You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iotdb.apache.org by ja...@apache.org on 2025/09/23 23:58:36 UTC
(iotdb) branch master updated: Refactor TreeAccessCheckVisitor
This is an automated email from the ASF dual-hosted git repository.
jackietien pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/master by this push:
new c9b441a212c Refactor TreeAccessCheckVisitor
c9b441a212c is described below
commit c9b441a212c61eca42b059eca99d6211b827748c
Author: Jackie Tien <ja...@gmail.com>
AuthorDate: Wed Sep 24 07:58:30 2025 +0800
Refactor TreeAccessCheckVisitor
---
.../security/TreeAccessCheckVisitor.java | 87 +++++++++++++++-------
.../org/apache/iotdb/commons/auth/entity/User.java | 6 ++
.../iotdb/commons/auth/user/BasicUserManager.java | 10 +--
3 files changed, 72 insertions(+), 31 deletions(-)
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java
index b0e018eb8aa..4dbd54b457a 100644
--- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java
+++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/relational/security/TreeAccessCheckVisitor.java
@@ -82,9 +82,14 @@ import org.apache.iotdb.db.queryengine.plan.statement.metadata.ShowTriggersState
import org.apache.iotdb.db.queryengine.plan.statement.metadata.ShowVariablesStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.UnSetTTLStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.CreateModelStatement;
+import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.CreateTrainingStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.DropModelStatement;
+import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.LoadModelStatement;
+import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.ShowAIDevicesStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.ShowAINodesStatement;
+import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.ShowLoadedModelsStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.ShowModelsStatement;
+import org.apache.iotdb.db.queryengine.plan.statement.metadata.model.UnloadModelStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.pipe.AlterPipeStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.pipe.CreatePipePluginStatement;
import org.apache.iotdb.db.queryengine.plan.statement.metadata.pipe.CreatePipeStatement;
@@ -123,8 +128,10 @@ import org.apache.iotdb.db.queryengine.plan.statement.metadata.view.ShowLogicalV
import org.apache.iotdb.db.queryengine.plan.statement.sys.AuthorStatement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.ClearCacheStatement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.ExplainAnalyzeStatement;
+import org.apache.iotdb.db.queryengine.plan.statement.sys.ExplainStatement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.FlushStatement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.KillQueryStatement;
+import org.apache.iotdb.db.queryengine.plan.statement.sys.LoadConfigurationStatement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.SetConfigurationStatement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.SetSqlDialectStatement;
import org.apache.iotdb.db.queryengine.plan.statement.sys.SetSystemStatusStatement;
@@ -161,10 +168,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
@Override
public TSStatus visitNode(StatementNode node, TreeAccessCheckContext context) {
- if (AuthorityChecker.SUPER_USER.equals(context.getUsername())) {
- return SUCCEED;
- }
- return AuthorityChecker.getTSStatus(false, "Only the admin user can perform this operation");
+ throw new IllegalStateException("Each operation should have permission check.");
}
@Override
@@ -229,7 +233,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
return SUCCEED;
}
// own SYSTEM can see all, otherwise can only see PATHS that user has READ_SCHEMA auth
- if (!AuthorityChecker.checkSystemPermission(context.getUsername(), PrivilegeType.SYSTEM)) {
+ if (!checkHasGlobalAuth(context.getUsername(), PrivilegeType.SYSTEM)) {
statement.setCanSeeAll(false);
return visitAuthorityInformation(statement, context);
} else {
@@ -289,11 +293,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
if (AuthorityChecker.SUPER_USER.equals(context.getUsername())) {
return SUCCEED;
}
- return AuthorityChecker.getTSStatus(
- AuthorityChecker.checkSystemPermission(context.getUsername(), PrivilegeType.SYSTEM)
- || AuthorityChecker.checkSystemPermission(
- context.getUsername(), PrivilegeType.EXTEND_TEMPLATE),
- PrivilegeType.SYSTEM);
+ return checkGlobalAuth(context.getUsername(), PrivilegeType.EXTEND_TEMPLATE);
}
// ============================= timeseries view related ===============
@@ -455,8 +455,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
}
case LIST_ROLE:
- if (AuthorityChecker.checkSystemPermission(
- context.getUsername(), PrivilegeType.MANAGE_ROLE)) {
+ if (checkHasGlobalAuth(context.getUsername(), PrivilegeType.MANAGE_ROLE)) {
return SUCCEED;
}
// list roles of other user is not allowed
@@ -572,6 +571,36 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
return checkModelManagement(context.getUsername());
}
+ @Override
+ public TSStatus visitCreateTraining(
+ CreateTrainingStatement createTrainingStatement, TreeAccessCheckContext context) {
+ return checkModelManagement(context.getUsername());
+ }
+
+ @Override
+ public TSStatus visitUnloadModel(
+ UnloadModelStatement unloadModelStatement, TreeAccessCheckContext context) {
+ return checkModelManagement(context.getUsername());
+ }
+
+ @Override
+ public TSStatus visitLoadModel(
+ LoadModelStatement loadModelStatement, TreeAccessCheckContext context) {
+ return checkModelManagement(context.getUsername());
+ }
+
+ @Override
+ public TSStatus visitShowAIDevices(
+ ShowAIDevicesStatement showAIDevicesStatement, TreeAccessCheckContext context) {
+ return checkModelManagement(context.getUsername());
+ }
+
+ @Override
+ public TSStatus visitShowLoadedModels(
+ ShowLoadedModelsStatement showLoadedModelsStatement, TreeAccessCheckContext context) {
+ return SUCCEED;
+ }
+
@Override
public TSStatus visitShowModels(ShowModelsStatement statement, TreeAccessCheckContext context) {
return SUCCEED;
@@ -691,10 +720,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
if (AuthorityChecker.SUPER_USER.equals(userName)) {
return SUCCEED;
}
- return AuthorityChecker.getTSStatus(
- AuthorityChecker.checkSystemPermission(userName, PrivilegeType.SYSTEM)
- || AuthorityChecker.checkSystemPermission(userName, PrivilegeType.USE_TRIGGER),
- PrivilegeType.SYSTEM);
+ return checkGlobalAuth(userName, PrivilegeType.USE_TRIGGER);
}
// ============================== database related ===========================
@@ -744,11 +770,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
if (AuthorityChecker.SUPER_USER.equals(context.getUsername())) {
return SUCCEED;
}
- return AuthorityChecker.getTSStatus(
- AuthorityChecker.checkSystemPermission(context.getUsername(), PrivilegeType.SYSTEM)
- || AuthorityChecker.checkSystemPermission(
- context.getUsername(), PrivilegeType.MANAGE_DATABASE),
- PrivilegeType.SYSTEM);
+ return checkGlobalAuth(context.getUsername(), PrivilegeType.MANAGE_DATABASE);
}
private TSStatus checkCreateOrAlterDatabasePermission(String userName, PartialPath databaseName) {
@@ -762,10 +784,7 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
return SUCCEED;
}
- return AuthorityChecker.getTSStatus(
- AuthorityChecker.checkSystemPermission(userName, PrivilegeType.SYSTEM)
- || AuthorityChecker.checkSystemPermission(userName, PrivilegeType.MANAGE_DATABASE),
- PrivilegeType.SYSTEM);
+ return checkGlobalAuth(userName, PrivilegeType.MANAGE_DATABASE);
}
private TSStatus checkShowOrCountDatabasePermission(
@@ -855,6 +874,11 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
return statement.getQueryStatement().accept(this, context);
}
+ @Override
+ public TSStatus visitExplain(ExplainStatement explainStatement, TreeAccessCheckContext context) {
+ return explainStatement.getQueryStatement().accept(this, context);
+ }
+
// ============================= timeseries related =================================
public static TSStatus checkTimeSeriesPermission(
String userName, List<? extends PartialPath> checkedPaths, PrivilegeType permission) {
@@ -1280,6 +1304,12 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
return SUCCEED;
}
+ @Override
+ public TSStatus visitLoadConfiguration(
+ LoadConfigurationStatement loadConfigurationStatement, TreeAccessCheckContext context) {
+ return checkOnlySuperUser(context.getUsername());
+ }
+
// ======================== TTL related ===========================
@Override
public TSStatus visitSetTTL(SetTTLStatement statement, TreeAccessCheckContext context) {
@@ -1429,4 +1459,11 @@ public class TreeAccessCheckVisitor extends StatementVisitor<TSStatus, TreeAcces
statement.setCanSeeAuditDB(false);
}
}
+
+ private TSStatus checkOnlySuperUser(String userName) {
+ if (AuthorityChecker.SUPER_USER.equals(userName)) {
+ return SUCCEED;
+ }
+ return AuthorityChecker.getTSStatus(false, "Only the admin user can perform this operation");
+ }
}
diff --git a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/User.java b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/User.java
index f6258ab1d0c..d2907846738 100644
--- a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/User.java
+++ b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/User.java
@@ -36,6 +36,12 @@ import java.util.Set;
/** This class contains all information of a User. */
public class User extends Role {
+ public static final long INTERNAL_USER_END_ID = 9999;
+
+ public static final long INTERNAL_SYSTEM_ADMIN = 1;
+ public static final long INTERNAL_SECURITY_ADMIN = 2;
+ public static final long INTERNAL_AUDIT_ADMIN = 3;
+
private long userId = -1;
private String password;
diff --git a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java
index 885e9a831e5..96d5ad7cc42 100644
--- a/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java
+++ b/iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/user/BasicUserManager.java
@@ -40,6 +40,8 @@ import org.slf4j.LoggerFactory;
import java.io.IOException;
import java.util.Map;
+import static org.apache.iotdb.commons.auth.entity.User.INTERNAL_USER_END_ID;
+
/** This class stores information of each user. */
public abstract class BasicUserManager extends BasicRoleManager {
@@ -55,7 +57,7 @@ public abstract class BasicUserManager extends BasicRoleManager {
return "No such user %s";
}
- protected long nextUserId = 9999;
+ protected long nextUserId = INTERNAL_USER_END_ID;
/**
* BasicUserManager Constructor.
@@ -151,11 +153,7 @@ public abstract class BasicUserManager extends BasicRoleManager {
private void initUserId() {
try {
long maxUserId = this.accessor.loadUserId();
- if (maxUserId < 9999) {
- nextUserId = 9999;
- } else {
- nextUserId = maxUserId;
- }
+ nextUserId = Math.max(maxUserId, INTERNAL_USER_END_ID);
for (Map.Entry<String, Role> userEntry : entityMap.entrySet()) {
User user = (User) userEntry.getValue();