This is an automated email from the ASF dual-hosted git repository.
SbloodyS pushed a commit to branch dev
in repository https://gitbox.apache.org/repos/asf/dolphinscheduler.git
The following commit(s) were added to refs/heads/dev by this push:
new ed90f48b0c [Improvement-18558][API] Harden user list access and
responses (#18560)
ed90f48b0c is described below
commit ed90f48b0cca64e203d6f98e71b895a2a82dc3a9
Author: Wenjun Ruan <[email protected]>
AuthorDate: Tue Aug 18 10:01:27 2026 +0800
[Improvement-18558][API] Harden user list access and responses (#18560)
---
.../api/controller/UsersController.java | 3 +-
.../dolphinscheduler/api/service/UsersService.java | 3 +-
.../api/service/impl/UsersServiceImpl.java | 12 ++++----
.../dolphinscheduler/api/vo/UserSimpleInfoVO.java | 35 ++++++++++++++++++++++
.../api/controller/UsersControllerTest.java | 5 ++++
.../api/service/UsersServiceTest.java | 18 +++++++----
.../apache/dolphinscheduler/dao/entity/User.java | 2 ++
.../dolphinscheduler/dao/mapper/UserMapper.xml | 3 +-
.../src/service/modules/users/types.ts | 12 --------
9 files changed, 65 insertions(+), 28 deletions(-)
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/UsersController.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/UsersController.java
index e41e0fe5c2..e7a96fef16 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/UsersController.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/UsersController.java
@@ -35,6 +35,7 @@ import org.apache.dolphinscheduler.api.enums.Status;
import org.apache.dolphinscheduler.api.exceptions.ApiException;
import org.apache.dolphinscheduler.api.service.UsersService;
import org.apache.dolphinscheduler.api.utils.Result;
+import org.apache.dolphinscheduler.api.vo.UserSimpleInfoVO;
import org.apache.dolphinscheduler.common.constants.Constants;
import org.apache.dolphinscheduler.dao.entity.User;
import org.apache.dolphinscheduler.plugin.task.api.utils.ParameterUtils;
@@ -296,7 +297,7 @@ public class UsersController extends BaseController {
@GetMapping(value = "/list-all")
@ResponseStatus(HttpStatus.OK)
@ApiException(USER_LIST_ERROR)
- public Result<List<User>> listAll(@RequestAttribute(value =
Constants.SESSION_USER) User loginUser) {
+ public Result<List<UserSimpleInfoVO>> listAll(@RequestAttribute(value =
Constants.SESSION_USER) User loginUser) {
return Result.success(usersService.queryUserList(loginUser));
}
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/UsersService.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/UsersService.java
index d6fb0dc67f..6619e91ddd 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/UsersService.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/UsersService.java
@@ -18,6 +18,7 @@
package org.apache.dolphinscheduler.api.service;
import org.apache.dolphinscheduler.api.utils.Result;
+import org.apache.dolphinscheduler.api.vo.UserSimpleInfoVO;
import org.apache.dolphinscheduler.common.enums.UserType;
import org.apache.dolphinscheduler.dao.entity.User;
@@ -147,7 +148,7 @@ public interface UsersService {
/**
* query enabled user list
*/
- List<User> queryUserList(User loginUser);
+ List<UserSimpleInfoVO> queryUserList(User loginUser);
/**
* verify user name exists
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java
index db601d18db..54c08e091d 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java
@@ -17,8 +17,6 @@
package org.apache.dolphinscheduler.api.service.impl;
-import static
org.apache.dolphinscheduler.api.constants.ApiFuncIdentificationConstant.USER_MANAGER;
-
import org.apache.dolphinscheduler.api.enums.Status;
import org.apache.dolphinscheduler.api.exceptions.ServiceException;
import org.apache.dolphinscheduler.api.service.SessionService;
@@ -26,9 +24,9 @@ import org.apache.dolphinscheduler.api.service.UsersService;
import org.apache.dolphinscheduler.api.utils.CheckUtils;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.api.utils.Result;
+import org.apache.dolphinscheduler.api.vo.UserSimpleInfoVO;
import org.apache.dolphinscheduler.common.constants.Constants;
import org.apache.dolphinscheduler.common.constants.SystemConstants;
-import org.apache.dolphinscheduler.common.enums.AuthorizationType;
import org.apache.dolphinscheduler.common.enums.Flag;
import org.apache.dolphinscheduler.common.enums.UserType;
import org.apache.dolphinscheduler.common.utils.EncryptionUtils;
@@ -800,12 +798,14 @@ public class UsersServiceImpl extends BaseServiceImpl
implements UsersService {
* @return user list
*/
@Override
- public List<User> queryUserList(User loginUser) {
+ public List<UserSimpleInfoVO> queryUserList(User loginUser) {
// only admin can operate
- if (!canOperatorPermissions(loginUser, null,
AuthorizationType.ACCESS_TOKEN, USER_MANAGER)) {
+ if (!isAdmin(loginUser)) {
throw new ServiceException(Status.USER_NO_OPERATION_PERM);
}
- return userDao.queryEnabledUsers();
+ return userDao.queryEnabledUsers().stream()
+ .map(UserSimpleInfoVO::new)
+ .collect(Collectors.toList());
}
/**
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/vo/UserSimpleInfoVO.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/vo/UserSimpleInfoVO.java
new file mode 100644
index 0000000000..a07158cfda
--- /dev/null
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/vo/UserSimpleInfoVO.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.dolphinscheduler.api.vo;
+
+import org.apache.dolphinscheduler.dao.entity.User;
+
+import lombok.Data;
+
+@Data
+public class UserSimpleInfoVO {
+
+ private Integer id;
+
+ private String userName;
+
+ public UserSimpleInfoVO(User user) {
+ this.id = user.getId();
+ this.userName = user.getUserName();
+ }
+}
diff --git
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/UsersControllerTest.java
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/UsersControllerTest.java
index efc2d4cfd5..c1bf188e86 100644
---
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/UsersControllerTest.java
+++
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/UsersControllerTest.java
@@ -17,9 +17,11 @@
package org.apache.dolphinscheduler.api.controller;
+import static org.hamcrest.Matchers.aMapWithSize;
import static
org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static
org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
import org.apache.dolphinscheduler.api.enums.Status;
@@ -183,6 +185,9 @@ public class UsersControllerTest extends
AbstractControllerTest {
.params(paramsMap))
.andExpect(status().isOk())
.andExpect(content().contentType(MediaType.APPLICATION_JSON))
+ .andExpect(jsonPath("$.data[0]", aMapWithSize(2)))
+ .andExpect(jsonPath("$.data[0].id").isNumber())
+ .andExpect(jsonPath("$.data[0].userName").isString())
.andReturn();
Result result =
JSONUtils.parseObject(mvcResult.getResponse().getContentAsString(),
Result.class);
diff --git
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/UsersServiceTest.java
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/UsersServiceTest.java
index d743448879..661740a7fc 100644
---
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/UsersServiceTest.java
+++
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/UsersServiceTest.java
@@ -30,6 +30,7 @@ import
org.apache.dolphinscheduler.api.service.impl.BaseServiceImpl;
import org.apache.dolphinscheduler.api.service.impl.UsersServiceImpl;
import org.apache.dolphinscheduler.api.utils.PageInfo;
import org.apache.dolphinscheduler.api.utils.Result;
+import org.apache.dolphinscheduler.api.vo.UserSimpleInfoVO;
import org.apache.dolphinscheduler.common.enums.AuthorizationType;
import org.apache.dolphinscheduler.common.enums.UserType;
import org.apache.dolphinscheduler.common.utils.EncryptionUtils;
@@ -225,21 +226,26 @@ public class UsersServiceTest {
@Test
public void testQueryUserList() {
User user = new User();
- user.setUserType(UserType.ADMIN_USER);
+ user.setUserType(UserType.GENERAL_USER);
user.setId(1);
+ // Access token permission must not grant general users access to the
user list.
Mockito.when(resourcePermissionCheckService.operationPermissionCheck(AuthorizationType.ACCESS_TOKEN,
1,
USER_MANAGER, serviceLogger)).thenReturn(true);
-
Mockito.when(resourcePermissionCheckService.resourcePermissionCheck(AuthorizationType.ACCESS_TOKEN,
null, 0,
- serviceLogger)).thenReturn(false);
+
Mockito.when(resourcePermissionCheckService.resourcePermissionCheck(AuthorizationType.ACCESS_TOKEN,
null, 1,
+ serviceLogger)).thenReturn(true);
assertThrowsServiceException(Status.USER_NO_OPERATION_PERM, () ->
usersService.queryUserList(user));
// success
+ user.setUserType(UserType.ADMIN_USER);
Mockito.when(resourcePermissionCheckService.resourcePermissionCheck(AuthorizationType.ACCESS_TOKEN,
null, 0,
serviceLogger)).thenReturn(true);
- when(userDao.queryEnabledUsers()).thenReturn(getUserList());
- List<User> users = usersService.queryUserList(user);
- Assertions.assertFalse(users.isEmpty());
+ User enabledUser = getGeneralUser();
+ enabledUser.setId(2);
+
when(userDao.queryEnabledUsers()).thenReturn(Lists.newArrayList(enabledUser));
+ List<UserSimpleInfoVO> users = usersService.queryUserList(user);
+ Assertions.assertEquals(2, users.get(0).getId());
+ Assertions.assertEquals("userTest0001", users.get(0).getUserName());
}
@Test
diff --git
a/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/entity/User.java
b/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/entity/User.java
index 827a2f575a..3f33623caa 100644
---
a/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/entity/User.java
+++
b/dolphinscheduler-dao/src/main/java/org/apache/dolphinscheduler/dao/entity/User.java
@@ -27,6 +27,7 @@ import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableField;
import com.baomidou.mybatisplus.annotation.TableId;
import com.baomidou.mybatisplus.annotation.TableName;
+import com.fasterxml.jackson.annotation.JsonIgnore;
@Data
@TableName("t_ds_user")
@@ -37,6 +38,7 @@ public class User {
private String userName;
+ @JsonIgnore
private String userPassword;
private String email;
diff --git
a/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml
b/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml
index 506c377f63..1d85f624bb 100644
---
a/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml
+++
b/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml
@@ -130,8 +130,7 @@
where u.id = rel.user_id and rel.project_id = #{projectId}
</select>
<select id="queryEnabledUsers"
resultType="org.apache.dolphinscheduler.dao.entity.User">
- select
- <include refid="baseSql"/>
+ select id, user_name
from t_ds_user
where state = 1
</select>
diff --git a/dolphinscheduler-ui/src/service/modules/users/types.ts
b/dolphinscheduler-ui/src/service/modules/users/types.ts
index 26b6629515..a590980e47 100644
--- a/dolphinscheduler-ui/src/service/modules/users/types.ts
+++ b/dolphinscheduler-ui/src/service/modules/users/types.ts
@@ -97,18 +97,6 @@ interface UserInfoRes extends UserReq, IdReq {
interface UserListRes {
id: number
userName: string
- userPassword: string
- email: string
- phone: string
- userType: string
- tenantId: number
- state: number
- tenantCode?: any
- queueName?: any
- alertGroup?: any
- queue: string
- createTime: string
- updateTime: string
}
export {
