Browse Source

[Fix-12828][api] Add permission check when query specific datasource (#12830)

3.2.0-release
Rick Cheng 2 years ago committed by GitHub
parent
commit
80da35e39c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 2
      dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/DataSourceController.java
  2. 2
      dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/DataSourceService.java
  3. 13
      dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/DataSourceServiceImpl.java
  4. 16
      dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/DataSourceServiceTest.java

2
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/DataSourceController.java

@ -141,7 +141,7 @@ public class DataSourceController extends BaseController {
public Result queryDataSource(@Parameter(hidden = true) @RequestAttribute(value = Constants.SESSION_USER) User loginUser, public Result queryDataSource(@Parameter(hidden = true) @RequestAttribute(value = Constants.SESSION_USER) User loginUser,
@PathVariable("id") int id) { @PathVariable("id") int id) {
Map<String, Object> result = dataSourceService.queryDataSource(id); Map<String, Object> result = dataSourceService.queryDataSource(id, loginUser);
return returnDataList(result); return returnDataList(result);
} }

2
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/DataSourceService.java

@ -55,7 +55,7 @@ public interface DataSourceService {
* @param id datasource id * @param id datasource id
* @return data source detail * @return data source detail
*/ */
Map<String, Object> queryDataSource(int id); Map<String, Object> queryDataSource(int id, User loginUser);
/** /**
* query datasource list by keyword * query datasource list by keyword

13
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/DataSourceServiceImpl.java

@ -234,7 +234,7 @@ public class DataSourceServiceImpl extends BaseServiceImpl implements DataSource
* @return data source detail * @return data source detail
*/ */
@Override @Override
public Map<String, Object> queryDataSource(int id) { public Map<String, Object> queryDataSource(int id, User loginUser) {
Map<String, Object> result = new HashMap<>(); Map<String, Object> result = new HashMap<>();
DataSource dataSource = dataSourceMapper.selectById(id); DataSource dataSource = dataSourceMapper.selectById(id);
@ -243,6 +243,13 @@ public class DataSourceServiceImpl extends BaseServiceImpl implements DataSource
putMsg(result, Status.RESOURCE_NOT_EXIST); putMsg(result, Status.RESOURCE_NOT_EXIST);
return result; return result;
} }
if (!canOperatorPermissions(loginUser, new Object[]{dataSource.getId()}, AuthorizationType.DATASOURCE,
ApiFuncIdentificationConstant.DATASOURCE)) {
putMsg(result, Status.USER_NO_OPERATION_PERM);
return result;
}
// type // type
BaseDataSourceParamDTO baseDataSourceParamDTO = DataSourceUtils.buildDatasourceParamDTO( BaseDataSourceParamDTO baseDataSourceParamDTO = DataSourceUtils.buildDatasourceParamDTO(
dataSource.getType(), dataSource.getConnectionParams()); dataSource.getType(), dataSource.getConnectionParams());
@ -272,8 +279,7 @@ public class DataSourceServiceImpl extends BaseServiceImpl implements DataSource
Page<DataSource> dataSourcePage = new Page<>(pageNo, pageSize); Page<DataSource> dataSourcePage = new Page<>(pageNo, pageSize);
PageInfo<DataSource> pageInfo = new PageInfo<>(pageNo, pageSize); PageInfo<DataSource> pageInfo = new PageInfo<>(pageNo, pageSize);
if (loginUser.getUserType().equals(UserType.ADMIN_USER)) { if (loginUser.getUserType().equals(UserType.ADMIN_USER)) {
dataSourceList = dataSourceMapper.selectPaging(dataSourcePage, dataSourceList = dataSourceMapper.selectPaging(dataSourcePage, 0, searchVal);
UserType.ADMIN_USER.equals(loginUser.getUserType()) ? 0 : loginUser.getId(), searchVal);
} else { } else {
Set<Integer> ids = resourcePermissionCheckService Set<Integer> ids = resourcePermissionCheckService
.userOwnedResourceIdsAcquisition(AuthorizationType.DATASOURCE, loginUser.getId(), logger); .userOwnedResourceIdsAcquisition(AuthorizationType.DATASOURCE, loginUser.getId(), logger);
@ -340,7 +346,6 @@ public class DataSourceServiceImpl extends BaseServiceImpl implements DataSource
datasourceList = dataSourceMapper.selectBatchIds(ids).stream() datasourceList = dataSourceMapper.selectBatchIds(ids).stream()
.filter(dataSource -> dataSource.getType().getCode() == type) .filter(dataSource -> dataSource.getType().getCode() == type)
.filter(dataSource -> dataSource.getTestFlag() == testFlag).collect(Collectors.toList()); .filter(dataSource -> dataSource.getTestFlag() == testFlag).collect(Collectors.toList());
} }
result.put(Constants.DATA_LIST, datasourceList); result.put(Constants.DATA_LIST, datasourceList);
putMsg(result, Status.SUCCESS); putMsg(result, Status.SUCCESS);

16
dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/DataSourceServiceTest.java

@ -17,6 +17,8 @@
package org.apache.dolphinscheduler.api.service; package org.apache.dolphinscheduler.api.service;
import static org.apache.dolphinscheduler.api.constants.ApiFuncIdentificationConstant.DATASOURCE;
import org.apache.dolphinscheduler.api.enums.Status; import org.apache.dolphinscheduler.api.enums.Status;
import org.apache.dolphinscheduler.api.permission.ResourcePermissionCheckService; import org.apache.dolphinscheduler.api.permission.ResourcePermissionCheckService;
import org.apache.dolphinscheduler.api.service.impl.BaseServiceImpl; import org.apache.dolphinscheduler.api.service.impl.BaseServiceImpl;
@ -334,11 +336,19 @@ public class DataSourceServiceTest {
@Test @Test
public void queryDataSourceTest() { public void queryDataSourceTest() {
Mockito.when(dataSourceMapper.selectById(Mockito.anyInt())).thenReturn(null); Mockito.when(dataSourceMapper.selectById(Mockito.anyInt())).thenReturn(null);
Map<String, Object> result = dataSourceService.queryDataSource(Mockito.anyInt()); User loginUser = new User();
loginUser.setUserType(UserType.GENERAL_USER);
loginUser.setId(2);
Map<String, Object> result = dataSourceService.queryDataSource(Mockito.anyInt(), loginUser);
Assertions.assertEquals(((Status) result.get(Constants.STATUS)).getCode(), Status.RESOURCE_NOT_EXIST.getCode()); Assertions.assertEquals(((Status) result.get(Constants.STATUS)).getCode(), Status.RESOURCE_NOT_EXIST.getCode());
Mockito.when(dataSourceMapper.selectById(Mockito.anyInt())).thenReturn(getOracleDataSource()); DataSource dataSource = getOracleDataSource(1);
result = dataSourceService.queryDataSource(Mockito.anyInt()); Mockito.when(dataSourceMapper.selectById(Mockito.anyInt())).thenReturn(dataSource);
Mockito.when(resourcePermissionCheckService.operationPermissionCheck(AuthorizationType.DATASOURCE,
loginUser.getId(), DATASOURCE, baseServiceLogger)).thenReturn(true);
Mockito.when(resourcePermissionCheckService.resourcePermissionCheck(AuthorizationType.DATASOURCE,
new Object[]{dataSource.getId()}, loginUser.getId(), baseServiceLogger)).thenReturn(true);
result = dataSourceService.queryDataSource(dataSource.getId(), loginUser);
Assertions.assertEquals(((Status) result.get(Constants.STATUS)).getCode(), Status.SUCCESS.getCode()); Assertions.assertEquals(((Status) result.get(Constants.STATUS)).getCode(), Status.SUCCESS.getCode());
} }

Loading…
Cancel
Save