You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iotdb.apache.org by ro...@apache.org on 2024/12/18 12:16:07 UTC
(iotdb) branch dev/1.3 updated: Pipe: Fixed the bug that auth plan with system privileges can not be transferred (#14492)
This is an automated email from the ASF dual-hosted git repository.
rong pushed a commit to branch dev/1.3
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/dev/1.3 by this push:
new c665cb723bf Pipe: Fixed the bug that auth plan with system privileges can not be transferred (#14492)
c665cb723bf is described below
commit c665cb723bf30319c2c3c1b06c4234019aed171c
Author: Caideyipi <87...@users.noreply.github.com>
AuthorDate: Wed Dec 18 20:16:00 2024 +0800
Pipe: Fixed the bug that auth plan with system privileges can not be transferred (#14492)
---
.../apache/iotdb/pipe/it/manual/IoTDBPipeInclusionIT.java | 12 +++++++++++-
.../iotdb/pipe/it/manual/IoTDBPipeMetaHistoricalIT.java | 12 +++++++++++-
.../extractor/PipeConfigPhysicalPlanPatternParseVisitor.java | 12 ++++++++++--
3 files changed, 32 insertions(+), 4 deletions(-)
diff --git a/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeInclusionIT.java b/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeInclusionIT.java
index 4515536c253..76affe08850 100644
--- a/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeInclusionIT.java
+++ b/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeInclusionIT.java
@@ -180,6 +180,7 @@ public class IoTDBPipeInclusionIT extends AbstractPipeDualManualIT {
senderEnv,
Arrays.asList(
"create user `ln_write_user` 'write_pwd'",
+ "grant manage_database,manage_user,manage_role,use_trigger,use_udf,use_cq,use_pipe on root.** to USER ln_write_user with grant option",
"GRANT READ_DATA, WRITE_DATA ON root.** TO USER ln_write_user;"))) {
return;
}
@@ -189,7 +190,16 @@ public class IoTDBPipeInclusionIT extends AbstractPipeDualManualIT {
"LIST PRIVILEGES OF USER ln_write_user",
"ROLE,PATH,PRIVILEGES,GRANT OPTION,",
new HashSet<>(
- Arrays.asList(",root.ln.**,READ_DATA,false,", ",root.ln.**,WRITE_DATA,false,")));
+ Arrays.asList(
+ ",root.**,MANAGE_USER,true,",
+ ",root.**,MANAGE_ROLE,true,",
+ ",root.**,USE_TRIGGER,true,",
+ ",root.**,USE_UDF,true,",
+ ",root.**,USE_CQ,true,",
+ ",root.**,USE_PIPE,true,",
+ ",root.**,MANAGE_DATABASE,true,",
+ ",root.ln.**,READ_DATA,false,",
+ ",root.ln.**,WRITE_DATA,false,")));
}
}
diff --git a/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeMetaHistoricalIT.java b/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeMetaHistoricalIT.java
index ccaf4bc24b5..94f629d846c 100644
--- a/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeMetaHistoricalIT.java
+++ b/integration-test/src/test/java/org/apache/iotdb/pipe/it/manual/IoTDBPipeMetaHistoricalIT.java
@@ -191,6 +191,7 @@ public class IoTDBPipeMetaHistoricalIT extends AbstractPipeDualManualIT {
"create role `admin`",
"grant role `admin` to `thulab`",
"grant read on root.** to role `admin`",
+ "grant manage_database,manage_user,manage_role,use_trigger,use_udf,use_cq,use_pipe on root.** to role `admin`;",
"create schema template t1 (temperature FLOAT encoding=RLE, status BOOLEAN encoding=PLAIN compression=SNAPPY)",
"set schema template t1 to root.ln.wf01",
"create timeseries using schema template on root.ln.wf01.wt01",
@@ -240,7 +241,16 @@ public class IoTDBPipeMetaHistoricalIT extends AbstractPipeDualManualIT {
+ ColumnHeaderConstant.GRANT_OPTION
+ ",",
new HashSet<>(
- Arrays.asList("admin,root.**,READ_DATA,false,", "admin,root.**,READ_SCHEMA,false,")));
+ Arrays.asList(
+ "admin,root.**,MANAGE_USER,false,",
+ "admin,root.**,MANAGE_ROLE,false,",
+ "admin,root.**,USE_TRIGGER,false,",
+ "admin,root.**,USE_UDF,false,",
+ "admin,root.**,USE_CQ,false,",
+ "admin,root.**,USE_PIPE,false,",
+ "admin,root.**,MANAGE_DATABASE,false,",
+ "admin,root.**,READ_DATA,false,",
+ "admin,root.**,READ_SCHEMA,false,")));
TestUtils.assertDataAlwaysOnEnv(
receiverEnv,
diff --git a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/extractor/PipeConfigPhysicalPlanPatternParseVisitor.java b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/extractor/PipeConfigPhysicalPlanPatternParseVisitor.java
index 3d0602875bc..6b9e99900bc 100644
--- a/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/extractor/PipeConfigPhysicalPlanPatternParseVisitor.java
+++ b/iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/extractor/PipeConfigPhysicalPlanPatternParseVisitor.java
@@ -19,6 +19,7 @@
package org.apache.iotdb.confignode.manager.pipe.extractor;
+import org.apache.iotdb.commons.auth.entity.PrivilegeType;
import org.apache.iotdb.commons.path.PartialPath;
import org.apache.iotdb.commons.path.PathPatternTree;
import org.apache.iotdb.commons.pipe.datastructure.pattern.IoTDBPipePattern;
@@ -50,6 +51,7 @@ import java.util.Collections;
import java.util.List;
import java.util.Map;
import java.util.Optional;
+import java.util.Set;
import java.util.stream.Collectors;
import java.util.stream.IntStream;
import java.util.stream.Stream;
@@ -192,7 +194,13 @@ public class PipeConfigPhysicalPlanPatternParseVisitor
.map(pattern::getIntersection)
.flatMap(Collection::stream)
.collect(Collectors.toList());
- return !intersectedPaths.isEmpty()
+ final Set<Integer> permissions =
+ !intersectedPaths.isEmpty()
+ ? pathRelatedAuthorPlan.getPermissions()
+ : pathRelatedAuthorPlan.getPermissions().stream()
+ .filter(permission -> !PrivilegeType.values()[permission].isPathRelevant())
+ .collect(Collectors.toSet());
+ return !permissions.isEmpty()
? Optional.of(
new AuthorPlan(
pathRelatedAuthorPlan.getAuthorType(),
@@ -200,7 +208,7 @@ public class PipeConfigPhysicalPlanPatternParseVisitor
pathRelatedAuthorPlan.getRoleName(),
pathRelatedAuthorPlan.getPassword(),
pathRelatedAuthorPlan.getNewPassword(),
- pathRelatedAuthorPlan.getPermissions(),
+ permissions,
pathRelatedAuthorPlan.getGrantOpt(),
intersectedPaths))
: Optional.empty();