(inlong) branch master updated: [INLONG-12187][Manager] Add user permission verification to API /user/get/{id} and /app/cluster/node/listByGroupId (#12188)

[wakefu]

This is an automated email from the ASF dual-hosted git repository.

fuweng11 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/inlong.git


The following commit(s) were added to refs/heads/master by this push:
     new 66c76fc4c8 [INLONG-12187][Manager] Add user permission verification to 
API /user/get/{id} and /app/cluster/node/listByGroupId (#12188)
66c76fc4c8 is described below

commit 66c76fc4c82b3d757b6f64ef31bf3b00e3756522
Author: fuweng11 <76141879+fuwen...@users.noreply.github.com>
AuthorDate: Wed Aug 19 15:18:13 2026 +0800

    [INLONG-12187][Manager] Add user permission verification to API 
/user/get/{id} and /app/cluster/node/listByGroupId (#12188)
    
    Co-authored-by: wakefu <wak...@tencent.com>
---
 .../manager/service/cluster/InlongClusterServiceImpl.java   | 13 ++++++++++++-
 .../apache/inlong/manager/service/user/UserServiceImpl.java | 13 ++++++++++---
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/cluster/InlongClusterServiceImpl.java
 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/cluster/InlongClusterServiceImpl.java
index 6161b7e05f..6a31b63cba 100644
--- 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/cluster/InlongClusterServiceImpl.java
+++ 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/cluster/InlongClusterServiceImpl.java
@@ -808,7 +808,14 @@ public class InlongClusterServiceImpl implements 
InlongClusterService {
     public List<ClusterNodeResponse> listNodeByGroupId(String groupId, String 
clusterType, String protocolType) {
         LOGGER.debug("begin to get cluster nodes for groupId={}, 
clusterType={}, protocol={}",
                 groupId, clusterType, protocolType);
-
+        InlongGroupEntity groupEntity = groupMapper.selectByGroupId(groupId);
+        if (groupEntity == null) {
+            LOGGER.error("inlong group not found by groupId={}", groupId);
+            throw new BusinessException(ErrorCodeEnum.GROUP_NOT_FOUND);
+        }
+        String username = LoginUserUtils.getLoginUser().getName();
+        userService.checkUser(groupEntity.getInCharges(), username,
+                "Current user does not have permission to get cluster info");
         List<InlongClusterNodeEntity> nodeEntities = getClusterNodes(groupId, 
clusterType, protocolType);
         if (CollectionUtils.isEmpty(nodeEntities)) {
             LOGGER.debug("not any cluster node for groupId={}, clusterType={}, 
protocol={}",
@@ -817,6 +824,10 @@ public class InlongClusterServiceImpl implements 
InlongClusterService {
         }
 
         List<ClusterNodeResponse> result = 
CommonBeanUtils.copyListProperties(nodeEntities, ClusterNodeResponse::new);
+        result.forEach(node -> {
+            node.setUsername(null);
+            node.setPassword(null);
+        });
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("success to get nodes for groupId={}, clusterType={}, 
protocol={}, result size={}",
                     groupId, clusterType, protocolType, result);
diff --git 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/user/UserServiceImpl.java
 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/user/UserServiceImpl.java
index 21282d9180..c71b45a327 100644
--- 
a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/user/UserServiceImpl.java
+++ 
b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/user/UserServiceImpl.java
@@ -163,8 +163,13 @@ public class UserServiceImpl implements UserService {
         UserEntity entity = userMapper.selectById(userId);
         Preconditions.expectNotNull(entity, "User not exists with id " + 
userId);
         UserEntity curUser = userMapper.selectByName(currentUser);
-        
Preconditions.expectTrue(TenantUserTypeEnum.TENANT_ADMIN.getCode().equals(curUser.getAccountType())
-                || Objects.equals(entity.getName(), currentUser),
+        Preconditions.expectNotNull(curUser, "Current user not exists");
+
+        UserInfo loginUser = LoginUserUtils.getLoginUser();
+        boolean isInlongAdmin = loginUser != null && loginUser.getRoles() != 
null
+                && loginUser.getRoles().contains(UserRoleCode.INLONG_ADMIN);
+        boolean isSelf = Objects.equals(entity.getName(), currentUser);
+        Preconditions.expectTrue(isInlongAdmin || isSelf,
                 "Current user does not have permission to get other users' 
info");
 
         UserInfo result = new UserInfo();
@@ -174,7 +179,9 @@ public class UserServiceImpl implements UserService {
         result.setAccountType(entity.getAccountType());
         result.setVersion(entity.getVersion());
 
-        if (StringUtils.isNotBlank(entity.getSecretKey()) && 
StringUtils.isNotBlank(entity.getPublicKey())) {
+        if (isSelf
+                && StringUtils.isNotBlank(entity.getSecretKey())
+                && StringUtils.isNotBlank(entity.getPublicKey())) {
             try {
                 // decipher according to stored key version
                 // note that if the version is null then the string is treated 
as unencrypted plain text