
341-
return configManager
342-
.checkUserPrivileges(
343-
username,
344-
new PrivilegeUnion(
345-
new ArrayList<>(
346-
PathPatternTree.deserialize(
347-
((PipeDeleteTimeSeriesPlan) plan).getPatternTreeBytes())
348-
.getAllPathPatterns()),
349-
PrivilegeType.WRITE_SCHEMA))
350-
.getStatus();
346+
return checkPathsStatus(
347+
userEntity,
348+
PrivilegeType.WRITE_SCHEMA,
349+
new ArrayList<>(
350+
PathPatternTree.deserialize(((PipeDeleteTimeSeriesPlan) plan).getPatternTreeBytes())
351+
.getAllPathPatterns()),
352+
true);
351353
case PipeAlterEncodingCompressor:
352354
// Judge here in the future
353355
if (configManager
@@ -376,37 +378,30 @@ private TSStatus checkPermission(final ConfigPhysicalPlan plan) throws IOExcepti
376378
.serialize());
377379
return StatusUtils.OK;
378380
} else {
379-
return configManager
380-
.checkUserPrivileges(
381-
username,
382-
new PrivilegeUnion(
383-
new ArrayList<>(
384-
PathPatternTree.deserialize(
385-
((PipeAlterEncodingCompressorPlan) plan).getPatternTreeBytes())
386-
.getAllPathPatterns()),
387-
PrivilegeType.WRITE_SCHEMA))
388-
.getStatus();
381+
return checkPathsStatus(
382+
userEntity,
383+
PrivilegeType.WRITE_SCHEMA,
384+
new ArrayList<>(
385+
PathPatternTree.deserialize(
386+
((PipeAlterEncodingCompressorPlan) plan).getPatternTreeBytes())
387+
.getAllPathPatterns()),
388+
true);
389389
}
390390
case PipeDeleteLogicalView:
391-
return configManager
392-
.checkUserPrivileges(
393-
username,
394-
new PrivilegeUnion(
395-
new ArrayList<>(
396-
PathPatternTree.deserialize(
397-
((PipeDeleteLogicalViewPlan) plan).getPatternTreeBytes())
398-
.getAllPathPatterns()),
399-
PrivilegeType.WRITE_SCHEMA))
400-
.getStatus();
391+
return checkPathsStatus(
392+
userEntity,
393+
PrivilegeType.WRITE_SCHEMA,
394+
new ArrayList<>(
395+
PathPatternTree.deserialize(
396+
((PipeDeleteLogicalViewPlan) plan).getPatternTreeBytes())
397+
.getAllPathPatterns()),
398+
true);
401399
case PipeDeactivateTemplate:
402-
return configManager
403-
.checkUserPrivileges(
404-
username,
405-
new PrivilegeUnion(
406-
new ArrayList<>(
407-
((PipeDeactivateTemplatePlan) plan).getTemplateSetInfo().keySet()),
408-
PrivilegeType.WRITE_SCHEMA))
409-
.getStatus();
400+
return checkPathsStatus(
401+
userEntity,
402+
PrivilegeType.WRITE_SCHEMA,
403+
new ArrayList<>(((PipeDeactivateTemplatePlan) plan).getTemplateSetInfo().keySet()),
404+
true);
410405
case SetTTL:
411406
return Objects.equals(
412407
configManager

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/source/PipeConfigTreePrivilegeParseVisitor.java‎

Lines changed: 32 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@
5151
import org.slf4j.Logger;
5252
import org.slf4j.LoggerFactory;
5353

54+
import javax.annotation.Nonnull;
55+
5456
import java.io.IOException;
5557
import java.util.Arrays;
5658
import java.util.Collections;
@@ -441,13 +443,34 @@ public static boolean hasGlobalPrivilege(
441443
== TSStatusCode.SUCCESS_STATUS.getStatusCode();
442444
}
443445

446+
public static TSStatus checkPathsStatus(
447+
final IAuditEntity userEntity,
448+
final PrivilegeType privilegeType,
449+
final @Nonnull List<PartialPath> paths,
450+
final boolean isLastCheck) {
451+
final ConfigManager configManager = ConfigNode.getInstance().getConfigManager();
452+
final CNAuditLogger logger = configManager.getAuditLogger();
453+
final TSStatus result =
454+
ConfigNode.getInstance()
455+
.getConfigManager()
456+
.getPermissionManager()
457+
.checkUserPrivileges(userEntity.getUsername(), new PrivilegeUnion(paths, privilegeType))
458+
.getStatus();
459+
if (result.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode() || isLastCheck) {
460+
logger.recordAuditLog(
461+
userEntity
462+
.setPrivilegeType(PrivilegeType.READ_SCHEMA)
463+
.setResult(result.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode()),
464+
paths::toString);
465+
}
466+
return result;
467+
}
468+
444469
private boolean hasReadPrivilege(
445470
final IAuditEntity userEntity,
446471
final String path,
447472
final boolean withWildcard,
448473
final boolean isLastCheck) {
449-
final ConfigManager configManager = ConfigNode.getInstance().getConfigManager();
450-
final CNAuditLogger logger = configManager.getAuditLogger();
451474
PartialPath partialPath;
452475
try {
453476
partialPath = new PartialPath(path);
@@ -458,21 +481,12 @@ private boolean hasReadPrivilege(
458481
if (withWildcard) {
459482
partialPath = partialPath.concatNode(MULTI_LEVEL_PATH_WILDCARD);
460483
}
461-
final boolean result =
462-
ConfigNode.getInstance()
463-
.getConfigManager()
464-
.getPermissionManager()
465-
.checkUserPrivileges(
466-
userEntity.getUsername(),
467-
new PrivilegeUnion(
468-
Collections.singletonList(partialPath), PrivilegeType.READ_SCHEMA))
469-
.getStatus()
470-
.getCode()
471-
== TSStatusCode.SUCCESS_STATUS.getStatusCode();
472-
if (result || isLastCheck) {
473-
logger.recordAuditLog(
474-
userEntity.setPrivilegeType(PrivilegeType.READ_SCHEMA).setResult(result), () -> path);
475-
}
476-
return result;
484+
return checkPathsStatus(
485+
userEntity,
486+
PrivilegeType.READ_SCHEMA,
487+
Collections.singletonList(partialPath),
488+
isLastCheck)
489+
.getCode()
490+
== TSStatusCode.SUCCESS_STATUS.getStatusCode();
477491
}
478492
}

0 commit comments

Comments
 (0)