From 810d1685a4b706d3fc726a46f0b4313a9c0f4bac Mon Sep 17 00:00:00 2001 From: wakefu Date: Wed, 15 Jul 2026 12:54:19 +0800 Subject: [PATCH 1/3] [INLONG-12160][Manager] Add permission verification when modifying the datanode --- .../manager/service/node/DataNodeService.java | 2 ++ .../service/node/DataNodeServiceImpl.java | 30 +++++++++++++++++++ .../web/controller/DataNodeController.java | 2 +- 3 files changed, 33 insertions(+), 1 deletion(-) diff --git a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeService.java b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeService.java index 48b900d56b3..762299909cc 100644 --- a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeService.java +++ b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeService.java @@ -76,6 +76,8 @@ public interface DataNodeService { */ DataNodeInfo get(String name, String type); + DataNodeInfo get(String name, String type, String operator); + /** * Paging query nodes according to conditions. * diff --git a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java index 9dc833f8eb0..70819acf783 100644 --- a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java +++ b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java @@ -36,6 +36,7 @@ import com.github.pagehelper.Page; import com.github.pagehelper.PageHelper; import org.apache.commons.lang3.StringUtils; +import org.apache.inlong.manager.service.user.UserService; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -58,6 +59,8 @@ public class DataNodeServiceImpl implements DataNodeService { private DataNodeEntityMapper dataNodeMapper; @Autowired private DataNodeOperatorFactory operatorFactory; + @Autowired + private UserService userService; @Override public Integer save(DataNodeRequest request, String operator) { @@ -112,6 +115,8 @@ public DataNodeInfo get(Integer id, String currentUser) { LOGGER.error("data node not found by id={}", id); throw new BusinessException("data node not found"); } + userService.checkUser(entity.getInCharges(), currentUser, + "Current user does not have permission to get data node info"); String dataNodeType = entity.getType(); DataNodeOperator dataNodeOperator = operatorFactory.getInstance(dataNodeType); DataNodeInfo dataNodeInfo = dataNodeOperator.getFromEntity(entity); @@ -125,6 +130,8 @@ public DataNodeInfo get(Integer id, UserInfo opInfo) { if (entity == null) { throw new BusinessException(ErrorCodeEnum.DATA_NODE_NOT_FOUND); } + userService.checkUser(entity.getInCharges(), opInfo.getName(), + "Current user does not have permission to get data node info"); DataNodeOperator dataNodeOperator = operatorFactory.getInstance(entity.getType()); return dataNodeOperator.getFromEntity(entity); } @@ -144,6 +151,21 @@ public DataNodeInfo get(String name, String type) { return dataNodeInfo; } + @Override + public DataNodeInfo get(String name, String type, String operator) { + DataNodeEntity entity = dataNodeMapper.selectByUniqueKey(name, type); + if (entity == null) { + String errMsg = String.format("data node not found by name=%s, type=%s", name, type); + LOGGER.error(errMsg); + throw new BusinessException(errMsg); + } + userService.checkUser(entity.getInCharges(), operator, "Current user does not have permission to delete data node info"); + DataNodeOperator dataNodeOperator = operatorFactory.getInstance(type); + DataNodeInfo dataNodeInfo = dataNodeOperator.getFromEntity(entity); + LOGGER.debug("success to get data node by name={} type={}", name, type); + return dataNodeInfo; + } + @Override public PageResult list(DataNodePageRequest request) { PageHelper.startPage(request.getPageNum(), request.getPageSize()); @@ -182,6 +204,8 @@ public Boolean update(DataNodeRequest request, String operator) { } // check whether modify unmodifiable parameters chkUnmodifiableParams(curEntity, request); + userService.checkUser(curEntity.getInCharges(), operator, + "Current user does not have permission to update data node info"); // after the update operation, `curEntity` will be updated to the latest info by the MyBatis cache mechanism, // so we need to get an `oldEntity` by copying `curEntity` before the update operation. @@ -216,6 +240,8 @@ public UpdateResult updateByKey(DataNodeRequest request, String operator) { LOGGER.error(errMsg); throw new BusinessException(errMsg); } + userService.checkUser(entity.getInCharges(), operator, + "Current user does not have permission to update data node info"); request.setId(entity.getId()); Boolean result = this.update(request, operator); LOGGER.info("success to update data node by key: {}", request); @@ -235,6 +261,8 @@ public Boolean delete(Integer id, UserInfo opInfo) { DataNodeEntity entity = dataNodeMapper.selectById(id); Preconditions.expectNotNull(entity, ErrorCodeEnum.DATA_NODE_NOT_FOUND, ErrorCodeEnum.DATA_NODE_NOT_FOUND.getMessage()); + userService.checkUser(entity.getInCharges(), opInfo.getName(), + "Current user does not have permission to delete data node info"); // delete record entity.setIsDeleted(entity.getId()); entity.setModifier(opInfo.getName()); @@ -250,6 +278,8 @@ public Boolean delete(Integer id, UserInfo opInfo) { private Boolean delete(DataNodeEntity entity, String operator) { entity.setIsDeleted(entity.getId()); entity.setModifier(operator); + userService.checkUser(entity.getInCharges(), operator, + "Current user does not have permission to delete data node info"); int rowCount = dataNodeMapper.updateById(entity); if (rowCount != InlongConstants.AFFECTED_ONE_ROW) { LOGGER.error("data node has already updated, data node name={}, type={}, current version ={}", diff --git a/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/controller/DataNodeController.java b/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/controller/DataNodeController.java index 4fb5487abcf..f4488a1fa4c 100644 --- a/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/controller/DataNodeController.java +++ b/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/controller/DataNodeController.java @@ -86,7 +86,7 @@ public Response get(@PathVariable Integer id) { @ApiImplicitParam(name = "type", value = "Data node type", dataTypeClass = String.class, required = true) }) public Response getByKey(@RequestParam String name, @RequestParam String type) { - return Response.success(dataNodeService.get(name, type)); + return Response.success(dataNodeService.get(name, type, LoginUserUtils.getLoginUser().getName())); } @PostMapping(value = "/node/list") From dc58193bcb4072ba186f0ac01930b66b207d6f5b Mon Sep 17 00:00:00 2001 From: wakefu Date: Wed, 15 Jul 2026 13:02:21 +0800 Subject: [PATCH 2/3] [INLONG-12160][Manager] Add permission verification when modifying the datanode --- .../inlong/manager/service/node/DataNodeServiceImpl.java | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java index 70819acf783..8dd7b0df31a 100644 --- a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java +++ b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java @@ -173,7 +173,9 @@ public PageResult list(DataNodePageRequest request) { PageResult pageResult = PageResult.fromPage(entityPage) .map(entity -> { DataNodeOperator dataNodeOperator = operatorFactory.getInstance(entity.getType()); - return dataNodeOperator.getFromEntity(entity); + DataNodeInfo dataNodeInfo = dataNodeOperator.getFromEntity(entity); + dataNodeInfo.setToken(null); + return dataNodeInfo; }); LOGGER.debug("success to list data node by {}", request); return pageResult; @@ -188,7 +190,9 @@ public List list(DataNodePageRequest request, UserInfo opInfo) { return nodeEntities.stream() .map(entity -> { DataNodeOperator dataNodeOperator = operatorFactory.getInstance(entity.getType()); - return dataNodeOperator.getFromEntity(entity); + DataNodeInfo dataNodeInfo = dataNodeOperator.getFromEntity(entity); + dataNodeInfo.setToken(null); + return dataNodeInfo; }).collect(Collectors.toList()); } From db63884d7408d5d729b79b09a920036970844afe Mon Sep 17 00:00:00 2001 From: wakefu Date: Wed, 15 Jul 2026 13:03:47 +0800 Subject: [PATCH 3/3] [INLONG-12160][Manager] Add permission verification when modifying the datanode --- .../inlong/manager/service/node/DataNodeServiceImpl.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java index 8dd7b0df31a..99a1ad56c3c 100644 --- a/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java +++ b/inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/node/DataNodeServiceImpl.java @@ -32,11 +32,11 @@ import org.apache.inlong.manager.pojo.node.DataNodePageRequest; import org.apache.inlong.manager.pojo.node.DataNodeRequest; import org.apache.inlong.manager.pojo.user.UserInfo; +import org.apache.inlong.manager.service.user.UserService; import com.github.pagehelper.Page; import com.github.pagehelper.PageHelper; import org.apache.commons.lang3.StringUtils; -import org.apache.inlong.manager.service.user.UserService; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -159,7 +159,8 @@ public DataNodeInfo get(String name, String type, String operator) { LOGGER.error(errMsg); throw new BusinessException(errMsg); } - userService.checkUser(entity.getInCharges(), operator, "Current user does not have permission to delete data node info"); + userService.checkUser(entity.getInCharges(), operator, + "Current user does not have permission to delete data node info"); DataNodeOperator dataNodeOperator = operatorFactory.getInstance(type); DataNodeInfo dataNodeInfo = dataNodeOperator.getFromEntity(entity); LOGGER.debug("success to get data node by name={} type={}", name, type);