Browse Source
* check udf and data source in order to fix issue 1770 * check udf and data source in order to fix issue 1770 * update testListAuthorizedUdfFuncpull/2/head
lgcareer
5 years ago
committed by
qiaozhanwei
13 changed files with 589 additions and 27 deletions
@ -0,0 +1,50 @@
|
||||
/* |
||||
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||
* contributor license agreements. See the NOTICE file distributed with |
||||
* this work for additional information regarding copyright ownership. |
||||
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
* (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.apache.dolphinscheduler.common.enums; |
||||
|
||||
import com.baomidou.mybatisplus.annotation.EnumValue; |
||||
|
||||
/** |
||||
* Authorization type |
||||
*/ |
||||
public enum AuthorizationType { |
||||
/** |
||||
* 0 RESOURCE_FILE; |
||||
* 1 DATASOURCE; |
||||
* 2 UDF; |
||||
*/ |
||||
RESOURCE_FILE(0, "resource file"), |
||||
DATASOURCE(1, "data source"), |
||||
UDF(2, "udf function"); |
||||
|
||||
AuthorizationType(int code, String descp){ |
||||
this.code = code; |
||||
this.descp = descp; |
||||
} |
||||
|
||||
@EnumValue |
||||
private final int code; |
||||
private final String descp; |
||||
|
||||
public int getCode() { |
||||
return code; |
||||
} |
||||
|
||||
public String getDescp() { |
||||
return descp; |
||||
} |
||||
} |
||||
@ -0,0 +1,157 @@
|
||||
/* |
||||
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||
* contributor license agreements. See the NOTICE file distributed with |
||||
* this work for additional information regarding copyright ownership. |
||||
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
* (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.apache.dolphinscheduler.dao.permission; |
||||
|
||||
import org.apache.dolphinscheduler.common.enums.AuthorizationType; |
||||
import org.apache.dolphinscheduler.common.enums.UserType; |
||||
import org.apache.dolphinscheduler.common.utils.CollectionUtils; |
||||
import org.apache.dolphinscheduler.dao.ProcessDao; |
||||
import org.apache.dolphinscheduler.dao.entity.User; |
||||
import org.slf4j.Logger; |
||||
|
||||
import java.util.List; |
||||
|
||||
public class PermissionCheck<T> { |
||||
/** |
||||
* logger |
||||
*/ |
||||
private Logger logger; |
||||
/** |
||||
* Authorization Type |
||||
*/ |
||||
private AuthorizationType authorizationType; |
||||
|
||||
/** |
||||
* Authorization Type |
||||
*/ |
||||
private ProcessDao processDao; |
||||
|
||||
/** |
||||
* need check array |
||||
*/ |
||||
private T[] needChecks; |
||||
|
||||
/** |
||||
* user id |
||||
*/ |
||||
private int userId; |
||||
|
||||
/** |
||||
* permission check |
||||
* @param authorizationType authorization type |
||||
* @param processDao process dao |
||||
*/ |
||||
public PermissionCheck(AuthorizationType authorizationType, ProcessDao processDao) { |
||||
this.authorizationType = authorizationType; |
||||
this.processDao = processDao; |
||||
} |
||||
|
||||
/** |
||||
* permission check |
||||
* @param authorizationType |
||||
* @param processDao |
||||
* @param needChecks |
||||
* @param userId |
||||
*/ |
||||
public PermissionCheck(AuthorizationType authorizationType, ProcessDao processDao, T[] needChecks, int userId) { |
||||
this.authorizationType = authorizationType; |
||||
this.processDao = processDao; |
||||
this.needChecks = needChecks; |
||||
this.userId = userId; |
||||
} |
||||
|
||||
/** |
||||
* permission check |
||||
* @param authorizationType |
||||
* @param processDao |
||||
* @param needChecks |
||||
* @param userId |
||||
* @param logger |
||||
*/ |
||||
public PermissionCheck(AuthorizationType authorizationType, ProcessDao processDao, T[] needChecks, int userId,Logger logger) { |
||||
this.authorizationType = authorizationType; |
||||
this.processDao = processDao; |
||||
this.needChecks = needChecks; |
||||
this.userId = userId; |
||||
this.logger = logger; |
||||
} |
||||
|
||||
public AuthorizationType getAuthorizationType() { |
||||
return authorizationType; |
||||
} |
||||
|
||||
public void setAuthorizationType(AuthorizationType authorizationType) { |
||||
this.authorizationType = authorizationType; |
||||
} |
||||
|
||||
public ProcessDao getProcessDao() { |
||||
return processDao; |
||||
} |
||||
|
||||
public void setProcessDao(ProcessDao processDao) { |
||||
this.processDao = processDao; |
||||
} |
||||
|
||||
public T[] getNeedChecks() { |
||||
return needChecks; |
||||
} |
||||
|
||||
public void setNeedChecks(T[] needChecks) { |
||||
this.needChecks = needChecks; |
||||
} |
||||
|
||||
public int getUserId() { |
||||
return userId; |
||||
} |
||||
|
||||
public void setUserId(int userId) { |
||||
this.userId = userId; |
||||
} |
||||
|
||||
/** |
||||
* has permission |
||||
* @return true if has permission |
||||
*/ |
||||
public boolean hasPermission(){ |
||||
try { |
||||
checkPermission(); |
||||
return true; |
||||
} catch (Exception e) { |
||||
return false; |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* check permission |
||||
* @throws Exception exception |
||||
*/ |
||||
public void checkPermission() throws Exception{ |
||||
if(this.needChecks.length > 0){ |
||||
// get user type in order to judge whether the user is admin
|
||||
User user = processDao.getUserById(userId); |
||||
if (user.getUserType() != UserType.ADMIN_USER){ |
||||
List<T> unauthorizedList = processDao.listUnauthorized(userId,needChecks,authorizationType); |
||||
// if exist unauthorized resource
|
||||
if(CollectionUtils.isNotEmpty(unauthorizedList)){ |
||||
logger.error("user {} didn't has permission of {}: {}", user.getUserName(), authorizationType.getDescp(),unauthorizedList.toString()); |
||||
throw new RuntimeException(String.format("user %s didn't has permission of %s %s", user.getUserName(), authorizationType.getDescp(), unauthorizedList.get(0))); |
||||
} |
||||
} |
||||
} |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue