fix(cubejs-server-core): fix schema caching in SQL API with DAP on

bsod90 · bsod90 · commit bc2ca422b7fa · 2025-02-10T09:03:32.000-08:00
diff --git a/packages/cubejs-server-core/src/core/CompilerApi.js b/packages/cubejs-server-core/src/core/CompilerApi.js
@@ -1,7 +1,7 @@
 import crypto from 'crypto';
 import R from 'ramda';
 import { createQuery, compile, queryClass, PreAggregations, QueryFactory } from '@cubejs-backend/schema-compiler';
-import { v4 as uuidv4 } from 'uuid';
+import { v4 as uuidv4, parse as uuidParse, stringify as uuidStringify } from 'uuid';
 import { NativeInstance } from '@cubejs-backend/native';
 
 export class CompilerApi {
@@ -428,7 +428,7 @@ export class CompilerApi {
     const { cubeEvaluator } = compilers;
 
     if (!cubeEvaluator.isRbacEnabled()) {
-      return cubes;
+      return { cubes, visibilityMaskHash: null };
     }
 
     for (const cube of cubes) {
@@ -481,39 +481,59 @@ export class CompilerApi {
       });
     };
 
-    return cubes
-      .map((cube) => ({
-        config: {
-          ...cube.config,
-          measures: cube.config.measures?.map(visibilityPatcherForCube(cube)),
-          dimensions: cube.config.dimensions?.map(visibilityPatcherForCube(cube)),
-          segments: cube.config.segments?.map(visibilityPatcherForCube(cube)),
-          hierarchies: cube.config.hierarchies?.map(visibilityPatcherForCube(cube)),
-        },
-      }));
+    const visibiliyMask = JSON.stringify(isMemberVisibleInContext, Object.keys(isMemberVisibleInContext).sort());
+    const visibilityMaskHash = crypto.createHash('md5').update(visibiliyMask).digest('hex').slice(0, 8);
+
+    return {
+      cubes: cubes
+        .map((cube) => ({
+          config: {
+            ...cube.config,
+            measures: cube.config.measures?.map(visibilityPatcherForCube(cube)),
+            dimensions: cube.config.dimensions?.map(visibilityPatcherForCube(cube)),
+            segments: cube.config.segments?.map(visibilityPatcherForCube(cube)),
+            hierarchies: cube.config.hierarchies?.map(visibilityPatcherForCube(cube)),
+          },
+        })),
+      visibilityMaskHash
+    };
+  }
+
+  mixInVisibilityMaskHash(compilerId, visibilityMaskHash) {
+    const uuidBytes = uuidParse(compilerId);
+    const hashBytes = Buffer.from(visibilityMaskHash, 'hex');
+    // Mix hash into the first 4 bytes and the last 4 bytes in a way that doesn't change the UUID version
+    for (let i = 0; i < 4; i++) {
+      // eslint-disable-next-line no-bitwise
+      uuidBytes[i] ^= hashBytes[i]; // First 4 bytes
+      // eslint-disable-next-line no-bitwise
+      uuidBytes[12 + i] ^= hashBytes[i + 4]; // Last 4 bytes
+    }
+
+    return uuidStringify(uuidBytes);
   }
 
   async metaConfig(requestContext, options = {}) {
     const { includeCompilerId, ...restOptions } = options;
     const compilers = await this.getCompilers(restOptions);
     const { cubes } = compilers.metaTransformer;
-    const patchedCubes = await this.patchVisibilityByAccessPolicy(
+    const { visibilityMaskHash, cubes: patchedCubes } = await this.patchVisibilityByAccessPolicy(
       compilers,
       requestContext,
       cubes
     );
     if (includeCompilerId) {
       return {
         cubes: patchedCubes,
-        compilerId: compilers.compilerId,
+        compilerId: visibilityMaskHash ? this.mixInVisibilityMaskHash(compilers.compilerId, visibilityMaskHash) : compilers.compilerId,
       };
     }
     return patchedCubes;
   }
 
   async metaConfigExtended(requestContext, options) {
     const compilers = await this.getCompilers(options);
-    const patchedCubes = await this.patchVisibilityByAccessPolicy(
+    const { cubes: patchedCubes } = await this.patchVisibilityByAccessPolicy(
       compilers,
       requestContext,
       compilers.metaTransformer?.cubes
diff --git a/packages/cubejs-testing/birdbox-fixtures/rbac/cube.js b/packages/cubejs-testing/birdbox-fixtures/rbac/cube.js
@@ -1,5 +1,6 @@
 module.exports = {
   contextToRoles: async (context) => context.securityContext.auth?.roles || [],
+  canSwitchSqlUser: async () => true,
   checkSqlAuth: async (req, user, password) => {
     if (user === 'admin') {
       if (password && password !== 'admin_password') {
@@ -64,6 +65,27 @@ module.exports = {
         },
       };
     }
+    if (user === 'restricted') {
+      if (password && password !== 'restricted_password') {
+        throw new Error(`Password doesn't match for ${user}`);
+      }
+      return {
+        password,
+        superuser: false,
+        securityContext: {
+          auth: {
+            username: 'default',
+            userAttributes: {
+              region: 'CA',
+              city: 'San Francisco',
+              canHaveAdmin: true,
+              minDefaultId: 20000,
+            },
+            roles: ['restricted'],
+          },
+        },
+      };
+    }
     throw new Error(`User "${user}" doesn't exist`);
   }
 };
diff --git a/packages/cubejs-testing/birdbox-fixtures/rbac/model/cubes/line_items.js b/packages/cubejs-testing/birdbox-fixtures/rbac/model/cubes/line_items.js
@@ -60,6 +60,12 @@ cube('line_items', {
         excludes: ['count', 'price', 'price_dim'],
       },
     },
+    {
+      role: 'restricted',
+      memberLevel: {
+        excludes: ['count', 'price', 'price_dim'],
+      },
+    },
     {
       role: 'admin',
       conditions: [
diff --git a/packages/cubejs-testing/test/__snapshots__/smoke-rbac.test.ts.snap b/packages/cubejs-testing/test/__snapshots__/smoke-rbac.test.ts.snap
@@ -770,3 +770,153 @@ Array [
 `;
 
 exports[`Cube RBAC Engine RBAC via SQL API manager SELECT * from line_items: line_items_manager 1`] = `Array []`;
+
+exports[`Cube RBAC Engine RBAC via SQL changing users Switching user should allow more members to be visible: line_items 1`] = `
+Array [
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2018-10-23T07:54:39.000Z,
+    "price": 267,
+    "quantity": 2,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2018-01-01T13:50:20.000Z,
+    "price": 263,
+    "quantity": 7,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2017-05-13T21:23:08.000Z,
+    "price": 180,
+    "quantity": 8,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2018-04-10T22:51:15.000Z,
+    "price": 169,
+    "quantity": 6,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2017-07-16T15:00:34.000Z,
+    "price": 156,
+    "quantity": 1,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2019-05-23T04:25:27.000Z,
+    "price": 36,
+    "quantity": 5,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2018-09-29T20:29:30.000Z,
+    "price": 245,
+    "quantity": 4,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2019-04-17T03:32:54.000Z,
+    "price": 232,
+    "quantity": 8,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2019-11-15T18:22:17.000Z,
+    "price": 63,
+    "quantity": 8,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "count": "1",
+    "created_at": 2019-12-16T08:09:36.000Z,
+    "price": 68,
+    "quantity": 6,
+  },
+]
+`;
+
+exports[`Cube RBAC Engine RBAC via SQL changing users Switching user should allow more members to be visible: line_items_default 1`] = `
+Array [
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2018-10-23T07:54:39.000Z,
+    "quantity": 2,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2018-01-01T13:50:20.000Z,
+    "quantity": 7,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2017-05-13T21:23:08.000Z,
+    "quantity": 8,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2018-04-10T22:51:15.000Z,
+    "quantity": 6,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2017-07-16T15:00:34.000Z,
+    "quantity": 1,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2019-05-23T04:25:27.000Z,
+    "quantity": 5,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2018-09-29T20:29:30.000Z,
+    "quantity": 4,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2019-04-17T03:32:54.000Z,
+    "quantity": 8,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2019-11-15T18:22:17.000Z,
+    "quantity": 8,
+  },
+  Object {
+    "__cubeJoinField": null,
+    "__user": null,
+    "created_at": 2019-12-16T08:09:36.000Z,
+    "quantity": 6,
+  },
+]
+`;
diff --git a/packages/cubejs-testing/test/smoke-rbac.test.ts b/packages/cubejs-testing/test/smoke-rbac.test.ts
@@ -198,6 +198,28 @@ describe('Cube RBAC Engine', () => {
     });
   });
 
+  describe('RBAC via SQL changing users', () => {
+    let connection: PgClient;
+
+    beforeAll(async () => {
+      connection = await createPostgresClient('restricted', 'restricted_password');
+    });
+
+    afterAll(async () => {
+      await connection.end();
+    }, JEST_AFTER_ALL_DEFAULT_TIMEOUT);
+
+    test('Switching user should allow more members to be visible', async () => {
+      const resDefault = await connection.query('SELECT * FROM line_items limit 10');
+      expect(resDefault.rows).toMatchSnapshot('line_items_default');
+
+      await connection.query('SET USER=admin');
+
+      const resAdmin = await connection.query('SELECT * FROM line_items limit 10');
+      expect(resAdmin.rows).toMatchSnapshot('line_items');
+    });
+  });
+
   describe('RBAC via REST API', () => {
     let client: CubeApi;
     let defaultClient: CubeApi;
