Browse Source
* Create process definition with task group and task group priority cannot be save into db * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * [Feature][API] Permission control of project * The result of the assertion cannot be changed. The only difference is the judgment condition. * test recovery. * controller test fix. * ProjectE2ETest fix. * WebElement import. * Prioritize problem solving. * Judging the length of the set fix Co-authored-by: houshitao <shitaohou@163.com> Co-authored-by: hstdream <33045461+hstdream@users.noreply.github.com>3.1.0-release
WangJPLeo
3 years ago
committed by
GitHub
13 changed files with 548 additions and 89 deletions
@ -0,0 +1,54 @@
|
||||
/* |
||||
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||
* contributor license agreements. See the NOTICE file distributed with |
||||
* this work for additional information regarding copyright ownership. |
||||
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
* (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.apache.dolphinscheduler.service.permission; |
||||
|
||||
import org.apache.dolphinscheduler.common.enums.AuthorizationType; |
||||
import org.slf4j.Logger; |
||||
|
||||
import java.util.Set; |
||||
|
||||
public interface ResourcePermissionCheckService<T>{ |
||||
/** |
||||
* resourcePermissionCheck |
||||
* @param authorizationType |
||||
* @param needChecks |
||||
* @param userId |
||||
* @param logger |
||||
* @return |
||||
*/ |
||||
boolean resourcePermissionCheck(AuthorizationType authorizationType, T[] needChecks, int userId, Logger logger); |
||||
|
||||
/** |
||||
* userOwnedResourceIdsAcquisition |
||||
* @param authorizationType |
||||
* @param userId |
||||
* @param logger |
||||
* @param <T> |
||||
* @return |
||||
*/ |
||||
<T> Set<T> userOwnedResourceIdsAcquisition(AuthorizationType authorizationType, int userId, Logger logger); |
||||
|
||||
/** |
||||
* operationpermissionCheck |
||||
* @param authorizationType |
||||
* @param userId |
||||
* @param sourceUrl |
||||
* @param logger |
||||
* @return |
||||
*/ |
||||
boolean operationPermissionCheck(AuthorizationType authorizationType, int userId, String sourceUrl, Logger logger); |
||||
} |
||||
@ -0,0 +1,149 @@
|
||||
/* |
||||
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||
* contributor license agreements. See the NOTICE file distributed with |
||||
* this work for additional information regarding copyright ownership. |
||||
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
* (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
/* |
||||
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||
* contributor license agreements. See the NOTICE file distributed with |
||||
* this work for additional information regarding copyright ownership. |
||||
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
* (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.apache.dolphinscheduler.service.permission; |
||||
|
||||
import org.apache.dolphinscheduler.common.enums.AuthorizationType; |
||||
import org.apache.dolphinscheduler.common.enums.UserType; |
||||
import org.apache.dolphinscheduler.dao.entity.*; |
||||
import org.apache.dolphinscheduler.dao.mapper.*; |
||||
import org.apache.dolphinscheduler.service.process.ProcessService; |
||||
import org.slf4j.Logger; |
||||
import org.springframework.beans.BeansException; |
||||
import org.springframework.beans.factory.annotation.Autowired; |
||||
import org.springframework.context.ApplicationContext; |
||||
import org.springframework.context.ApplicationContextAware; |
||||
import org.springframework.stereotype.Component; |
||||
|
||||
import java.util.*; |
||||
import java.util.concurrent.ConcurrentHashMap; |
||||
|
||||
import static java.util.stream.Collectors.toSet; |
||||
|
||||
@Component |
||||
public class ResourcePermissionCheckServiceImpl implements ResourcePermissionCheckService<Object>, ApplicationContextAware { |
||||
|
||||
@Autowired |
||||
private ProcessService processService; |
||||
|
||||
public static final Map<AuthorizationType, ResourceAcquisitionAndPermissionCheck<?>> RESOURCE_LIST_MAP = new ConcurrentHashMap<>(); |
||||
|
||||
@Override |
||||
public void setApplicationContext(ApplicationContext applicationContext) throws BeansException { |
||||
for (ResourceAcquisitionAndPermissionCheck<?> authorizedResourceList : applicationContext.getBeansOfType(ResourceAcquisitionAndPermissionCheck.class).values()) { |
||||
List<AuthorizationType> authorizationTypes = authorizedResourceList.authorizationTypes(); |
||||
authorizationTypes.forEach(auth -> RESOURCE_LIST_MAP.put(auth, authorizedResourceList)); |
||||
} |
||||
} |
||||
|
||||
@Override |
||||
public boolean resourcePermissionCheck(AuthorizationType authorizationType, Object[] needChecks, int userId, Logger logger) { |
||||
if (Objects.nonNull(needChecks) && needChecks.length > 0){ |
||||
Set<Object> originResSet = new HashSet<>(Arrays.asList(needChecks)); |
||||
Set<Object> ownResSets = RESOURCE_LIST_MAP.get(authorizationType).listAuthorizedResource(userId, logger); |
||||
originResSet.removeAll(ownResSets); |
||||
return originResSet.isEmpty(); |
||||
} |
||||
return true; |
||||
} |
||||
|
||||
@Override |
||||
public boolean operationPermissionCheck(AuthorizationType authorizationType, int userId, String sourceUrl, Logger logger) { |
||||
return RESOURCE_LIST_MAP.get(authorizationType).permissionCheck(userId, sourceUrl, logger); |
||||
} |
||||
|
||||
@Override |
||||
public <T> Set<T> userOwnedResourceIdsAcquisition(AuthorizationType authorizationType, int userId, Logger logger) { |
||||
User user = processService.getUserById(userId); |
||||
if (user == null){ |
||||
logger.error("user id {} doesn't exist", userId); |
||||
return Collections.emptySet(); |
||||
} |
||||
return RESOURCE_LIST_MAP.get(authorizationType).listAuthorizedResource(user.getUserType().equals(UserType.ADMIN_USER) ? 0 : userId, logger); |
||||
} |
||||
|
||||
@Component |
||||
public static class ProjectsResourceList implements ResourceAcquisitionAndPermissionCheck<Integer> { |
||||
|
||||
private final ProjectMapper projectMapper; |
||||
|
||||
@Autowired |
||||
private ProcessService processService; |
||||
|
||||
public ProjectsResourceList(ProjectMapper projectMapper) { |
||||
this.projectMapper = projectMapper; |
||||
} |
||||
|
||||
@Override |
||||
public List<AuthorizationType> authorizationTypes() { |
||||
return Collections.singletonList(AuthorizationType.PROJECTS); |
||||
} |
||||
|
||||
@Override |
||||
public boolean permissionCheck(int userId, String url, Logger logger) { |
||||
// all users can create projects
|
||||
return true; |
||||
} |
||||
|
||||
@Override |
||||
public Set<Integer> listAuthorizedResource(int userId, Logger logger) { |
||||
return projectMapper.listAuthorizedProjects(userId, null).stream().map(Project::getId).collect(toSet()); |
||||
} |
||||
} |
||||
|
||||
|
||||
interface ResourceAcquisitionAndPermissionCheck<T> { |
||||
|
||||
/** |
||||
* authorization types |
||||
* @return |
||||
*/ |
||||
List<AuthorizationType> authorizationTypes(); |
||||
|
||||
/** |
||||
* get all resources under the user (no admin) |
||||
* @param userId |
||||
* @param <T> |
||||
* @return |
||||
*/ |
||||
<T> Set<T> listAuthorizedResource(int userId, Logger logger); |
||||
|
||||
/** |
||||
* permission check |
||||
* @param userId |
||||
* @return |
||||
*/ |
||||
boolean permissionCheck(int userId, String url, Logger logger); |
||||
|
||||
} |
||||
} |
||||
@ -0,0 +1,125 @@
|
||||
/* |
||||
* Licensed to the Apache Software Foundation (ASF) under one or more |
||||
* contributor license agreements. See the NOTICE file distributed with |
||||
* this work for additional information regarding copyright ownership. |
||||
* The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
* (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.apache.dolphinscheduler.service.permission; |
||||
|
||||
|
||||
import com.google.common.collect.Lists; |
||||
import org.apache.dolphinscheduler.common.enums.AuthorizationType; |
||||
import org.apache.dolphinscheduler.common.enums.UserType; |
||||
import org.apache.dolphinscheduler.dao.entity.Project; |
||||
import org.apache.dolphinscheduler.dao.entity.User; |
||||
import org.apache.dolphinscheduler.dao.mapper.ProjectMapper; |
||||
import org.apache.dolphinscheduler.service.process.ProcessService; |
||||
import org.junit.Assert; |
||||
import org.junit.Test; |
||||
import org.junit.runner.RunWith; |
||||
import org.mockito.InjectMocks; |
||||
import org.mockito.Mock; |
||||
import org.mockito.junit.MockitoJUnitRunner; |
||||
import org.slf4j.Logger; |
||||
import org.slf4j.LoggerFactory; |
||||
import org.springframework.context.ApplicationContext; |
||||
|
||||
import java.util.ArrayList; |
||||
import java.util.List; |
||||
import java.util.Map; |
||||
import java.util.Set; |
||||
import java.util.concurrent.ConcurrentHashMap; |
||||
|
||||
/** |
||||
* permission service test |
||||
*/ |
||||
@RunWith(MockitoJUnitRunner.class) |
||||
public class ResourcePermissionCheckServiceTest { |
||||
|
||||
private static final Logger logger = LoggerFactory.getLogger(ResourcePermissionCheckServiceTest.class); |
||||
|
||||
@Mock |
||||
private ProcessService processService; |
||||
|
||||
@Mock |
||||
private ProjectMapper projectMapper; |
||||
|
||||
@Mock |
||||
private ApplicationContext context; |
||||
@Mock |
||||
private ResourcePermissionCheckService<Object> resourcePermissionCheckService; |
||||
|
||||
@InjectMocks |
||||
ResourcePermissionCheckServiceImpl resourcePermissionCheckServices; |
||||
|
||||
protected static final Map<AuthorizationType, ResourcePermissionCheckServiceImpl.ResourceAcquisitionAndPermissionCheck<?>> RESOURCE_LIST_MAP = new ConcurrentHashMap<>(); |
||||
|
||||
@Test |
||||
public void testResourcePermissionCheck(){ |
||||
User user = new User(); |
||||
user.setId(1); |
||||
Object[] obj = new Object[]{1,2}; |
||||
boolean result = this.resourcePermissionCheckService.resourcePermissionCheck(AuthorizationType.PROJECTS, obj, user.getId(), logger); |
||||
Assert.assertFalse(result); |
||||
} |
||||
|
||||
@Test |
||||
public void testOperationPermissionCheck(){ |
||||
User user = new User(); |
||||
user.setId(1); |
||||
resourcePermissionCheckServices.setApplicationContext(context); |
||||
Assert.assertFalse(resourcePermissionCheckService.operationPermissionCheck(AuthorizationType.PROJECTS, user.getId(), null, logger)); |
||||
String sourceUrl = "/tmp/"; |
||||
Assert.assertFalse(resourcePermissionCheckService.operationPermissionCheck(AuthorizationType.PROJECTS, user.getId(), sourceUrl, logger)); |
||||
} |
||||
|
||||
@Test |
||||
public void testUserOwnedResourceIdsAcquisition(){ |
||||
User user = new User(); |
||||
user.setId(1); |
||||
//ADMIN
|
||||
user.setUserType(UserType.ADMIN_USER); |
||||
Object[] obj = new Object[]{1,2}; |
||||
List<Project> projectList = Lists.newArrayList(this.getEntity()); |
||||
Set result = resourcePermissionCheckServices.userOwnedResourceIdsAcquisition(AuthorizationType.PROJECTS, |
||||
user.getId(), |
||||
logger); |
||||
Assert.assertNotNull(result); |
||||
} |
||||
|
||||
|
||||
@Test |
||||
public void testSetApplication(){ |
||||
resourcePermissionCheckServices.setApplicationContext(context); |
||||
} |
||||
/** |
||||
* create entity |
||||
*/ |
||||
private Project getEntity() { |
||||
Project project = new Project(); |
||||
project.setId(1); |
||||
project.setUserId(1); |
||||
project.setName("permissionsTest"); |
||||
project.setUserName("permissionTest"); |
||||
return project; |
||||
} |
||||
|
||||
/** |
||||
* entity list |
||||
*/ |
||||
private List<Project> getList() { |
||||
List<Project> list = new ArrayList<>(); |
||||
list.add(getEntity()); |
||||
return list; |
||||
} |
||||
} |
||||
Loading…
Reference in new issue