roryqi commented on code in PR #12001:
URL: https://github.com/apache/gravitino/pull/12001#discussion_r3594935548
##########
server-common/src/main/java/org/apache/gravitino/server/authorization/jcasbin/JcasbinAuthorizer.java:
##########
@@ -470,70 +469,102 @@ public boolean isSelf(
public boolean hasSetOwnerPermission(
String metalake, String type, String fullName,
AuthorizationRequestContext requestContext) {
Principal currentPrincipal = PrincipalUtils.getCurrentPrincipal();
+ MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
MetadataObject metalakeObject =
MetadataObjects.of(ImmutableList.of(metalake),
MetadataObject.Type.METALAKE);
+
// metalake owner can set owner in metalake.
if (isOwner(currentPrincipal, metalake, metalakeObject, requestContext)) {
return true;
}
- MetadataObject.Type metadataType =
MetadataObject.Type.valueOf(type.toUpperCase(Locale.ROOT));
- MetadataObject metadataObject =
- MetadataObjects.of(Arrays.asList(fullName.split("\\.")), metadataType);
+
+ MetadataObject metadataObject = MetadataObjects.parse(fullName,
metadataType);
do {
if (isOwner(currentPrincipal, metalake, metadataObject, requestContext))
{
- MetadataObject.Type tempType = metadataObject.type();
- if (tempType == MetadataObject.Type.SCHEMA) {
- boolean hasCatalogUseCatalog =
- authorize(
- currentPrincipal,
- metalake,
- MetadataObjects.parent(metadataObject),
- Privilege.Name.USE_CATALOG,
- requestContext);
- boolean hasMetalakeUseCatalog =
- authorize(
- currentPrincipal,
- metalake,
- metalakeObject,
- Privilege.Name.USE_CATALOG,
- requestContext);
- return hasCatalogUseCatalog || hasMetalakeUseCatalog;
- }
- if (tempType == MetadataObject.Type.TABLE
- || tempType == MetadataObject.Type.VIEW
- || tempType == MetadataObject.Type.TOPIC
- || tempType == MetadataObject.Type.FILESET
- || tempType == MetadataObject.Type.MODEL) {
- boolean hasMetalakeUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- metalakeObject,
- Privilege.Name.USE_SCHEMA,
- requestContext);
- MetadataObject schemaObject = MetadataObjects.parent(metadataObject);
- boolean hasCatalogUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- MetadataObjects.parent(schemaObject),
- Privilege.Name.USE_SCHEMA,
- requestContext);
- boolean hasSchemaUseSchema =
- authorize(
- currentPrincipal,
- metalake,
- schemaObject,
- Privilege.Name.USE_SCHEMA,
- requestContext);
- return hasMetalakeUseSchema || hasCatalogUseSchema ||
hasSchemaUseSchema;
- }
- return true;
+ return hasParentUsagePermission(
+ currentPrincipal, metalake, metadataObject, metalakeObject,
requestContext);
}
} while ((metadataObject = MetadataObjects.parent(metadataObject)) !=
null);
return false;
}
+ private boolean hasAuthorizeWithoutDeny(
+ Principal principal,
+ String metalake,
+ List<MetadataObject> authorizeObjects,
+ List<MetadataObject> denyObjects,
+ Privilege.Name privilege,
+ AuthorizationRequestContext requestContext) {
+ return hasAuthorizeOnAny(principal, metalake, authorizeObjects, privilege,
requestContext)
Review Comment:
The user doesn't have the allow privileges in the most cases. So this order
has the better performance.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
