You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iotdb.apache.org by yo...@apache.org on 2025/10/12 06:10:11 UTC
(iotdb) branch patch-for-authentication updated: Update ITableAuthCheckerImpl.java
This is an automated email from the ASF dual-hosted git repository.
yongzao pushed a commit to branch patch-for-authentication
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/patch-for-authentication by this push:
new 735a6290281 Update ITableAuthCheckerImpl.java
735a6290281 is described below
commit 735a62902816c1b8c8438bf2675b16f7b122f18c
Author: Yongzao <53...@qq.com>
AuthorDate: Sun Oct 12 14:10:03 2025 +0800
Update ITableAuthCheckerImpl.java
---
.../relational/security/ITableAuthCheckerImpl.java | 36 +++++++++++-----------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java
index 29fc704d85f..4781b0c428d 100644
--- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java
+++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/ITableAuthCheckerImpl.java
@@ -66,23 +66,19 @@ public class ITableAuthCheckerImpl implements ITableAuthChecker {
}
if (TABLE_MODEL_AUDIT_DATABASE.equalsIgnoreCase(databaseName)) {
+ // The audit database only requires audit privilege
+ boolean hasAuditPrivilege =
+ AuthorityChecker.checkSystemPermission(userName, PrivilegeType.AUDIT);
+ recordAuditLog(
+ auditEntity
+ .setAuditLogOperation(AuditLogOperation.QUERY)
+ .setPrivilegeType(PrivilegeType.AUDIT)
+ .setResult(hasAuditPrivilege),
+ () -> databaseName);
if (AuthorityChecker.checkSystemPermission(userName, PrivilegeType.AUDIT)) {
- recordAuditLog(
- auditEntity
- .setAuditLogOperation(AuditLogOperation.QUERY)
- .setPrivilegeType(PrivilegeType.READ_SCHEMA)
- .setResult(true),
- () -> databaseName);
return;
- } else {
- recordAuditLog(
- auditEntity
- .setAuditLogOperation(AuditLogOperation.QUERY)
- .setPrivilegeType(PrivilegeType.READ_SCHEMA)
- .setResult(false),
- () -> databaseName);
- throw new AccessDeniedException("DATABASE " + databaseName);
}
+ throw new AccessDeniedException("DATABASE " + databaseName);
}
if (AuthorityChecker.checkSystemPermission(userName, PrivilegeType.SYSTEM)) {
@@ -341,14 +337,18 @@ public class ITableAuthCheckerImpl implements ITableAuthChecker {
}
String databaseName = tableName.getDatabaseName();
- if (TABLE_MODEL_AUDIT_DATABASE.equalsIgnoreCase(databaseName)
- && !AuthorityChecker.checkSystemPermission(userName, PrivilegeType.AUDIT)) {
+ if (TABLE_MODEL_AUDIT_DATABASE.equalsIgnoreCase(databaseName)) {
+ // The audit table only requires audit privilege
+ boolean hasAuditPrivilege = AuthorityChecker.checkSystemPermission(userName, PrivilegeType.AUDIT);
recordAuditLog(
auditEntity
.setAuditLogOperation(AuditLogOperation.QUERY)
- .setPrivilegeType(PrivilegeType.READ_SCHEMA)
- .setResult(false),
+ .setPrivilegeType(PrivilegeType.AUDIT)
+ .setResult(hasAuditPrivilege),
tableName::getObjectName);
+ if (hasAuditPrivilege) {
+ return;
+ }
throw new AccessDeniedException("TABLE " + tableName);
}