You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iotdb.apache.org by ja...@apache.org on 2023/11/29 06:13:30 UTC
(iotdb) branch master updated: Only root can alter template
This is an automated email from the ASF dual-hosted git repository.
jackietien pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/master by this push:
new afc6c7f916f Only root can alter template
afc6c7f916f is described below
commit afc6c7f916fdcd0a3e17b7bf3ef0394b7d03299a
Author: Jackie Tien <ja...@gmail.com>
AuthorDate: Wed Nov 29 14:13:24 2023 +0800
Only root can alter template
---
.../org/apache/iotdb/db/it/auth/IoTDBAuthIT.java | 15 +++++-
.../db/it/auth/IoTDBTemplatePermissionIT.java | 5 ++
.../analyze/schema/AutoCreateSchemaExecutor.java | 61 ++++++++++++++++------
.../template/AlterSchemaTemplateStatement.java | 19 -------
4 files changed, 64 insertions(+), 36 deletions(-)
diff --git a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
index 7dca5a275a1..974d45e5baa 100644
--- a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
+++ b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBAuthIT.java
@@ -1180,13 +1180,26 @@ public class IoTDBAuthIT {
adminStmt.execute("CREATE DATABASE root.a");
adminStmt.execute("create schema template t1 aligned (s_name TEXT)");
+ adminStmt.execute("GRANT EXTEND_TEMPLATE ON root.** TO USER tempuser");
adminStmt.execute("GRANT WRITE_DATA ON root.a.** TO USER tempuser");
adminStmt.execute("set schema template t1 to root.a");
// grant privilege to insert
Assert.assertThrows(
SQLException.class,
- () -> userStmt.execute("INSERT INTO root.a.d1(timestamp, s_name) VALUES (1,'IoTDB')"));
+ () ->
+ userStmt.execute(
+ "INSERT INTO root.a.d1(timestamp, s_name, s_value) VALUES (1,'IoTDB', 2)"));
+
+ adminStmt.execute("GRANT WRITE_SCHEMA ON root.a.d1.** TO USER tempuser");
+ userStmt.execute("INSERT INTO root.a.d1(timestamp, s_name, s_value) VALUES (1,'IoTDB', 2)");
+ adminStmt.execute("REVOKE EXTEND_TEMPLATE ON root.** FROM USER tempuser");
+
+ Assert.assertThrows(
+ SQLException.class,
+ () ->
+ userStmt.execute(
+ "INSERT INTO root.a.d1(timestamp, s_name, s_value, s_value_2) VALUES (1,'IoTDB', 2, 2)"));
}
}
}
diff --git a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBTemplatePermissionIT.java b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBTemplatePermissionIT.java
index db3d335efcd..7ac8a1e96a5 100644
--- a/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBTemplatePermissionIT.java
+++ b/integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBTemplatePermissionIT.java
@@ -72,6 +72,11 @@ public class IoTDBTemplatePermissionIT {
"803: Only the admin user can perform this operation",
"test",
"test123");
+ assertNonQueryTestFail(
+ "alter device template t1 add (speed FLOAT encoding=RLE, FLOAT TEXT encoding=PLAIN compression=SNAPPY)",
+ "803: Only the admin user can perform this operation",
+ "test",
+ "test123");
assertNonQueryTestFail(
"show device templates",
"803: Only the admin user can perform this operation",
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/analyze/schema/AutoCreateSchemaExecutor.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/analyze/schema/AutoCreateSchemaExecutor.java
index 5340cd9c378..4fca45790ea 100644
--- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/analyze/schema/AutoCreateSchemaExecutor.java
+++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/analyze/schema/AutoCreateSchemaExecutor.java
@@ -20,10 +20,12 @@
package org.apache.iotdb.db.queryengine.plan.analyze.schema;
import org.apache.iotdb.common.rpc.thrift.TSStatus;
+import org.apache.iotdb.commons.auth.entity.PrivilegeType;
import org.apache.iotdb.commons.exception.IoTDBException;
import org.apache.iotdb.commons.exception.MetadataException;
import org.apache.iotdb.commons.path.MeasurementPath;
import org.apache.iotdb.commons.path.PartialPath;
+import org.apache.iotdb.commons.service.metric.PerformanceOverviewMetrics;
import org.apache.iotdb.db.auth.AuthorityChecker;
import org.apache.iotdb.db.conf.IoTDBConfig;
import org.apache.iotdb.db.conf.IoTDBDescriptor;
@@ -194,12 +196,44 @@ class AutoCreateSchemaExecutor {
List<String> measurementList,
List<TSDataType> dataTypeList,
MPPQueryContext context) {
+ long startTime = System.nanoTime();
+ try {
+ String userName = context.getSession().getUserName();
+ if (!AuthorityChecker.SUPER_USER.equals(userName)) {
+ TSStatus status =
+ AuthorityChecker.getTSStatus(
+ AuthorityChecker.checkSystemPermission(
+ userName, PrivilegeType.EXTEND_TEMPLATE.ordinal()),
+ PrivilegeType.EXTEND_TEMPLATE);
+ if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
+ throw new RuntimeException(new IoTDBException(status.getMessage(), status.getCode()));
+ }
+ }
+ } finally {
+ PerformanceOverviewMetrics.getInstance().recordAuthCost(System.nanoTime() - startTime);
+ }
internalExtendTemplate(templateName, measurementList, dataTypeList, null, null, context);
}
// Used for insert records or tablets
void autoExtendTemplate(
Map<String, TemplateExtendInfo> templateExtendInfoMap, MPPQueryContext context) {
+ long startTime = System.nanoTime();
+ try {
+ String userName = context.getSession().getUserName();
+ if (!AuthorityChecker.SUPER_USER.equals(userName)) {
+ TSStatus status =
+ AuthorityChecker.getTSStatus(
+ AuthorityChecker.checkSystemPermission(
+ userName, PrivilegeType.EXTEND_TEMPLATE.ordinal()),
+ PrivilegeType.EXTEND_TEMPLATE);
+ if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
+ throw new RuntimeException(new IoTDBException(status.getMessage(), status.getCode()));
+ }
+ }
+ } finally {
+ PerformanceOverviewMetrics.getInstance().recordAuthCost(System.nanoTime() - startTime);
+ }
TemplateExtendInfo templateExtendInfo;
for (Map.Entry<String, TemplateExtendInfo> entry : templateExtendInfoMap.entrySet()) {
templateExtendInfo = entry.getValue().deduplicate();
@@ -598,22 +632,17 @@ class AutoCreateSchemaExecutor {
List<CompressionType> compressionTypeList,
MPPQueryContext context) {
- AlterSchemaTemplateStatement statement =
- new AlterSchemaTemplateStatement(
- templateName,
- measurementList,
- dataTypeList,
- encodingList,
- compressionTypeList,
- TemplateAlterOperationType.EXTEND_TEMPLATE);
- TSStatus status =
- AuthorityChecker.checkAuthority(statement, context.getSession().getUserName());
- if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
- throw new RuntimeException(new IoTDBException(status.getMessage(), status.getCode()));
- }
-
- ExecutionResult executionResult = executeStatement(statement, context);
- status = executionResult.status;
+ ExecutionResult executionResult =
+ executeStatement(
+ new AlterSchemaTemplateStatement(
+ templateName,
+ measurementList,
+ dataTypeList,
+ encodingList,
+ compressionTypeList,
+ TemplateAlterOperationType.EXTEND_TEMPLATE),
+ context);
+ TSStatus status = executionResult.status;
if (status.getCode() != TSStatusCode.SUCCESS_STATUS.getStatusCode()
&& status.getCode()
!= TSStatusCode.MEASUREMENT_ALREADY_EXISTS_IN_TEMPLATE.getStatusCode()) {
diff --git a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/metadata/template/AlterSchemaTemplateStatement.java b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/metadata/template/AlterSchemaTemplateStatement.java
index 0863d7f5aae..91b4ebce012 100644
--- a/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/metadata/template/AlterSchemaTemplateStatement.java
+++ b/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/statement/metadata/template/AlterSchemaTemplateStatement.java
@@ -19,10 +19,7 @@
package org.apache.iotdb.db.queryengine.plan.statement.metadata.template;
-import org.apache.iotdb.common.rpc.thrift.TSStatus;
-import org.apache.iotdb.commons.auth.entity.PrivilegeType;
import org.apache.iotdb.commons.path.PartialPath;
-import org.apache.iotdb.db.auth.AuthorityChecker;
import org.apache.iotdb.db.queryengine.plan.analyze.QueryType;
import org.apache.iotdb.db.queryengine.plan.statement.IConfigStatement;
import org.apache.iotdb.db.queryengine.plan.statement.Statement;
@@ -31,7 +28,6 @@ import org.apache.iotdb.db.queryengine.plan.statement.StatementVisitor;
import org.apache.iotdb.db.schemaengine.template.TemplateAlterOperationType;
import org.apache.iotdb.db.schemaengine.template.alter.TemplateAlterInfo;
import org.apache.iotdb.db.schemaengine.template.alter.TemplateExtendInfo;
-import org.apache.iotdb.rpc.TSStatusCode;
import org.apache.iotdb.tsfile.file.metadata.enums.CompressionType;
import org.apache.iotdb.tsfile.file.metadata.enums.TSDataType;
import org.apache.iotdb.tsfile.file.metadata.enums.TSEncoding;
@@ -85,21 +81,6 @@ public class AlterSchemaTemplateStatement extends Statement implements IConfigSt
return Collections.emptyList();
}
- @Override
- public TSStatus checkPermissionBeforeProcess(String userName) {
- if (AuthorityChecker.SUPER_USER.equals(userName)) {
- return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
- }
- if (operationType == EXTEND_TEMPLATE) {
- return AuthorityChecker.getTSStatus(
- AuthorityChecker.checkSystemPermission(userName, PrivilegeType.EXTEND_TEMPLATE.ordinal()),
- PrivilegeType.EXTEND_TEMPLATE);
- } else {
- return new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
- .setMessage("Only the admin user can perform this operation");
- }
- }
-
@Override
public <R, C> R accept(StatementVisitor<R, C> visitor, C context) {
return visitor.visitAlterSchemaTemplate(this, context);