You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@rocketmq.apache.org by GitBox <gi...@apache.org> on 2021/08/17 09:27:13 UTC
[GitHub] [rocketmq-dashboard] zhangjidi2016 opened a new pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
zhangjidi2016 opened a new pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6
## What is the purpose of the change
#5
When the login user calls all interfaces, the permission of each interface is verified by AOP, by checking whether the role to which the user belongs has the access permission of the interface. All interface urls that a common user role has access permissions are saved in a file. The file is hot updated to facilitate adding or deleting permissions.
## Brief changelog
XX
## Verifying this change
XXXX
Follow this checklist to help us incorporate your contribution quickly and easily. Notice, `it would be helpful if you could finish the following 5 checklist(the last one is not necessary)before request the community to review your PR`.
- [x] Make sure there is a [Github issue](https://github.com/apache/rocketmq/issues) filed for the change (usually before you start working on it). Trivial changes like typos do not require a Github issue. Your pull request should address just this issue, without pulling in other changes - one PR resolves one issue.
- [x] Format the pull request title like `[ISSUE #123] Fix UnknownException when host config not exist`. Each commit in the pull request should have a meaningful subject line and body.
- [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
- [x] Write necessary unit-test(over 80% coverage) to verify your logic correction, more mock a little better when cross module dependency exist. If the new feature or significant change is committed, please remember to add integration-test in [test module](https://github.com/apache/rocketmq/tree/master/test).
- [x] Run `mvn -B clean apache-rat:check findbugs:findbugs checkstyle:checkstyle` to make sure basic checks pass. Run `mvn clean install -DskipITs` to make sure unit-test pass. Run `mvn clean test-compile failsafe:integration-test` to make sure integration-test pass.
- [ ] If this contribution is large, please file an [Apache Individual Contributor License Agreement](http://www.apache.org/licenses/#clas).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-908302947
> @zhangjidi2016
> Do you have any further updates for this PR.
> If no further updates, since the feature works well, I'm OK to merge it and we can refactor it in the future.
Well, we can merge this PR first, and verify permissions according to the interface path in the first version, and then optimize this problem again according to the structure of RBAC.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] vongosling edited a comment on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
vongosling edited a comment on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901871790
One trick is you could store it in one topic if it is necessary, but it is not friendly for updates, it invokes me to think about our compact topic design...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] vongosling commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
vongosling commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r690844961
##########
File path: doc/1_0_0/UserGuide_CN.md
##########
@@ -112,4 +112,35 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. 启动控制台则开启了登录功能
\ No newline at end of file
+* 3.启动控制台则开启了登录功能
+
+## 权限检验
+如果用户访问console时开启了登录功能，会按照登录的角色对访问的接口进行权限控制。
+* 1.在Spring配置文件resources/application.properties中修改 开启登录功能
+```$xslt
+ # 开启登录功能
+ rocketmq.config.loginRequired=true
+
+ # Dashboard文件目录，登录用户配置文件所在目录
+ rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.确保${rocketmq.config.dataPath}定义的目录存在，并且该目录下创建登录配置文件"role-permission.yml",
+如果该目录下不存在此文件，则默认使用resources/role-permission.yml文件。改文件保存了普通用户角色所有能访问的接口地址。
Review comment:
改-> 该
如果resources/role-permission.yml也不存在，会怎样？请把错误的退避规则描述的更精致一些：-）
##########
File path: doc/1_0_0/UserGuide_CN.md
##########
@@ -112,4 +112,35 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. 启动控制台则开启了登录功能
\ No newline at end of file
+* 3.启动控制台则开启了登录功能
+
+## 权限检验
+如果用户访问console时开启了登录功能，会按照登录的角色对访问的接口进行权限控制。
+* 1.在Spring配置文件resources/application.properties中修改 开启登录功能
+```$xslt
+ # 开启登录功能
+ rocketmq.config.loginRequired=true
+
+ # Dashboard文件目录，登录用户配置文件所在目录
+ rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.确保${rocketmq.config.dataPath}定义的目录存在，并且该目录下创建登录配置文件"role-permission.yml",
+如果该目录下不存在此文件，则默认使用resources/role-permission.yml文件。改文件保存了普通用户角色所有能访问的接口地址。
+role-permission.yml文件格式为:
+```$xslt
+# 该文件支持热修改，即添加和修改用户时，不需要重新启动console
+# 格式，如果增加和删除接口权限，直接在列表中增加和删除接口地址即可。
+
+# 普通用户
+rolePerms:
+ ordinary:
+ - /rocketmq/nsaddr
+ - /ops/homepage.query
+ - /cluster/list.query
+ - /cluster/brokerConfig.query
+ - /dashboard/broker.query
+ - /dashboard/topic.query
+ - /dashboard/topicCurrent
+ ....
Review comment:
考虑通配支持，后续维护太复杂否则
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/Permission.java
##########
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface Permission {
+
+ String value() default "";
Review comment:
It would be helpful if we could leave the concrete field in here. such as read-only, write...
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/PermissionAspect.java
##########
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.util.List;
+import java.util.Map;
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.model.UserInfo;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.dashboard.util.WebUtil;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Pointcut;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+@Aspect
+@Component
+public class PermissionAspect {
+
+ public static final String ORDINARY = "ordinary";
+ public static final String ADMIN = "admin";
+
+ @Resource
+ private RMQConfigure configure;
+
+ @Resource
+ private PermissionService permissionService;
+
+ /**
+ * @Permission can be applied to the Controller class to implement Permission verification on all methods in the class
+ * can also be applied to methods in a class for fine control
+ */
+ @Pointcut("@annotation(org.apache.rocketmq.dashboard.permisssion.Permission) || @within(org.apache.rocketmq.dashboard.permisssion.Permission)")
+ private void permission() {
Review comment:
Does within[1] annotation work well here?
[1] https://docs.spring.io/spring-framework/docs/2.0.x/reference/aop.html
##########
File path: src/main/java/org/apache/rocketmq/dashboard/controller/ConsumerController.java
##########
@@ -37,6 +38,7 @@
@Controller
@RequestMapping("/consumer")
+@Permission
Review comment:
I still recommend using the unified configuration, which can be unified in one directory, without annotating each method.
##########
File path: src/main/java/org/apache/rocketmq/dashboard/service/impl/PermissionServiceImpl.java
##########
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.service.impl;
+
+import com.alibaba.fastjson.JSONObject;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import javax.annotation.Resource;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.srvutil.FileWatchService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.stereotype.Service;
+import org.yaml.snakeyaml.Yaml;
+
+@Service
+public class PermissionServiceImpl implements PermissionService, InitializingBean {
+
+ @Resource
+ RMQConfigure configure;
+
+ FileBasedPermissionStore fileBasedPermissionStore;
+
+ @Override
+ public Map<String, List<String>> queryRolePerms() {
+ return fileBasedPermissionStore.rolePerms;
+ }
+
+ @Override
+ public void afterPropertiesSet() {
+ if (configure.isLoginRequired()) {
+ fileBasedPermissionStore = new FileBasedPermissionStore(configure);
+ }
+ }
+
+ public static class FileBasedPermissionStore {
+ private final Logger log = LoggerFactory.getLogger(this.getClass());
+ private static final String FILE_NAME = "role-permission.yml";
+
+ private String filePath;
+ private Map<String/**role**/, List<String>/**accessUrls**/> rolePerms = new ConcurrentHashMap<>();
+
+ public FileBasedPermissionStore(RMQConfigure configure) {
+ filePath = configure.getRocketMqDashboardDataPath() + File.separator + FILE_NAME;
+ if (!new File(filePath).exists()) {
+ InputStream inputStream = getClass().getResourceAsStream("/" + FILE_NAME);
+ if (inputStream == null) {
+ log.error(String.format("Can not found the file %s in Spring Boot jar", FILE_NAME));
+ System.exit(1);
+ } else {
+ load(inputStream);
+ }
+ } else {
+ log.info(String.format("User Permission configure file is %s", filePath));
Review comment:
Any resource leak if we do not use try with?
##########
File path: doc/1_0_0/UserGuide_EN.md
##########
@@ -115,4 +115,38 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. Restart Dashboard Application after above configuration setting well.
\ No newline at end of file
+* 3.Restart Console Application after above configuration setting well.
+
+
+## Permission Control
+If the login function is enabled when a user accesses the Console, the user controls the access permission of the interface based on the login role.
+
+* 1.Turn on the property in resources/application.properties.
+```$xslt
+# open the login func
+rocketmq.config.loginRequired=true
+
+# Directory of ashboard & login user configure file
+rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.Make sure the directory defined in property ${rocketmq.config.dataPath} exists and the file "role-permission.yml" is created under it.
+The console system will use the resources/role-permission.yml by default if a customized file is not found。
+
+The format in the content of role-permission.yml:
+```$xslt
+# This file supports hot change, any change will be auto-reloaded without Console restarting.
+# Format: To add or delete interface permissions, add or delete interface addresses from the list.
+
+# ordinary user
+rolePerms:
+ ordinary:
+ - /rocketmq/nsaddr
+ - /ops/homepage.query
Review comment:
Change description corresponds with CN.
##########
File path: doc/1_0_0/UserGuide_CN.md
##########
@@ -112,4 +112,35 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. 启动控制台则开启了登录功能
\ No newline at end of file
+* 3.启动控制台则开启了登录功能
+
+## 权限检验
+如果用户访问console时开启了登录功能，会按照登录的角色对访问的接口进行权限控制。
+* 1.在Spring配置文件resources/application.properties中修改 开启登录功能
+```$xslt
+ # 开启登录功能
+ rocketmq.config.loginRequired=true
+
+ # Dashboard文件目录，登录用户配置文件所在目录
+ rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.确保${rocketmq.config.dataPath}定义的目录存在，并且该目录下创建登录配置文件"role-permission.yml",
+如果该目录下不存在此文件，则默认使用resources/role-permission.yml文件。改文件保存了普通用户角色所有能访问的接口地址。
+role-permission.yml文件格式为:
+```$xslt
+# 该文件支持热修改，即添加和修改用户时，不需要重新启动console
+# 格式，如果增加和删除接口权限，直接在列表中增加和删除接口地址即可。
+
+# 普通用户
+rolePerms:
+ ordinary:
+ - /rocketmq/nsaddr
+ - /ops/homepage.query
+ - /cluster/list.query
+ - /cluster/brokerConfig.query
+ - /dashboard/broker.query
+ - /dashboard/topic.query
+ - /dashboard/topicCurrent
+ ....
+```
+* 3.前端页面显示上，为了更好区分普通用户和admin用户权限，关于资源的删除、更新等操作按钮不对普通用户角色显示。
Review comment:
考虑重签功能，要么退出换角色登入，要么支持管理员到普通账户的一键切换
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] vongosling commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
vongosling commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901871790
One trick is you could store it in one topic if it is necessary, but it is not friendly for updates, it invoke me to think about our compact topic design...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901773263
> @zhangjidi2016 there are many places waiting to be clarified. BTW, do we have a better way to support here. do not link permission to URL directly?
I haven't thought of any other good authentication methods yet. However, regardless of the authentication method, we need to maintain the role-permission mapping, because rocketMQ-Dashboard deployment does not depend on any external storage system, only to save the mapping to a disk file.
Do you have any good suggestions for improving authentication？@vongosling @StyleTang @zongtanghu
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901903881
I come up with an idea for improving authentication.
For now, the relationship is
```
user -> role
role -> uri
```
Maybe we can introduce permission
```
user -> role
role -> permission
(URI/button/tab) requires permission
```
user have role, role contains several permissions. A login user can have a permission set.
for example we have a topic_write permission.
For backend: invoke create topic method requires topic_write permission ==> (we can add @Permission(value = "topic_write") to the create topic method)
For front end: show create topic button requires topic_write permission ==> (we can get permissions after login,only show create topic button if the user has topic_write permission)
Do you have any suggestions?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-909225934
@zhangjidi2016
This branch has conflicts with master, could you resolve the conflicts.
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r691962620
##########
File path: doc/1_0_0/UserGuide_CN.md
##########
@@ -112,4 +112,35 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. 启动控制台则开启了登录功能
\ No newline at end of file
+* 3.启动控制台则开启了登录功能
+
+## 权限检验
+如果用户访问console时开启了登录功能，会按照登录的角色对访问的接口进行权限控制。
+* 1.在Spring配置文件resources/application.properties中修改 开启登录功能
+```$xslt
+ # 开启登录功能
+ rocketmq.config.loginRequired=true
+
+ # Dashboard文件目录，登录用户配置文件所在目录
+ rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.确保${rocketmq.config.dataPath}定义的目录存在，并且该目录下创建登录配置文件"role-permission.yml",
+如果该目录下不存在此文件，则默认使用resources/role-permission.yml文件。改文件保存了普通用户角色所有能访问的接口地址。
+role-permission.yml文件格式为:
+```$xslt
+# 该文件支持热修改，即添加和修改用户时，不需要重新启动console
+# 格式，如果增加和删除接口权限，直接在列表中增加和删除接口地址即可。
+
+# 普通用户
+rolePerms:
+ ordinary:
+ - /rocketmq/nsaddr
+ - /ops/homepage.query
+ - /cluster/list.query
+ - /cluster/brokerConfig.query
+ - /dashboard/broker.query
+ - /dashboard/topic.query
+ - /dashboard/topicCurrent
+ ....
Review comment:
Ok, the interface path in the authentication file is added with wildcard characters
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/Permission.java
##########
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface Permission {
+
+ String value() default "";
Review comment:
This value attribute is not used, then delete
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r690827669
##########
File path: src/main/java/org/apache/rocketmq/dashboard/service/impl/PermissionServiceImpl.java
##########
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.service.impl;
+
+import com.alibaba.fastjson.JSONObject;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import javax.annotation.Resource;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.srvutil.FileWatchService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.stereotype.Service;
+import org.yaml.snakeyaml.Yaml;
+
+@Service
+public class PermissionServiceImpl implements PermissionService, InitializingBean {
+
+ @Resource
+ RMQConfigure configure;
+
+ FileBasedPermissionStore fileBasedPermissionStore;
+
+ @Override
+ public Map<String, List<String>> queryRolePerms() {
+ return fileBasedPermissionStore.rolePerms;
+ }
+
+ @Override
+ public void afterPropertiesSet() {
+ if (configure.isLoginRequired()) {
+ fileBasedPermissionStore = new FileBasedPermissionStore(configure);
+ }
+ }
+
+ public static class FileBasedPermissionStore {
Review comment:
Okay, I'll re-optimize the code as suggested.
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/PermissionAspect.java
##########
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.util.List;
+import java.util.Map;
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.model.UserInfo;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.dashboard.util.WebUtil;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Pointcut;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+@Aspect
+@Component
+public class PermissionAspect {
+
+ public static final String ORDINARY = "ordinary";
+ public static final String ADMIN = "admin";
+
+ @Resource
+ private RMQConfigure configure;
+
+ @Resource
+ private PermissionService permissionService;
+
+ /**
+ * @Permission can be applied to the Controller class to implement Permission verification on all methods in the class
+ * can also be applied to methods in a class for fine control
+ */
+ @Pointcut("@annotation(org.apache.rocketmq.dashboard.permisssion.Permission) || @within(org.apache.rocketmq.dashboard.permisssion.Permission)")
+ private void permission() {
Review comment:
Yes，it can work，@within - limits matching to join points within types that have the given annotation (the execution of methods declared in types with the given annotation when using Spring AOP).
##########
File path: src/main/java/org/apache/rocketmq/dashboard/controller/ConsumerController.java
##########
@@ -37,6 +38,7 @@
@Controller
@RequestMapping("/consumer")
+@Permission
Review comment:
The @permission annotation is on a class in which all the methods of the class will implement aop methods. There is no need to annotate each method
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-909880405
> @zhangjidi2016
> This branch has conflicts with master, could you resolve the conflicts.
> Thanks.
OK，code conflicts have been resolved
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-909225934
@zhangjidi2016
This branch has conflicts with master, could you resolve the conflicts.
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-909225934
@zhangjidi2016
This branch has conflicts with master, could you resolve the conflicts.
Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901905073
Local file storage is indeed a problem. Because of it, we need to stand-alone deployment, or the config can not sync.
It is better to have a remote shared storage, Maybe we should abstract the storage interface, local file storage is an implementation(for now), mysql is another implementation, MQ message implementation etc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] vongosling commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
vongosling commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901947786
> I come up with an idea for improving authentication.
> For now, the relationship is
>
> ```
> user -> role
> role -> uri
> ```
>
> Maybe we can introduce permission
>
> ```
> user -> role
> role -> permission
>
> (URI/button/tab) requires permission
> ```
>
> user have role, role contains several permissions. A login user can have a permission set.
> for example we have a topic_write permission.
>
> For backend: invoke create topic method requires topic_write permission ==> (we can add @Permission(value = "topic_write") to the create topic method)
>
> For front end: show create topic button requires topic_write permission ==> (we can get permissions after login,only show create topic button if the user has topic_write permission)
>
> Do you have any suggestions?
Agree, specifically speaking, we could learn lessons from RBAC, here resources may have different operations
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r690464731
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/PermissionAspect.java
##########
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.util.List;
+import java.util.Map;
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.model.UserInfo;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.dashboard.util.WebUtil;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Pointcut;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+@Aspect
+@Component
+public class PermissionAspect {
+
+ public static final String ORDINARY = "ordinary";
+ public static final String ADMIN = "admin";
+
+ @Resource
+ private RMQConfigure configure;
+
+ @Resource
+ private PermissionService permissionService;
+
+ /**
+ * @Permission can be applied to the Controller class to implement Permission verification on all methods in the class
+ * can also be applied to methods in a class for fine control
+ */
+ @Pointcut("@annotation(org.apache.rocketmq.dashboard.permisssion.Permission) || @within(org.apache.rocketmq.dashboard.permisssion.Permission)")
+ private void permission() {
+
+ }
+
+ @Around("permission()")
+ public Object checkPermission(ProceedingJoinPoint joinPoint) throws Throwable {
+ if (configure.isLoginRequired()) {
+ HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
+ String url = request.getRequestURI();
+ UserInfo userInfo = (UserInfo) request.getSession().getAttribute(WebUtil.USER_INFO);
+ if (userInfo == null || userInfo.getUser() == null) {
+ throw new ServiceException(-1, "user not login");
+ }
+ int type = userInfo.getUser().getType();
+ // 1:admin 0:ordinary
+ String loginUserRole = type == 1 ? ADMIN : ORDINARY;
+ // if it is admin, it could access all resources
+ if (loginUserRole == ADMIN) {
+ return joinPoint.proceed();
+ }
+ Map<String, List<String>> map = permissionService.queryRolePerms();
Review comment:
The permission check logic should not be here. It should belongs to PermissionService.
suggest to use
```
permissionService.checkUriAvailable(uri , userInfo);
```
In this permission check aspect, just invoke it.
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/PermissionAspect.java
##########
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.util.List;
+import java.util.Map;
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.model.UserInfo;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.dashboard.util.WebUtil;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Pointcut;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+@Aspect
+@Component
+public class PermissionAspect {
+
+ public static final String ORDINARY = "ordinary";
+ public static final String ADMIN = "admin";
+
+ @Resource
+ private RMQConfigure configure;
+
+ @Resource
+ private PermissionService permissionService;
+
+ /**
+ * @Permission can be applied to the Controller class to implement Permission verification on all methods in the class
+ * can also be applied to methods in a class for fine control
+ */
+ @Pointcut("@annotation(org.apache.rocketmq.dashboard.permisssion.Permission) || @within(org.apache.rocketmq.dashboard.permisssion.Permission)")
+ private void permission() {
+
+ }
+
+ @Around("permission()")
+ public Object checkPermission(ProceedingJoinPoint joinPoint) throws Throwable {
+ if (configure.isLoginRequired()) {
+ HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
+ String url = request.getRequestURI();
+ UserInfo userInfo = (UserInfo) request.getSession().getAttribute(WebUtil.USER_INFO);
+ if (userInfo == null || userInfo.getUser() == null) {
+ throw new ServiceException(-1, "user not login");
+ }
+ int type = userInfo.getUser().getType();
+ // 1:admin 0:ordinary
+ String loginUserRole = type == 1 ? ADMIN : ORDINARY;
Review comment:
Can we add a UserRoleEnum, it seems so many place use it.
##########
File path: src/main/java/org/apache/rocketmq/dashboard/service/impl/PermissionServiceImpl.java
##########
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.service.impl;
+
+import com.alibaba.fastjson.JSONObject;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import javax.annotation.Resource;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.srvutil.FileWatchService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.stereotype.Service;
+import org.yaml.snakeyaml.Yaml;
+
+@Service
+public class PermissionServiceImpl implements PermissionService, InitializingBean {
+
+ @Resource
+ RMQConfigure configure;
+
+ FileBasedPermissionStore fileBasedPermissionStore;
+
+ @Override
+ public Map<String, List<String>> queryRolePerms() {
+ return fileBasedPermissionStore.rolePerms;
+ }
+
+ @Override
+ public void afterPropertiesSet() {
+ if (configure.isLoginRequired()) {
+ fileBasedPermissionStore = new FileBasedPermissionStore(configure);
+ }
+ }
+
+ public static class FileBasedPermissionStore {
Review comment:
There are some duplicate code here, it would be better if we can reuse it.
```
org.apache.rocketmq.dashboard.service.impl.UserServiceImpl.FileBasedUserInfoStore
```
##########
File path: src/main/java/org/apache/rocketmq/dashboard/service/impl/PermissionServiceImpl.java
##########
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.service.impl;
+
+import com.alibaba.fastjson.JSONObject;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import javax.annotation.Resource;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.srvutil.FileWatchService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.stereotype.Service;
+import org.yaml.snakeyaml.Yaml;
+
+@Service
+public class PermissionServiceImpl implements PermissionService, InitializingBean {
+
+ @Resource
+ RMQConfigure configure;
+
+ FileBasedPermissionStore fileBasedPermissionStore;
Review comment:
suggest to use private but not default.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r691963003
##########
File path: src/main/java/org/apache/rocketmq/dashboard/service/impl/PermissionServiceImpl.java
##########
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.service.impl;
+
+import com.alibaba.fastjson.JSONObject;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import javax.annotation.Resource;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.srvutil.FileWatchService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.stereotype.Service;
+import org.yaml.snakeyaml.Yaml;
+
+@Service
+public class PermissionServiceImpl implements PermissionService, InitializingBean {
+
+ @Resource
+ RMQConfigure configure;
+
+ FileBasedPermissionStore fileBasedPermissionStore;
+
+ @Override
+ public Map<String, List<String>> queryRolePerms() {
+ return fileBasedPermissionStore.rolePerms;
+ }
+
+ @Override
+ public void afterPropertiesSet() {
+ if (configure.isLoginRequired()) {
+ fileBasedPermissionStore = new FileBasedPermissionStore(configure);
+ }
+ }
+
+ public static class FileBasedPermissionStore {
+ private final Logger log = LoggerFactory.getLogger(this.getClass());
+ private static final String FILE_NAME = "role-permission.yml";
+
+ private String filePath;
+ private Map<String/**role**/, List<String>/**accessUrls**/> rolePerms = new ConcurrentHashMap<>();
+
+ public FileBasedPermissionStore(RMQConfigure configure) {
+ filePath = configure.getRocketMqDashboardDataPath() + File.separator + FILE_NAME;
+ if (!new File(filePath).exists()) {
+ InputStream inputStream = getClass().getResourceAsStream("/" + FILE_NAME);
+ if (inputStream == null) {
+ log.error(String.format("Can not found the file %s in Spring Boot jar", FILE_NAME));
+ System.exit(1);
+ } else {
+ load(inputStream);
+ }
+ } else {
+ log.info(String.format("User Permission configure file is %s", filePath));
Review comment:
Yes, I will close the InputStream after use
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] vongosling commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
vongosling commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901601418
@zhangjidi2016 there are many places waiting to be clarified. BTW, do we have a better way to support here. do not link permission to URL directly?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-909880405
> @zhangjidi2016
> This branch has conflicts with master, could you resolve the conflicts.
> Thanks.
OK，code conflicts have been resolved
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-908279083
@zhangjidi2016
Do you have any further updates for this PR.
If no further updates, since the feature works well, I'm OK to merge it and we can refactor it in the future.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang commented on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang commented on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901894209
I come up with an idea for improving authentication.
For now, the relationship is
```
user -> role
role -> uri
```
Maybe we can introduce permission
```
user -> role
role -> permission
(URI/button/tab) requires permission
```
user have role, role contains several permissions. A login user can have a permission set.
for example we have a topic_write permission.
For backend: invoke create topic method requires topic_write permission ==> (we can add @Permission(value = "topic_write") to the create topic method)
For front end: show create topic button requires topic_write permission ==> (we can get permissions after login,only show create topic button if the user has topic_write permission)
Do you have any suggestions?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang merged pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang merged pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] vongosling commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
vongosling commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r690844961
##########
File path: doc/1_0_0/UserGuide_CN.md
##########
@@ -112,4 +112,35 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. 启动控制台则开启了登录功能
\ No newline at end of file
+* 3.启动控制台则开启了登录功能
+
+## 权限检验
+如果用户访问console时开启了登录功能，会按照登录的角色对访问的接口进行权限控制。
+* 1.在Spring配置文件resources/application.properties中修改 开启登录功能
+```$xslt
+ # 开启登录功能
+ rocketmq.config.loginRequired=true
+
+ # Dashboard文件目录，登录用户配置文件所在目录
+ rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.确保${rocketmq.config.dataPath}定义的目录存在，并且该目录下创建登录配置文件"role-permission.yml",
+如果该目录下不存在此文件，则默认使用resources/role-permission.yml文件。改文件保存了普通用户角色所有能访问的接口地址。
Review comment:
改-> 该
如果resources/role-permission.yml也不存在，会怎样？请把错误的退避规则描述的更精致一些：-）
##########
File path: doc/1_0_0/UserGuide_CN.md
##########
@@ -112,4 +112,35 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. 启动控制台则开启了登录功能
\ No newline at end of file
+* 3.启动控制台则开启了登录功能
+
+## 权限检验
+如果用户访问console时开启了登录功能，会按照登录的角色对访问的接口进行权限控制。
+* 1.在Spring配置文件resources/application.properties中修改 开启登录功能
+```$xslt
+ # 开启登录功能
+ rocketmq.config.loginRequired=true
+
+ # Dashboard文件目录，登录用户配置文件所在目录
+ rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.确保${rocketmq.config.dataPath}定义的目录存在，并且该目录下创建登录配置文件"role-permission.yml",
+如果该目录下不存在此文件，则默认使用resources/role-permission.yml文件。改文件保存了普通用户角色所有能访问的接口地址。
+role-permission.yml文件格式为:
+```$xslt
+# 该文件支持热修改，即添加和修改用户时，不需要重新启动console
+# 格式，如果增加和删除接口权限，直接在列表中增加和删除接口地址即可。
+
+# 普通用户
+rolePerms:
+ ordinary:
+ - /rocketmq/nsaddr
+ - /ops/homepage.query
+ - /cluster/list.query
+ - /cluster/brokerConfig.query
+ - /dashboard/broker.query
+ - /dashboard/topic.query
+ - /dashboard/topicCurrent
+ ....
Review comment:
考虑通配支持，后续维护太复杂否则
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/Permission.java
##########
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface Permission {
+
+ String value() default "";
Review comment:
It would be helpful if we could leave the concrete field in here. such as read-only, write...
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/PermissionAspect.java
##########
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.util.List;
+import java.util.Map;
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.model.UserInfo;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.dashboard.util.WebUtil;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Pointcut;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+@Aspect
+@Component
+public class PermissionAspect {
+
+ public static final String ORDINARY = "ordinary";
+ public static final String ADMIN = "admin";
+
+ @Resource
+ private RMQConfigure configure;
+
+ @Resource
+ private PermissionService permissionService;
+
+ /**
+ * @Permission can be applied to the Controller class to implement Permission verification on all methods in the class
+ * can also be applied to methods in a class for fine control
+ */
+ @Pointcut("@annotation(org.apache.rocketmq.dashboard.permisssion.Permission) || @within(org.apache.rocketmq.dashboard.permisssion.Permission)")
+ private void permission() {
Review comment:
Does within[1] annotation work well here?
[1] https://docs.spring.io/spring-framework/docs/2.0.x/reference/aop.html
##########
File path: src/main/java/org/apache/rocketmq/dashboard/controller/ConsumerController.java
##########
@@ -37,6 +38,7 @@
@Controller
@RequestMapping("/consumer")
+@Permission
Review comment:
I still recommend using the unified configuration, which can be unified in one directory, without annotating each method.
##########
File path: src/main/java/org/apache/rocketmq/dashboard/service/impl/PermissionServiceImpl.java
##########
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.service.impl;
+
+import com.alibaba.fastjson.JSONObject;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import javax.annotation.Resource;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.srvutil.FileWatchService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.stereotype.Service;
+import org.yaml.snakeyaml.Yaml;
+
+@Service
+public class PermissionServiceImpl implements PermissionService, InitializingBean {
+
+ @Resource
+ RMQConfigure configure;
+
+ FileBasedPermissionStore fileBasedPermissionStore;
+
+ @Override
+ public Map<String, List<String>> queryRolePerms() {
+ return fileBasedPermissionStore.rolePerms;
+ }
+
+ @Override
+ public void afterPropertiesSet() {
+ if (configure.isLoginRequired()) {
+ fileBasedPermissionStore = new FileBasedPermissionStore(configure);
+ }
+ }
+
+ public static class FileBasedPermissionStore {
+ private final Logger log = LoggerFactory.getLogger(this.getClass());
+ private static final String FILE_NAME = "role-permission.yml";
+
+ private String filePath;
+ private Map<String/**role**/, List<String>/**accessUrls**/> rolePerms = new ConcurrentHashMap<>();
+
+ public FileBasedPermissionStore(RMQConfigure configure) {
+ filePath = configure.getRocketMqDashboardDataPath() + File.separator + FILE_NAME;
+ if (!new File(filePath).exists()) {
+ InputStream inputStream = getClass().getResourceAsStream("/" + FILE_NAME);
+ if (inputStream == null) {
+ log.error(String.format("Can not found the file %s in Spring Boot jar", FILE_NAME));
+ System.exit(1);
+ } else {
+ load(inputStream);
+ }
+ } else {
+ log.info(String.format("User Permission configure file is %s", filePath));
Review comment:
Any resource leak if we do not use try with?
##########
File path: doc/1_0_0/UserGuide_EN.md
##########
@@ -115,4 +115,38 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. Restart Dashboard Application after above configuration setting well.
\ No newline at end of file
+* 3.Restart Console Application after above configuration setting well.
+
+
+## Permission Control
+If the login function is enabled when a user accesses the Console, the user controls the access permission of the interface based on the login role.
+
+* 1.Turn on the property in resources/application.properties.
+```$xslt
+# open the login func
+rocketmq.config.loginRequired=true
+
+# Directory of ashboard & login user configure file
+rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.Make sure the directory defined in property ${rocketmq.config.dataPath} exists and the file "role-permission.yml" is created under it.
+The console system will use the resources/role-permission.yml by default if a customized file is not found。
+
+The format in the content of role-permission.yml:
+```$xslt
+# This file supports hot change, any change will be auto-reloaded without Console restarting.
+# Format: To add or delete interface permissions, add or delete interface addresses from the list.
+
+# ordinary user
+rolePerms:
+ ordinary:
+ - /rocketmq/nsaddr
+ - /ops/homepage.query
Review comment:
Change description corresponds with CN.
##########
File path: doc/1_0_0/UserGuide_CN.md
##########
@@ -112,4 +112,35 @@ admin=admin,1
user1=user1
user2=user2
```
-* 3. 启动控制台则开启了登录功能
\ No newline at end of file
+* 3.启动控制台则开启了登录功能
+
+## 权限检验
+如果用户访问console时开启了登录功能，会按照登录的角色对访问的接口进行权限控制。
+* 1.在Spring配置文件resources/application.properties中修改 开启登录功能
+```$xslt
+ # 开启登录功能
+ rocketmq.config.loginRequired=true
+
+ # Dashboard文件目录，登录用户配置文件所在目录
+ rocketmq.config.dataPath=/tmp/rocketmq-console/data
+```
+* 2.确保${rocketmq.config.dataPath}定义的目录存在，并且该目录下创建登录配置文件"role-permission.yml",
+如果该目录下不存在此文件，则默认使用resources/role-permission.yml文件。改文件保存了普通用户角色所有能访问的接口地址。
+role-permission.yml文件格式为:
+```$xslt
+# 该文件支持热修改，即添加和修改用户时，不需要重新启动console
+# 格式，如果增加和删除接口权限，直接在列表中增加和删除接口地址即可。
+
+# 普通用户
+rolePerms:
+ ordinary:
+ - /rocketmq/nsaddr
+ - /ops/homepage.query
+ - /cluster/list.query
+ - /cluster/brokerConfig.query
+ - /dashboard/broker.query
+ - /dashboard/topic.query
+ - /dashboard/topicCurrent
+ ....
+```
+* 3.前端页面显示上，为了更好区分普通用户和admin用户权限，关于资源的删除、更新等操作按钮不对普通用户角色显示。
Review comment:
考虑重签功能，要么退出换角色登入，要么支持管理员到普通账户的一键切换
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r690925097
##########
File path: src/main/java/org/apache/rocketmq/dashboard/controller/ConsumerController.java
##########
@@ -37,6 +38,7 @@
@Controller
@RequestMapping("/consumer")
+@Permission
Review comment:
The @permission annotation is on a class in which all the methods of the class will implement aop methods. There is no need to annotate each method
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] StyleTang removed a comment on pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
StyleTang removed a comment on pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#issuecomment-901903881
I come up with an idea for improving authentication.
For now, the relationship is
```
user -> role
role -> uri
```
Maybe we can introduce permission
```
user -> role
role -> permission
(URI/button/tab) requires permission
```
user have role, role contains several permissions. A login user can have a permission set.
for example we have a topic_write permission.
For backend: invoke create topic method requires topic_write permission ==> (we can add @Permission(value = "topic_write") to the create topic method)
For front end: show create topic button requires topic_write permission ==> (we can get permissions after login,only show create topic button if the user has topic_write permission)
Do you have any suggestions?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r690923485
##########
File path: src/main/java/org/apache/rocketmq/dashboard/permisssion/PermissionAspect.java
##########
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.permisssion;
+
+import java.util.List;
+import java.util.Map;
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.model.UserInfo;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.dashboard.util.WebUtil;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Pointcut;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+@Aspect
+@Component
+public class PermissionAspect {
+
+ public static final String ORDINARY = "ordinary";
+ public static final String ADMIN = "admin";
+
+ @Resource
+ private RMQConfigure configure;
+
+ @Resource
+ private PermissionService permissionService;
+
+ /**
+ * @Permission can be applied to the Controller class to implement Permission verification on all methods in the class
+ * can also be applied to methods in a class for fine control
+ */
+ @Pointcut("@annotation(org.apache.rocketmq.dashboard.permisssion.Permission) || @within(org.apache.rocketmq.dashboard.permisssion.Permission)")
+ private void permission() {
Review comment:
Yes，it can work，@within - limits matching to join points within types that have the given annotation (the execution of methods declared in types with the given annotation when using Spring AOP).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [rocketmq-dashboard] zhangjidi2016 commented on a change in pull request #6: [ISSUE #5]Add permission control when loginRequired is true.
Posted by GitBox <gi...@apache.org>.
zhangjidi2016 commented on a change in pull request #6:
URL: https://github.com/apache/rocketmq-dashboard/pull/6#discussion_r690827669
##########
File path: src/main/java/org/apache/rocketmq/dashboard/service/impl/PermissionServiceImpl.java
##########
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.dashboard.service.impl;
+
+import com.alibaba.fastjson.JSONObject;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import javax.annotation.Resource;
+import org.apache.rocketmq.dashboard.config.RMQConfigure;
+import org.apache.rocketmq.dashboard.exception.ServiceException;
+import org.apache.rocketmq.dashboard.service.PermissionService;
+import org.apache.rocketmq.srvutil.FileWatchService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.stereotype.Service;
+import org.yaml.snakeyaml.Yaml;
+
+@Service
+public class PermissionServiceImpl implements PermissionService, InitializingBean {
+
+ @Resource
+ RMQConfigure configure;
+
+ FileBasedPermissionStore fileBasedPermissionStore;
+
+ @Override
+ public Map<String, List<String>> queryRolePerms() {
+ return fileBasedPermissionStore.rolePerms;
+ }
+
+ @Override
+ public void afterPropertiesSet() {
+ if (configure.isLoginRequired()) {
+ fileBasedPermissionStore = new FileBasedPermissionStore(configure);
+ }
+ }
+
+ public static class FileBasedPermissionStore {
Review comment:
Okay, I'll re-optimize the code as suggested.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org