Skip to content

Commit d209e83

Browse files
bsod90bsod90
authored
fix(cubejs-server-core): fix schema caching in SQL API with DAP on (#9204)
1 parent 9956ad7 commit d209e83

File tree

6 files changed

+294
-18
lines changed

6 files changed

+294
-18
lines changed

‎packages/cubejs-server-core/src/core/CompilerApi.js‎

Lines changed: 34 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import crypto from 'crypto';
22
import R from 'ramda';
33
import { createQuery, compile, queryClass, PreAggregations, QueryFactory } from '@cubejs-backend/schema-compiler';
4-
import { v4 as uuidv4 } from 'uuid';
4+
import { v4 as uuidv4, parse as uuidParse, stringify as uuidStringify } from 'uuid';
55
import { NativeInstance } from '@cubejs-backend/native';
66

77
export class CompilerApi {
@@ -428,7 +428,7 @@ export class CompilerApi {
428428
const { cubeEvaluator } = compilers;
429429

430430
if (!cubeEvaluator.isRbacEnabled()) {
431-
return cubes;
431+
return { cubes, visibilityMaskHash: null };
432432
}
433433

434434
for (const cube of cubes) {
@@ -481,39 +481,58 @@ export class CompilerApi {
481481
});
482482
};
483483

484-
return cubes
485-
.map((cube) => ({
486-
config: {
487-
...cube.config,
488-
measures: cube.config.measures?.map(visibilityPatcherForCube(cube)),
489-
dimensions: cube.config.dimensions?.map(visibilityPatcherForCube(cube)),
490-
segments: cube.config.segments?.map(visibilityPatcherForCube(cube)),
491-
hierarchies: cube.config.hierarchies?.map(visibilityPatcherForCube(cube)),
492-
},
493-
}));
484+
const visibiliyMask = JSON.stringify(isMemberVisibleInContext, Object.keys(isMemberVisibleInContext).sort());
485+
// This hash will be returned along the modified meta config and can be used
486+
// to distinguish between different "schema versions" after DAP visibility is applied
487+
const visibilityMaskHash = crypto.createHash('sha256').update(visibiliyMask).digest('hex');
488+
489+
return {
490+
cubes: cubes
491+
.map((cube) => ({
492+
config: {
493+
...cube.config,
494+
measures: cube.config.measures?.map(visibilityPatcherForCube(cube)),
495+
dimensions: cube.config.dimensions?.map(visibilityPatcherForCube(cube)),
496+
segments: cube.config.segments?.map(visibilityPatcherForCube(cube)),
497+
hierarchies: cube.config.hierarchies?.map(visibilityPatcherForCube(cube)),
498+
},
499+
})),
500+
visibilityMaskHash
501+
};
502+
}
503+
504+
mixInVisibilityMaskHash(compilerId, visibilityMaskHash) {
505+
const uuidBytes = uuidParse(compilerId);
506+
const hashBytes = Buffer.from(visibilityMaskHash, 'hex');
507+
return uuidv4({ random: crypto.createHash('sha256').update(uuidBytes).update(hashBytes).digest()
508+
.subarray(0, 16) });
494509
}
495510

496511
async metaConfig(requestContext, options = {}) {
497512
const { includeCompilerId, ...restOptions } = options;
498513
const compilers = await this.getCompilers(restOptions);
499514
const { cubes } = compilers.metaTransformer;
500-
const patchedCubes = await this.patchVisibilityByAccessPolicy(
515+
const { visibilityMaskHash, cubes: patchedCubes } = await this.patchVisibilityByAccessPolicy(
501516
compilers,
502517
requestContext,
503518
cubes
504519
);
505520
if (includeCompilerId) {
506521
return {
507522
cubes: patchedCubes,
508-
compilerId: compilers.compilerId,
523+
// This compilerId is primarily used by the cubejs-backend-native or caching purposes.
524+
// By default it doesn't account for member visibility changes introduced above by DAP.
525+
// Here we're modifying the originila compilerId in a way that it's distinct for
526+
// distinct schema versions while still being a valid UUID.
527+
compilerId: visibilityMaskHash ? this.mixInVisibilityMaskHash(compilers.compilerId, visibilityMaskHash) : compilers.compilerId,
509528
};
510529
}
511530
return patchedCubes;
512531
}
513532

514533
async metaConfigExtended(requestContext, options) {
515534
const compilers = await this.getCompilers(options);
516-
const patchedCubes = await this.patchVisibilityByAccessPolicy(
535+
const { cubes: patchedCubes } = await this.patchVisibilityByAccessPolicy(
517536
compilers,
518537
requestContext,
519538
compilers.metaTransformer?.cubes

‎packages/cubejs-testing/birdbox-fixtures/rbac/cube.js‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
module.exports = {
22
contextToRoles: async (context) => context.securityContext.auth?.roles || [],
3+
canSwitchSqlUser: async () => true,
34
checkSqlAuth: async (req, user, password) => {
45
if (user === 'admin') {
56
if (password && password !== 'admin_password') {
@@ -64,6 +65,27 @@ module.exports = {
6465
},
6566
};
6667
}
68+
if (user === 'restricted') {
69+
if (password && password !== 'restricted_password') {
70+
throw new Error(`Password doesn't match for ${user}`);
71+
}
72+
return {
73+
password,
74+
superuser: false,
75+
securityContext: {
76+
auth: {
77+
username: 'default',
78+
userAttributes: {
79+
region: 'CA',
80+
city: 'San Francisco',
81+
canHaveAdmin: true,
82+
minDefaultId: 20000,
83+
},
84+
roles: ['restricted'],
85+
},
86+
},
87+
};
88+
}
6789
throw new Error(`User "${user}" doesn't exist`);
6890
}
6991
};

‎packages/cubejs-testing/birdbox-fixtures/rbac/model/cubes/line_items.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,12 @@ cube('line_items', {
6060
excludes: ['count', 'price', 'price_dim'],
6161
},
6262
},
63+
{
64+
role: 'restricted',
65+
memberLevel: {
66+
excludes: ['count', 'price', 'price_dim'],
67+
},
68+
},
6369
{
6470
role: 'admin',
6571
conditions: [

‎packages/cubejs-testing/test/__snapshots__/smoke-rbac.test.ts.snap‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -770,3 +770,153 @@ Array [
770770
`;
771771

772772
exports[`Cube RBAC Engine RBAC via SQL API manager SELECT * from line_items: line_items_manager 1`] = `Array []`;
773+
774+
exports[`Cube RBAC Engine RBAC via SQL changing users Switching user should allow more members to be visible: line_items 1`] = `
775+
Array [
776+
Object {
777+
"__cubeJoinField": null,
778+
"__user": null,
779+
"count": "1",
780+
"created_at": 2018-10-23T07:54:39.000Z,
781+
"price": 267,
782+
"quantity": 2,
783+
},
784+
Object {
785+
"__cubeJoinField": null,
786+
"__user": null,
787+
"count": "1",
788+
"created_at": 2018-01-01T13:50:20.000Z,
789+
"price": 263,
790+
"quantity": 7,
791+
},
792+
Object {
793+
"__cubeJoinField": null,
794+
"__user": null,
795+
"count": "1",
796+
"created_at": 2017-05-13T21:23:08.000Z,
797+
"price": 180,
798+
"quantity": 8,
799+
},
800+
Object {
801+
"__cubeJoinField": null,
802+
"__user": null,
803+
"count": "1",
804+
"created_at": 2018-04-10T22:51:15.000Z,
805+
"price": 169,
806+
"quantity": 6,
807+
},
808+
Object {
809+
"__cubeJoinField": null,
810+
"__user": null,
811+
"count": "1",
812+
"created_at": 2017-07-16T15:00:34.000Z,
813+
"price": 156,
814+
"quantity": 1,
815+
},
816+
Object {
817+
"__cubeJoinField": null,
818+
"__user": null,
819+
"count": "1",
820+
"created_at": 2019-05-23T04:25:27.000Z,
821+
"price": 36,
822+
"quantity": 5,
823+
},
824+
Object {
825+
"__cubeJoinField": null,
826+
"__user": null,
827+
"count": "1",
828+
"created_at": 2018-09-29T20:29:30.000Z,
829+
"price": 245,
830+
"quantity": 4,
831+
},
832+
Object {
833+
"__cubeJoinField": null,
834+
"__user": null,
835+
"count": "1",
836+
"created_at": 2019-04-17T03:32:54.000Z,
837+
"price": 232,
838+
"quantity": 8,
839+
},
840+
Object {
841+
"__cubeJoinField": null,
842+
"__user": null,
843+
"count": "1",
844+
"created_at": 2019-11-15T18:22:17.000Z,
845+
"price": 63,
846+
"quantity": 8,
847+
},
848+
Object {
849+
"__cubeJoinField": null,
850+
"__user": null,
851+
"count": "1",
852+
"created_at": 2019-12-16T08:09:36.000Z,
853+
"price": 68,
854+
"quantity": 6,
855+
},
856+
]
857+
`;
858+
859+
exports[`Cube RBAC Engine RBAC via SQL changing users Switching user should allow more members to be visible: line_items_default 1`] = `
860+
Array [
861+
Object {
862+
"__cubeJoinField": null,
863+
"__user": null,
864+
"created_at": 2018-10-23T07:54:39.000Z,
865+
"quantity": 2,
866+
},
867+
Object {
868+
"__cubeJoinField": null,
869+
"__user": null,
870+
"created_at": 2018-01-01T13:50:20.000Z,
871+
"quantity": 7,
872+
},
873+
Object {
874+
"__cubeJoinField": null,
875+
"__user": null,
876+
"created_at": 2017-05-13T21:23:08.000Z,
877+
"quantity": 8,
878+
},
879+
Object {
880+
"__cubeJoinField": null,
881+
"__user": null,
882+
"created_at": 2018-04-10T22:51:15.000Z,
883+
"quantity": 6,
884+
},
885+
Object {
886+
"__cubeJoinField": null,
887+
"__user": null,
888+
"created_at": 2017-07-16T15:00:34.000Z,
889+
"quantity": 1,
890+
},
891+
Object {
892+
"__cubeJoinField": null,
893+
"__user": null,
894+
"created_at": 2019-05-23T04:25:27.000Z,
895+
"quantity": 5,
896+
},
897+
Object {
898+
"__cubeJoinField": null,
899+
"__user": null,
900+
"created_at": 2018-09-29T20:29:30.000Z,
901+
"quantity": 4,
902+
},
903+
Object {
904+
"__cubeJoinField": null,
905+
"__user": null,
906+
"created_at": 2019-04-17T03:32:54.000Z,
907+
"quantity": 8,
908+
},
909+
Object {
910+
"__cubeJoinField": null,
911+
"__user": null,
912+
"created_at": 2019-11-15T18:22:17.000Z,
913+
"quantity": 8,
914+
},
915+
Object {
916+
"__cubeJoinField": null,
917+
"__user": null,
918+
"created_at": 2019-12-16T08:09:36.000Z,
919+
"quantity": 6,
920+
},
921+
]
922+
`;

‎packages/cubejs-testing/test/smoke-rbac.test.ts‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,28 @@ describe('Cube RBAC Engine', () => {
198198
});
199199
});
200200

201+
describe('RBAC via SQL changing users', () => {
202+
let connection: PgClient;
203+
204+
beforeAll(async () => {
205+
connection = await createPostgresClient('restricted', 'restricted_password');
206+
});
207+
208+
afterAll(async () => {
209+
await connection.end();
210+
}, JEST_AFTER_ALL_DEFAULT_TIMEOUT);
211+
212+
test('Switching user should allow more members to be visible', async () => {
213+
const resDefault = await connection.query('SELECT * FROM line_items limit 10');
214+
expect(resDefault.rows).toMatchSnapshot('line_items_default');
215+
216+
await connection.query('SET USER=admin');
217+
218+
const resAdmin = await connection.query('SELECT * FROM line_items limit 10');
219+
expect(resAdmin.rows).toMatchSnapshot('line_items');
220+
});
221+
});
222+
201223
describe('RBAC via REST API', () => {
202224
let client: CubeApi;
203225
let defaultClient: CubeApi;

0 commit comments

Comments
 (0)