roryqi commented on code in PR #12001:
URL: https://github.com/apache/gravitino/pull/12001#discussion_r3583972227
##########
server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java:
##########
@@ -470,70 +469,109 @@ public boolean isSelf(
public boolean hasSetOwnerPermission(
String metalake, String type, String fullName,
AuthorizationRequestContext requestContext) {
Principal currentPrincipal = PrincipalUtils.getCurrentPrincipal();
+ MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
+ MetadataObject targetObject = MetadataObjects.parse(fullName,
metadataType);
MetadataObject metalakeObject =
MetadataObjects.of(ImmutableList.of(metalake),
MetadataObject.Type.METALAKE);
+
// metalake owner can set owner in metalake.
if (isOwner(currentPrincipal, metalake, metalakeObject, requestContext)) {
return true;
}
- MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
- MetadataObject metadataObject =
- MetadataObjects.of(Arrays.asList(fullName.split("\\.")), metadataType);
+
+ MetadataObject metadataObject = targetObject;
do {
if (isOwner(currentPrincipal, metalake, metadataObject, requestContext))
{
- MetadataObject.Type tempType = metadataObject.type();
- if (tempType == MetadataObject.Type.SCHEMA) {
- boolean hasCatalogUseCatalog =
- authorize(
- currentPrincipal,
- metalake,
- MetadataObjects.parent(metadataObject),
- Privilege.Name.USE_CATALOG,
- requestContext);
- boolean hasMetalakeUseCatalog =
- authorize(
- currentPrincipal,
- metalake,
- metalakeObject,
- Privilege.Name.USE_CATALOG,
- requestContext);
- return hasCatalogUseCatalog || hasMetalakeUseCatalog;
- }
- if (tempType == MetadataObject.Type.TABLE
- || tempType == MetadataObject.Type.VIEW
- || tempType == MetadataObject.Type.TOPIC
- || tempType == MetadataObject.Type.FILESET
- || tempType == MetadataObject.Type.MODEL) {
- boolean hasMetalakeUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- metalakeObject,
- Privilege.Name.USE_SCHEMA,
- requestContext);
- MetadataObject schemaObject = MetadataObjects.parent(metadataObject);
- boolean hasCatalogUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- MetadataObjects.parent(schemaObject),
- Privilege.Name.USE_SCHEMA,
- requestContext);
- boolean hasSchemaUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- schemaObject,
- Privilege.Name.USE_SCHEMA,
- requestContext);
- return hasMetalakeUseSchema || hasCatalogUseSchema ||
hasSchemaUseSchema;
- }
- return true;
+ return hasParentUsagePermission(
+ currentPrincipal, metalake, metadataObject, metalakeObject,
requestContext);
}
} while ((metadataObject = MetadataObjects.parent(metadataObject)) !=
null);
return false;
}
+ private boolean hasAuthorizeWithoutDeny(
+ Principal principal,
+ String metalake,
+ List<MetadataObject> authorizeObjects,
+ List<MetadataObject> denyObjects,
+ Privilege.Name privilege,
+ AuthorizationRequestContext requestContext) {
+ return hasAuthorizeOnAny(principal, metalake, authorizeObjects, privilege,
requestContext)
+ && !hasDenyOnAny(principal, metalake, denyObjects, privilege,
requestContext);
+ }
+
+ private boolean hasAuthorizeOnAny(
+ Principal principal,
+ String metalake,
+ List<MetadataObject> metadataObjects,
+ Privilege.Name privilege,
+ AuthorizationRequestContext requestContext) {
+ for (MetadataObject metadataObject : metadataObjects) {
+ if (authorize(principal, metalake, metadataObject, privilege,
requestContext)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ private boolean hasDenyOnAny(
+ Principal principal,
+ String metalake,
+ List<MetadataObject> metadataObjects,
+ Privilege.Name privilege,
+ AuthorizationRequestContext requestContext) {
+ for (MetadataObject metadataObject : metadataObjects) {
+ if (deny(principal, metalake, metadataObject, privilege,
requestContext)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ private boolean hasParentUsagePermission(
+ Principal principal,
+ String metalake,
+ MetadataObject targetObject,
+ MetadataObject metalakeObject,
+ AuthorizationRequestContext requestContext) {
+ MetadataObject.Type targetType = targetObject.type();
+ if (targetType == MetadataObject.Type.SCHEMA) {
+ List<MetadataObject> useCatalogObjects =
+ ImmutableList.of(MetadataObjects.parent(targetObject),
metalakeObject);
+ return hasAuthorizeWithoutDeny(
+ principal,
+ metalake,
+ useCatalogObjects,
+ useCatalogObjects,
+ Privilege.Name.USE_CATALOG,
+ requestContext);
+ }
+ if (targetType == MetadataObject.Type.TABLE
+ || targetType == MetadataObject.Type.VIEW
+ || targetType == MetadataObject.Type.TOPIC
+ || targetType == MetadataObject.Type.FILESET
+ || targetType == MetadataObject.Type.MODEL) {
Review Comment:
Ok, I should add them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
