Skip to content

[Auth].Refine author statement and add parser test for user/role's privilege management #11027

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JackieTien97 merged 3 commits into from
Sep 4, 2023
Merged

[Auth].Refine author statement and add parser test for user/role's privilege management #11027

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7d10156
[auth].fix parser.
ColinLeeo Sep 3, 2023
74b1bc3
[auth].fix header.
ColinLeeo Sep 3, 2023
cfcf43b
[auth] fix read write.
ColinLeeo Sep 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions iotdb-core/antlr/src/main/antlr4/org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -861,7 +861,7 @@ grantOpt

// Grant User Role
grantRoleToUser
: GRANT roleName=identifier TO userName=identifier
: GRANT ROLE roleName=identifier TO userName=identifier
;

// Revoke User Privileges
Expand All @@ -876,7 +876,7 @@ revokeRole

// Revoke Role From User
revokeRoleFromUser
: REVOKE roleName=identifier FROM userName=identifier
: REVOKE ROLE roleName=identifier FROM userName=identifier
;

// Drop User
Expand All @@ -899,14 +899,14 @@ listRole
: LIST ROLE (OF USER userName=usernameWithRoot)?
;

// List Privileges of Users On Specific Path
// List Privileges of Users
listPrivilegesUser
: LIST PRIVILEGES USER userName=usernameWithRoot (ON prefixPath (COMMA prefixPath)*)?
: LIST PRIVILEGES OF USER userName=usernameWithRoot
;

// List Privileges of Roles On Specific Path
// List Privileges of Roles
listPrivilegesRole
: LIST PRIVILEGES ROLE roleName=identifier (ON prefixPath (COMMA prefixPath)*)?
: LIST PRIVILEGES OF ROLE roleName=identifier
;

privileges
Expand Down
67 changes: 45 additions & 22 deletions ...b-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/parser/ASTVisitor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2195,10 +2195,11 @@ public Statement visitGrantUser(IoTDBSqlParser.GrantUserContext ctx) {
.distinct()
.collect(Collectors.toList());
checkGrantRevokePrivileges(privileges, nodeNameList);
String[] priviParsed = parsePrivilege(privileges);

AuthorStatement authorStatement = new AuthorStatement(AuthorType.GRANT_USER);
authorStatement.setUserName(parseIdentifier(ctx.userName.getText()));
authorStatement.setPrivilegeList(privileges);
authorStatement.setPrivilegeList(priviParsed);
authorStatement.setNodeNameList(nodeNameList);
authorStatement.setGrantOpt(ctx.grantOpt() != null);
return authorStatement;
Expand All @@ -2215,10 +2216,11 @@ public Statement visitGrantRole(IoTDBSqlParser.GrantRoleContext ctx) {
.distinct()
.collect(Collectors.toList());
checkGrantRevokePrivileges(privileges, nodeNameList);
String[] priviParsed = parsePrivilege(privileges);

AuthorStatement authorStatement = new AuthorStatement(AuthorType.GRANT_ROLE);
authorStatement.setRoleName(parseIdentifier(ctx.roleName.getText()));
authorStatement.setPrivilegeList(privileges);
authorStatement.setPrivilegeList(priviParsed);
authorStatement.setNodeNameList(nodeNameList);
authorStatement.setGrantOpt(ctx.grantOpt() != null);
return authorStatement;
Expand All @@ -2245,10 +2247,11 @@ public Statement visitRevokeUser(IoTDBSqlParser.RevokeUserContext ctx) {
.distinct()
.collect(Collectors.toList());
checkGrantRevokePrivileges(privileges, nodeNameList);
String[] priviParsed = parsePrivilege(privileges);

AuthorStatement authorStatement = new AuthorStatement(AuthorType.REVOKE_USER);
authorStatement.setUserName(parseIdentifier(ctx.userName.getText()));
authorStatement.setPrivilegeList(privileges);
authorStatement.setPrivilegeList(priviParsed);
authorStatement.setNodeNameList(nodeNameList);
return authorStatement;
}
Expand All @@ -2264,40 +2267,66 @@ public Statement visitRevokeRole(IoTDBSqlParser.RevokeRoleContext ctx) {
.distinct()
.collect(Collectors.toList());
checkGrantRevokePrivileges(privileges, nodeNameList);
String[] priviParsed = parsePrivilege(privileges);

AuthorStatement authorStatement = new AuthorStatement(AuthorType.REVOKE_ROLE);
authorStatement.setRoleName(parseIdentifier(ctx.roleName.getText()));
authorStatement.setPrivilegeList(privileges);
authorStatement.setPrivilegeList(priviParsed);
authorStatement.setNodeNameList(nodeNameList);
return authorStatement;
}

private void checkGrantRevokePrivileges(String[] privileges, List<PartialPath> nodeNameList) {
// 1. all grant or revoke statements need target path.
if (nodeNameList.isEmpty()) {
nodeNameList.add(new PartialPath(ALL_RESULT_NODES));
return;
throw new SemanticException("Statement needs target paths");
}
boolean pathRelevant = true;

// 2. if privilege list has system privilege or "ALL", nodeNameList must only contain "root.**".
boolean hasSystemPri = false;
String errorPrivilegeName = "";

for (String privilege : privileges) {
if (!PrivilegeType.valueOf(privilege.toUpperCase()).isPathRelevant()) {
pathRelevant = false;
if ("ALL".equalsIgnoreCase(privilege)
|| (!"READ".equalsIgnoreCase(privilege)
&& !"WRITE".equalsIgnoreCase(privilege)
&& !PrivilegeType.valueOf(privilege.toUpperCase()).isPathRelevant())) {
hasSystemPri = true;
errorPrivilegeName = privilege.toUpperCase();
break;
}
}
if (!(pathRelevant
|| (nodeNameList.size() == 1
&& nodeNameList.contains(new PartialPath(ALL_RESULT_NODES))))) {
if (hasSystemPri
&& !(nodeNameList.size() == 1
&& nodeNameList.contains(new PartialPath(ALL_RESULT_NODES)))) {
throw new SemanticException(
String.format(
"path independent privilege: [%s] can only be set on path: root.**",
errorPrivilegeName));
String.format("[%s] can only be set on path: root.**", errorPrivilegeName));
}
}

// Revoke Role From User
private String[] parsePrivilege(String[] privileges) {
Set<String> privSet = new HashSet<>();
for (String priv : privileges) {
if (priv.equalsIgnoreCase("READ")) {
privSet.add("READ_SCHEMA");
privSet.add("READ_DATA");
continue;
} else if (priv.equalsIgnoreCase("WRITE")) {
privSet.add("WRITE_DATA");
privSet.add("WRITE_SCHEMA");
continue;
} else if (priv.equalsIgnoreCase("ALL")) {
for (PrivilegeType type : PrivilegeType.values()) {
privSet.add(type.toString());
}
continue;
}
privSet.add(priv);
}
return privSet.toArray(new String[0]);
}

// Revoke Role From User
@Override
public Statement visitRevokeRoleFromUser(IoTDBSqlParser.RevokeRoleFromUserContext ctx) {
AuthorStatement authorStatement = new AuthorStatement(AuthorType.REVOKE_USER_ROLE);
Expand Down Expand Up @@ -2352,9 +2381,6 @@ public Statement visitListRole(IoTDBSqlParser.ListRoleContext ctx) {
public Statement visitListPrivilegesUser(IoTDBSqlParser.ListPrivilegesUserContext ctx) {
AuthorStatement authorStatement = new AuthorStatement(AuthorType.LIST_USER_PRIVILEGE);
authorStatement.setUserName(parseIdentifier(ctx.userName.getText()));
List<PartialPath> nodeNameList =
ctx.prefixPath().stream().map(this::parsePrefixPath).collect(Collectors.toList());
authorStatement.setNodeNameList(nodeNameList);
return authorStatement;
}

Expand All @@ -2364,9 +2390,6 @@ public Statement visitListPrivilegesUser(IoTDBSqlParser.ListPrivilegesUserContex
public Statement visitListPrivilegesRole(IoTDBSqlParser.ListPrivilegesRoleContext ctx) {
AuthorStatement authorStatement = new AuthorStatement(AuthorType.LIST_ROLE_PRIVILEGE);
authorStatement.setRoleName(parseIdentifier(ctx.roleName.getText()));
List<PartialPath> nodeNameList =
ctx.prefixPath().stream().map(this::parsePrefixPath).collect(Collectors.toList());
authorStatement.setNodeNameList(nodeNameList);
return authorStatement;
}

Expand Down
Loading