• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

apache / iotdb / #9890

22 Aug 2023 09:07AM UTC coverage: 47.922% (-0.07%) from 47.992%
#9890

push

travis_ci

web-flow
[IOTDB-6114] Pipe: Support multi-cluster data sync (#10868)(#10926)

306 of 306 new or added lines in 33 files covered. (100.0%)

79862 of 166649 relevant lines covered (47.92%)

0.48 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java
1
/*
2
 * Licensed to the Apache Software Foundation (ASF) under one
3
 * or more contributor license agreements.  See the NOTICE file
4
 * distributed with this work for additional information
5
 * regarding copyright ownership.  The ASF licenses this file
6
 * to you under the Apache License, Version 2.0 (the
7
 * "License"); you may not use this file except in compliance
8
 * with the License.  You may obtain a copy of the License at
9
 *
10
 *     http://www.apache.org/licenses/LICENSE-2.0
11
 *
12
 * Unless required by applicable law or agreed to in writing,
13
 * software distributed under the License is distributed on an
14
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15
 * KIND, either express or implied.  See the License for the
16
 * specific language governing permissions and limitations
17
 * under the License.
18
 */
19

20
package org.apache.iotdb.db.auth;
21

22
import org.apache.iotdb.common.rpc.thrift.TSStatus;
23
import org.apache.iotdb.commons.auth.AuthException;
24
import org.apache.iotdb.commons.auth.entity.PrivilegeType;
25
import org.apache.iotdb.commons.conf.CommonDescriptor;
26
import org.apache.iotdb.commons.path.PartialPath;
27
import org.apache.iotdb.commons.service.metric.PerformanceOverviewMetrics;
28
import org.apache.iotdb.commons.utils.AuthUtils;
29
import org.apache.iotdb.db.protocol.session.IClientSession;
30
import org.apache.iotdb.db.protocol.thrift.OperationType;
31
import org.apache.iotdb.db.queryengine.plan.statement.Statement;
32
import org.apache.iotdb.db.queryengine.plan.statement.StatementType;
33
import org.apache.iotdb.db.queryengine.plan.statement.sys.AuthorStatement;
34
import org.apache.iotdb.rpc.RpcUtils;
35
import org.apache.iotdb.rpc.TSStatusCode;
36

37
import org.slf4j.Logger;
38
import org.slf4j.LoggerFactory;
39

40
import java.util.ArrayList;
41
import java.util.List;
42

43
import static org.apache.iotdb.db.utils.ErrorHandlingUtils.onQueryException;
44

45
public class AuthorityChecker {
46

47
  private static final String SUPER_USER =
48
      CommonDescriptor.getInstance().getConfig().getAdminName();
×
49
  private static final Logger logger = LoggerFactory.getLogger(AuthorityChecker.class);
×
50

51
  private static final AuthorizerManager authorizerManager = AuthorizerManager.getInstance();
×
52

53
  private static final PerformanceOverviewMetrics PERFORMANCE_OVERVIEW_METRICS =
×
54
      PerformanceOverviewMetrics.getInstance();
×
55

56
  private AuthorityChecker() {
57
    // Empty constructor
58
  }
59

60
  /**
61
   * Check permission(datanode to confignode).
62
   *
63
   * @param username username
64
   * @param paths paths in List structure
65
   * @param type Statement Type
66
   * @param targetUser target user
67
   * @return if permission-check is passed
68
   */
69
  public static boolean checkPermission(
70
      String username, List<? extends PartialPath> paths, StatementType type, String targetUser) {
71
    if (SUPER_USER.equals(username)) {
×
72
      return true;
×
73
    }
74

75
    int permission = translateToPermissionId(type);
×
76
    if (permission == -1) {
×
77
      return false;
×
78
    } else if (permission == PrivilegeType.MODIFY_PASSWORD.ordinal()
×
79
        && username.equals(targetUser)) {
×
80
      // A user can modify his own password
81
      return true;
×
82
    }
83

84
    List<PartialPath> allPath = new ArrayList<>();
×
85
    if (paths != null && !paths.isEmpty()) {
×
86
      for (PartialPath path : paths) {
×
87
        allPath.add(path == null ? AuthUtils.ROOT_PATH_PRIVILEGE_PATH : path);
×
88
      }
×
89
    } else {
90
      allPath.add(AuthUtils.ROOT_PATH_PRIVILEGE_PATH);
×
91
    }
92

93
    TSStatus status = authorizerManager.checkPath(username, allPath, permission);
×
94
    return status.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode();
×
95
  }
96

97
  private static boolean checkOnePath(String username, PartialPath path, int permission)
98
      throws AuthException {
99
    try {
100
      PartialPath newPath = path == null ? AuthUtils.ROOT_PATH_PRIVILEGE_PATH : path;
×
101
      if (authorizerManager.checkUserPrivileges(username, newPath, permission)) {
×
102
        return true;
×
103
      }
104
    } catch (AuthException e) {
×
105
      logger.error("Error occurs when checking the seriesPath {} for user {}", path, username, e);
×
106
      throw new AuthException(TSStatusCode.ILLEGAL_PARAMETER, e);
×
107
    }
×
108
    return false;
×
109
  }
110

111
  /** Check whether specific Session has the authorization to given plan. */
112
  public static TSStatus checkAuthority(Statement statement, IClientSession session) {
113
    long startTime = System.nanoTime();
×
114
    try {
115
      if (!checkAuthorization(statement, session.getUsername())) {
×
116
        return RpcUtils.getStatus(
×
117
            TSStatusCode.NO_PERMISSION,
118
            "No permissions for this operation, please add privilege "
119
                + PrivilegeType.values()[
×
120
                    AuthorityChecker.translateToPermissionId(statement.getType())]);
×
121
      }
122
    } catch (AuthException e) {
×
123
      logger.warn("Meets error while checking authorization.", e);
×
124
      return RpcUtils.getStatus(e.getCode(), e.getMessage());
×
125
    } catch (Exception e) {
×
126
      return onQueryException(
×
127
          e, OperationType.CHECK_AUTHORITY.getName(), TSStatusCode.EXECUTE_STATEMENT_ERROR);
×
128
    } finally {
129
      PERFORMANCE_OVERVIEW_METRICS.recordAuthCost(System.nanoTime() - startTime);
×
130
    }
131
    return RpcUtils.getStatus(TSStatusCode.SUCCESS_STATUS);
×
132
  }
133

134
  /**
135
   * Check whether specific user has the authorization to given plan.
136
   *
137
   * @throws AuthException if encountered authentication failure
138
   * @return true if the authority permission has passed
139
   */
140
  public static boolean checkAuthorization(Statement statement, String username)
141
      throws AuthException {
142
    if (!statement.isAuthenticationRequired()) {
×
143
      return true;
×
144
    }
145
    String targetUser = null;
×
146
    if (statement instanceof AuthorStatement) {
×
147
      targetUser = ((AuthorStatement) statement).getUserName();
×
148
    }
149
    return AuthorityChecker.checkPermission(
×
150
        username, statement.getPaths(), statement.getType(), targetUser);
×
151
  }
152

153
  private static int translateToPermissionId(StatementType type) {
154
    switch (type) {
×
155
      case CREATE_ROLE:
156
        return PrivilegeType.CREATE_ROLE.ordinal();
×
157
      case CREATE_USER:
158
        return PrivilegeType.CREATE_USER.ordinal();
×
159
      case DELETE_USER:
160
        return PrivilegeType.DELETE_USER.ordinal();
×
161
      case DELETE_ROLE:
162
        return PrivilegeType.DELETE_ROLE.ordinal();
×
163
      case MODIFY_PASSWORD:
164
        return PrivilegeType.MODIFY_PASSWORD.ordinal();
×
165
      case GRANT_USER_PRIVILEGE:
166
        return PrivilegeType.GRANT_USER_PRIVILEGE.ordinal();
×
167
      case GRANT_ROLE_PRIVILEGE:
168
        return PrivilegeType.GRANT_ROLE_PRIVILEGE.ordinal();
×
169
      case REVOKE_USER_PRIVILEGE:
170
        return PrivilegeType.REVOKE_USER_PRIVILEGE.ordinal();
×
171
      case REVOKE_ROLE_PRIVILEGE:
172
        return PrivilegeType.REVOKE_ROLE_PRIVILEGE.ordinal();
×
173
      case GRANT_USER_ROLE:
174
        return PrivilegeType.GRANT_USER_ROLE.ordinal();
×
175
      case REVOKE_USER_ROLE:
176
        return PrivilegeType.REVOKE_USER_ROLE.ordinal();
×
177
      case STORAGE_GROUP_SCHEMA:
178
      case TTL:
179
        return PrivilegeType.CREATE_DATABASE.ordinal();
×
180
      case DELETE_STORAGE_GROUP:
181
        return PrivilegeType.DELETE_DATABASE.ordinal();
×
182
      case CREATE_TIMESERIES:
183
      case CREATE_ALIGNED_TIMESERIES:
184
      case CREATE_MULTI_TIMESERIES:
185
        return PrivilegeType.CREATE_TIMESERIES.ordinal();
×
186
      case DELETE_TIMESERIES:
187
      case DELETE:
188
      case DROP_INDEX:
189
        return PrivilegeType.DELETE_TIMESERIES.ordinal();
×
190
      case ALTER_TIMESERIES:
191
        return PrivilegeType.ALTER_TIMESERIES.ordinal();
×
192
      case SHOW:
193
      case QUERY:
194
      case GROUP_BY_TIME:
195
      case QUERY_INDEX:
196
      case AGGREGATION:
197
      case UDAF:
198
      case UDTF:
199
      case LAST:
200
      case FILL:
201
      case GROUP_BY_FILL:
202
      case SELECT_INTO:
203
      case COUNT:
204
        return PrivilegeType.READ_TIMESERIES.ordinal();
×
205
      case INSERT:
206
      case LOAD_DATA:
207
      case CREATE_INDEX:
208
      case BATCH_INSERT:
209
      case BATCH_INSERT_ONE_DEVICE:
210
      case BATCH_INSERT_ROWS:
211
      case MULTI_BATCH_INSERT:
212
      case PIPE_ENRICHED_INSERT:
213
        return PrivilegeType.INSERT_TIMESERIES.ordinal();
×
214
      case LIST_ROLE:
215
      case LIST_ROLE_USERS:
216
      case LIST_ROLE_PRIVILEGE:
217
        return PrivilegeType.LIST_ROLE.ordinal();
×
218
      case LIST_USER:
219
      case LIST_USER_ROLES:
220
      case LIST_USER_PRIVILEGE:
221
        return PrivilegeType.LIST_USER.ordinal();
×
222
      case CREATE_FUNCTION:
223
        return PrivilegeType.CREATE_FUNCTION.ordinal();
×
224
      case DROP_FUNCTION:
225
        return PrivilegeType.DROP_FUNCTION.ordinal();
×
226
      case CREATE_TRIGGER:
227
        return PrivilegeType.CREATE_TRIGGER.ordinal();
×
228
      case DROP_TRIGGER:
229
        return PrivilegeType.DROP_TRIGGER.ordinal();
×
230
      case CREATE_CONTINUOUS_QUERY:
231
        return PrivilegeType.CREATE_CONTINUOUS_QUERY.ordinal();
×
232
      case DROP_CONTINUOUS_QUERY:
233
        return PrivilegeType.DROP_CONTINUOUS_QUERY.ordinal();
×
234
      case CREATE_TEMPLATE:
235
      case DROP_TEMPLATE:
236
        return PrivilegeType.UPDATE_TEMPLATE.ordinal();
×
237
      case SET_TEMPLATE:
238
      case ACTIVATE_TEMPLATE:
239
      case DEACTIVATE_TEMPLATE:
240
      case UNSET_TEMPLATE:
241
        return PrivilegeType.APPLY_TEMPLATE.ordinal();
×
242
      case SHOW_SCHEMA_TEMPLATE:
243
      case SHOW_NODES_IN_SCHEMA_TEMPLATE:
244
        return PrivilegeType.READ_TEMPLATE.ordinal();
×
245
      case SHOW_PATH_SET_SCHEMA_TEMPLATE:
246
      case SHOW_PATH_USING_SCHEMA_TEMPLATE:
247
        return PrivilegeType.READ_TEMPLATE_APPLICATION.ordinal();
×
248
      case SHOW_CONTINUOUS_QUERIES:
249
        return PrivilegeType.SHOW_CONTINUOUS_QUERIES.ordinal();
×
250
      case CREATE_PIPEPLUGIN:
251
        return PrivilegeType.CREATE_PIPEPLUGIN.ordinal();
×
252
      case DROP_PIPEPLUGIN:
253
        return PrivilegeType.DROP_PIPEPLUGIN.ordinal();
×
254
      case SHOW_PIPEPLUGINS:
255
        return PrivilegeType.SHOW_PIPEPLUGINS.ordinal();
×
256
      case CREATE_PIPE:
257
        return PrivilegeType.CREATE_PIPE.ordinal();
×
258
      case START_PIPE:
259
        return PrivilegeType.START_PIPE.ordinal();
×
260
      case STOP_PIPE:
261
        return PrivilegeType.STOP_PIPE.ordinal();
×
262
      case DROP_PIPE:
263
        return PrivilegeType.DROP_PIPE.ordinal();
×
264
      case SHOW_PIPES:
265
        return PrivilegeType.SHOW_PIPES.ordinal();
×
266
      case CREATE_LOGICAL_VIEW:
267
        return PrivilegeType.CREATE_VIEW.ordinal();
×
268
      case ALTER_LOGICAL_VIEW:
269
        return PrivilegeType.ALTER_VIEW.ordinal();
×
270
      case RENAME_LOGICAL_VIEW:
271
        return PrivilegeType.RENAME_VIEW.ordinal();
×
272
      case DELETE_LOGICAL_VIEW:
273
        return PrivilegeType.DELETE_VIEW.ordinal();
×
274
      default:
275
        logger.error("Unrecognizable operator type ({}) for AuthorityChecker.", type);
×
276
        return -1;
×
277
    }
278
  }
279
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc