Browse Source
* Create process definition with task group and task group priority cannot be save into db * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * The result of the assertion cannot be changed. The only difference is the judgment condition. * test recovery. * controller test fix. * ProjectE2ETest fix. * WebElement import. * Prioritize problem solving. * Judging the length of the set fix Co-authored-by: houshitao <shitaohou@163.com> Co-authored-by: hstdream <33045461+hstdream@users.noreply.github.com>3.1.0-release
WangJPLeo
3 years ago
committed by
GitHub
13 changed files with 548 additions and 89 deletions
@ -0,0 +1,54 @@ |
|||||||
|
/* |
||||||
|
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||||
|
* contributor license agreements. See the NOTICE file distributed with |
||||||
|
* this work for additional information regarding copyright ownership. |
||||||
|
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||||
|
* (the "License"); you may not use this file except in compliance with |
||||||
|
* the License. You may obtain a copy of the License at |
||||||
|
* |
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
* |
||||||
|
* Unless required by applicable law or agreed to in writing, software |
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
* See the License for the specific language governing permissions and |
||||||
|
* limitations under the License. |
||||||
|
*/ |
||||||
|
package org.apache.dolphinscheduler.service.permission; |
||||||
|
|
||||||
|
import org.apache.dolphinscheduler.common.enums.AuthorizationType; |
||||||
|
import org.slf4j.Logger; |
||||||
|
|
||||||
|
import java.util.Set; |
||||||
|
|
||||||
|
public interface ResourcePermissionCheckService<T>{ |
||||||
|
/** |
||||||
|
* resourcePermissionCheck |
||||||
|
* @param authorizationType |
||||||
|
* @param needChecks |
||||||
|
* @param userId |
||||||
|
* @param logger |
||||||
|
* @return |
||||||
|
*/ |
||||||
|
boolean resourcePermissionCheck(AuthorizationType authorizationType, T[] needChecks, int userId, Logger logger); |
||||||
|
|
||||||
|
/** |
||||||
|
* userOwnedResourceIdsAcquisition |
||||||
|
* @param authorizationType |
||||||
|
* @param userId |
||||||
|
* @param logger |
||||||
|
* @param <T> |
||||||
|
* @return |
||||||
|
*/ |
||||||
|
<T> Set<T> userOwnedResourceIdsAcquisition(AuthorizationType authorizationType, int userId, Logger logger); |
||||||
|
|
||||||
|
/** |
||||||
|
* operationpermissionCheck |
||||||
|
* @param authorizationType |
||||||
|
* @param userId |
||||||
|
* @param sourceUrl |
||||||
|
* @param logger |
||||||
|
* @return |
||||||
|
*/ |
||||||
|
boolean operationPermissionCheck(AuthorizationType authorizationType, int userId, String sourceUrl, Logger logger); |
||||||
|
} |
||||||
@ -0,0 +1,149 @@ |
|||||||
|
/* |
||||||
|
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||||
|
* contributor license agreements. See the NOTICE file distributed with |
||||||
|
* this work for additional information regarding copyright ownership. |
||||||
|
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||||
|
* (the "License"); you may not use this file except in compliance with |
||||||
|
* the License. You may obtain a copy of the License at |
||||||
|
* |
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
* |
||||||
|
* Unless required by applicable law or agreed to in writing, software |
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
* See the License for the specific language governing permissions and |
||||||
|
* limitations under the License. |
||||||
|
*/ |
||||||
|
/* |
||||||
|
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||||
|
* contributor license agreements. See the NOTICE file distributed with |
||||||
|
* this work for additional information regarding copyright ownership. |
||||||
|
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||||
|
* (the "License"); you may not use this file except in compliance with |
||||||
|
* the License. You may obtain a copy of the License at |
||||||
|
* |
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
* |
||||||
|
* Unless required by applicable law or agreed to in writing, software |
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
* See the License for the specific language governing permissions and |
||||||
|
* limitations under the License. |
||||||
|
*/ |
||||||
|
|
||||||
|
package org.apache.dolphinscheduler.service.permission; |
||||||
|
|
||||||
|
import org.apache.dolphinscheduler.common.enums.AuthorizationType; |
||||||
|
import org.apache.dolphinscheduler.common.enums.UserType; |
||||||
|
import org.apache.dolphinscheduler.dao.entity.*; |
||||||
|
import org.apache.dolphinscheduler.dao.mapper.*; |
||||||
|
import org.apache.dolphinscheduler.service.process.ProcessService; |
||||||
|
import org.slf4j.Logger; |
||||||
|
import org.springframework.beans.BeansException; |
||||||
|
import org.springframework.beans.factory.annotation.Autowired; |
||||||
|
import org.springframework.context.ApplicationContext; |
||||||
|
import org.springframework.context.ApplicationContextAware; |
||||||
|
import org.springframework.stereotype.Component; |
||||||
|
|
||||||
|
import java.util.*; |
||||||
|
import java.util.concurrent.ConcurrentHashMap; |
||||||
|
|
||||||
|
import static java.util.stream.Collectors.toSet; |
||||||
|
|
||||||
|
@Component |
||||||
|
public class ResourcePermissionCheckServiceImpl implements ResourcePermissionCheckService<Object>, ApplicationContextAware { |
||||||
|
|
||||||
|
@Autowired |
||||||
|
private ProcessService processService; |
||||||
|
|
||||||
|
public static final Map<AuthorizationType, ResourceAcquisitionAndPermissionCheck<?>> RESOURCE_LIST_MAP = new ConcurrentHashMap<>(); |
||||||
|
|
||||||
|
@Override |
||||||
|
public void setApplicationContext(ApplicationContext applicationContext) throws BeansException { |
||||||
|
for (ResourceAcquisitionAndPermissionCheck<?> authorizedResourceList : applicationContext.getBeansOfType(ResourceAcquisitionAndPermissionCheck.class).values()) { |
||||||
|
List<AuthorizationType> authorizationTypes = authorizedResourceList.authorizationTypes(); |
||||||
|
authorizationTypes.forEach(auth -> RESOURCE_LIST_MAP.put(auth, authorizedResourceList)); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public boolean resourcePermissionCheck(AuthorizationType authorizationType, Object[] needChecks, int userId, Logger logger) { |
||||||
|
if (Objects.nonNull(needChecks) && needChecks.length > 0){ |
||||||
|
Set<Object> originResSet = new HashSet<>(Arrays.asList(needChecks)); |
||||||
|
Set<Object> ownResSets = RESOURCE_LIST_MAP.get(authorizationType).listAuthorizedResource(userId, logger); |
||||||
|
originResSet.removeAll(ownResSets); |
||||||
|
return originResSet.isEmpty(); |
||||||
|
} |
||||||
|
return true; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public boolean operationPermissionCheck(AuthorizationType authorizationType, int userId, String sourceUrl, Logger logger) { |
||||||
|
return RESOURCE_LIST_MAP.get(authorizationType).permissionCheck(userId, sourceUrl, logger); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public <T> Set<T> userOwnedResourceIdsAcquisition(AuthorizationType authorizationType, int userId, Logger logger) { |
||||||
|
User user = processService.getUserById(userId); |
||||||
|
if (user == null){ |
||||||
|
logger.error("user id {} doesn't exist", userId); |
||||||
|
return Collections.emptySet(); |
||||||
|
} |
||||||
|
return RESOURCE_LIST_MAP.get(authorizationType).listAuthorizedResource(user.getUserType().equals(UserType.ADMIN_USER) ? 0 : userId, logger); |
||||||
|
} |
||||||
|
|
||||||
|
@Component |
||||||
|
public static class ProjectsResourceList implements ResourceAcquisitionAndPermissionCheck<Integer> { |
||||||
|
|
||||||
|
private final ProjectMapper projectMapper; |
||||||
|
|
||||||
|
@Autowired |
||||||
|
private ProcessService processService; |
||||||
|
|
||||||
|
public ProjectsResourceList(ProjectMapper projectMapper) { |
||||||
|
this.projectMapper = projectMapper; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public List<AuthorizationType> authorizationTypes() { |
||||||
|
return Collections.singletonList(AuthorizationType.PROJECTS); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public boolean permissionCheck(int userId, String url, Logger logger) { |
||||||
|
// all users can create projects
|
||||||
|
return true; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public Set<Integer> listAuthorizedResource(int userId, Logger logger) { |
||||||
|
return projectMapper.listAuthorizedProjects(userId, null).stream().map(Project::getId).collect(toSet()); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
|
||||||
|
interface ResourceAcquisitionAndPermissionCheck<T> { |
||||||
|
|
||||||
|
/** |
||||||
|
* authorization types |
||||||
|
* @return |
||||||
|
*/ |
||||||
|
List<AuthorizationType> authorizationTypes(); |
||||||
|
|
||||||
|
/** |
||||||
|
* get all resources under the user (no admin) |
||||||
|
* @param userId |
||||||
|
* @param <T> |
||||||
|
* @return |
||||||
|
*/ |
||||||
|
<T> Set<T> listAuthorizedResource(int userId, Logger logger); |
||||||
|
|
||||||
|
/** |
||||||
|
* permission check |
||||||
|
* @param userId |
||||||
|
* @return |
||||||
|
*/ |
||||||
|
boolean permissionCheck(int userId, String url, Logger logger); |
||||||
|
|
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,125 @@ |
|||||||
|
/* |
||||||
|
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||||
|
* contributor license agreements. See the NOTICE file distributed with |
||||||
|
* this work for additional information regarding copyright ownership. |
||||||
|
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||||
|
* (the "License"); you may not use this file except in compliance with |
||||||
|
* the License. You may obtain a copy of the License at |
||||||
|
* |
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
* |
||||||
|
* Unless required by applicable law or agreed to in writing, software |
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||||
|
* See the License for the specific language governing permissions and |
||||||
|
* limitations under the License. |
||||||
|
*/ |
||||||
|
package org.apache.dolphinscheduler.service.permission; |
||||||
|
|
||||||
|
|
||||||
|
import com.google.common.collect.Lists; |
||||||
|
import org.apache.dolphinscheduler.common.enums.AuthorizationType; |
||||||
|
import org.apache.dolphinscheduler.common.enums.UserType; |
||||||
|
import org.apache.dolphinscheduler.dao.entity.Project; |
||||||
|
import org.apache.dolphinscheduler.dao.entity.User; |
||||||
|
import org.apache.dolphinscheduler.dao.mapper.ProjectMapper; |
||||||
|
import org.apache.dolphinscheduler.service.process.ProcessService; |
||||||
|
import org.junit.Assert; |
||||||
|
import org.junit.Test; |
||||||
|
import org.junit.runner.RunWith; |
||||||
|
import org.mockito.InjectMocks; |
||||||
|
import org.mockito.Mock; |
||||||
|
import org.mockito.junit.MockitoJUnitRunner; |
||||||
|
import org.slf4j.Logger; |
||||||
|
import org.slf4j.LoggerFactory; |
||||||
|
import org.springframework.context.ApplicationContext; |
||||||
|
|
||||||
|
import java.util.ArrayList; |
||||||
|
import java.util.List; |
||||||
|
import java.util.Map; |
||||||
|
import java.util.Set; |
||||||
|
import java.util.concurrent.ConcurrentHashMap; |
||||||
|
|
||||||
|
/** |
||||||
|
* permission service test |
||||||
|
*/ |
||||||
|
@RunWith(MockitoJUnitRunner.class) |
||||||
|
public class ResourcePermissionCheckServiceTest { |
||||||
|
|
||||||
|
private static final Logger logger = LoggerFactory.getLogger(ResourcePermissionCheckServiceTest.class); |
||||||
|
|
||||||
|
@Mock |
||||||
|
private ProcessService processService; |
||||||
|
|
||||||
|
@Mock |
||||||
|
private ProjectMapper projectMapper; |
||||||
|
|
||||||
|
@Mock |
||||||
|
private ApplicationContext context; |
||||||
|
@Mock |
||||||
|
private ResourcePermissionCheckService<Object> resourcePermissionCheckService; |
||||||
|
|
||||||
|
@InjectMocks |
||||||
|
ResourcePermissionCheckServiceImpl resourcePermissionCheckServices; |
||||||
|
|
||||||
|
protected static final Map<AuthorizationType, ResourcePermissionCheckServiceImpl.ResourceAcquisitionAndPermissionCheck<?>> RESOURCE_LIST_MAP = new ConcurrentHashMap<>(); |
||||||
|
|
||||||
|
@Test |
||||||
|
public void testResourcePermissionCheck(){ |
||||||
|
User user = new User(); |
||||||
|
user.setId(1); |
||||||
|
Object[] obj = new Object[]{1,2}; |
||||||
|
boolean result = this.resourcePermissionCheckService.resourcePermissionCheck(AuthorizationType.PROJECTS, obj, user.getId(), logger); |
||||||
|
Assert.assertFalse(result); |
||||||
|
} |
||||||
|
|
||||||
|
@Test |
||||||
|
public void testOperationPermissionCheck(){ |
||||||
|
User user = new User(); |
||||||
|
user.setId(1); |
||||||
|
resourcePermissionCheckServices.setApplicationContext(context); |
||||||
|
Assert.assertFalse(resourcePermissionCheckService.operationPermissionCheck(AuthorizationType.PROJECTS, user.getId(), null, logger)); |
||||||
|
String sourceUrl = "/tmp/"; |
||||||
|
Assert.assertFalse(resourcePermissionCheckService.operationPermissionCheck(AuthorizationType.PROJECTS, user.getId(), sourceUrl, logger)); |
||||||
|
} |
||||||
|
|
||||||
|
@Test |
||||||
|
public void testUserOwnedResourceIdsAcquisition(){ |
||||||
|
User user = new User(); |
||||||
|
user.setId(1); |
||||||
|
//ADMIN
|
||||||
|
user.setUserType(UserType.ADMIN_USER); |
||||||
|
Object[] obj = new Object[]{1,2}; |
||||||
|
List<Project> projectList = Lists.newArrayList(this.getEntity()); |
||||||
|
Set result = resourcePermissionCheckServices.userOwnedResourceIdsAcquisition(AuthorizationType.PROJECTS, |
||||||
|
user.getId(), |
||||||
|
logger); |
||||||
|
Assert.assertNotNull(result); |
||||||
|
} |
||||||
|
|
||||||
|
|
||||||
|
@Test |
||||||
|
public void testSetApplication(){ |
||||||
|
resourcePermissionCheckServices.setApplicationContext(context); |
||||||
|
} |
||||||
|
/** |
||||||
|
* create entity |
||||||
|
*/ |
||||||
|
private Project getEntity() { |
||||||
|
Project project = new Project(); |
||||||
|
project.setId(1); |
||||||
|
project.setUserId(1); |
||||||
|
project.setName("permissionsTest"); |
||||||
|
project.setUserName("permissionTest"); |
||||||
|
return project; |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* entity list |
||||||
|
*/ |
||||||
|
private List<Project> getList() { |
||||||
|
List<Project> list = new ArrayList<>(); |
||||||
|
list.add(getEntity()); |
||||||
|
return list; |
||||||
|
} |
||||||
|
} |
||||||
Loading…
Reference in new issue