SOLR-15568: Don't render the Schema Designer screen if user is not authorized

solr/core/src/java/org/apache/solr/handler/designer/SchemaDesignerAPI.java

@@ -329,22 +329,23 @@ public void listCollectionsForConfig(SolrQueryRequest req, SolrQueryResponse rsp
     rsp.getValues().addAll(Collections.singletonMap("collections", configSetHelper.listCollectionsForConfig(configSet)));
   }
 
-  @EndPoint(method = GET, path = "/schema-designer/configs", permission = CONFIG_READ_PERM)
+  // CONFIG_EDIT_PERM is required here since this endpoint is used by the UI to determine if the user has access to the Schema Designer UI
+  @EndPoint(method = GET, path = "/schema-designer/configs", permission = CONFIG_EDIT_PERM)
   @SuppressWarnings("unchecked")
   public void listConfigs(SolrQueryRequest req, SolrQueryResponse rsp) throws IOException {
     rsp.getValues().addAll(Collections.singletonMap("configSets", listEnabledConfigs()));
   }
 
-  protected Map<String, Boolean> listEnabledConfigs() throws IOException {
+  protected Map<String, Integer> listEnabledConfigs() throws IOException {
     List<String> configsInZk = configSetHelper.listConfigsInZk();
-    final Map<String, Boolean> configs = configsInZk.stream()
+    final Map<String, Integer> configs = configsInZk.stream()
         .filter(c -> !excludeConfigSetNames.contains(c) && !c.startsWith(DESIGNER_PREFIX))
-        .collect(Collectors.toMap(c -> c, c -> !settingsDAO.isDesignerDisabled(c)));
+        .collect(Collectors.toMap(c -> c, c -> settingsDAO.isDesignerDisabled(c) ? 1 : 2));
 
     // add the in-progress but drop the _designer prefix
     configsInZk.stream().filter(c -> c.startsWith(DESIGNER_PREFIX))
         .map(c -> c.substring(DESIGNER_PREFIX.length()))
-        .forEach(c -> configs.putIfAbsent(c, true));
+        .forEach(c -> configs.putIfAbsent(c, 0));
 
     return configs;
   }

solr/webapp/web/index.html

@@ -169,7 +169,7 @@ <h2>Connection recovered...</h2>
                 </ul>
               </li>
 
-              <li ng-show="isCloudEnabled" id="schema-designer" class="global" ng-class="{active:page=='schema-designer'}"><p><a href="#/~schema-designer">Schema Designer</a></p></li>
+              <li ng-show="isCloudEnabled && isSchemaDesignerEnabled" id="schema-designer" class="global" ng-class="{active:page=='schema-designer'}"><p><a href="#/~schema-designer">Schema Designer</a></p></li>
 
               <li ng-show="isCloudEnabled" id="collections" class="global" ng-class="{active:page=='collections'}"><p><a href="#/~collections">Collections</a></p></li>
               <li ng-hide="isCloudEnabled" id="cores" class="global" ng-class="{active:page=='cores'}"><p><a href="#/~cores">Core Admin</a></p></li>

solr/webapp/web/js/angular/app.js

@@ -468,7 +468,7 @@ solrAdminApp.config([
     };
 });
 
-solrAdminApp.controller('MainController', function($scope, $route, $rootScope, $location, Cores, Collections, System, Ping, Constants) {
+solrAdminApp.controller('MainController', function($scope, $route, $rootScope, $location, Cores, Collections, System, Ping, Constants, SchemaDesigner) {
 
   $rootScope.exceptions={};
 
@@ -502,6 +502,7 @@ solrAdminApp.controller('MainController', function($scope, $route, $rootScope, $
       $scope.initFailures = data.initFailures;
     });
 
+    $scope.isSchemaDesignerEnabled = true;
     System.get(function(data) {
       $scope.isCloudEnabled = data.mode.match( /solrcloud/i );
 
@@ -539,6 +540,14 @@ solrAdminApp.controller('MainController', function($scope, $route, $rootScope, $
               $scope.aliases_and_collections = $scope.aliases_and_collections.concat({name:'-----'});
             }
             $scope.aliases_and_collections = $scope.aliases_and_collections.concat($scope.collections);
+
+            SchemaDesigner.get({path: "configs"}, function (ignore) {
+              // no-op, just checking if we have access to this path
+            }, function(e) {
+              if (e.status === 403) {
+                $scope.isSchemaDesignerEnabled = false;
+              }
+            });
           });
         });
       }

solr/webapp/web/js/angular/controllers/collections.js

@@ -26,6 +26,9 @@ solrAdminApp.controller('CollectionsController',
           Collections.status(function (data) {
               $scope.collections = [];
               for (var name in data.cluster.collections) {
+                  if (name.startsWith("._designer_")) {
+                      continue;
+                  }
                   var collection = data.cluster.collections[name];
                   collection.name = name;
                   collection.type = 'collection';

solr/webapp/web/js/angular/controllers/schema-designer.js

@@ -96,6 +96,8 @@ solrAdminApp.controller('SchemaDesignerController', function ($scope, $timeout,
   };
 
   $scope.refresh = function () {
+    $scope.isSchemaDesignerEnabled = true;
+
     delete $scope.helpId;
 
     $scope.updateStatusMessage = "";
@@ -141,24 +143,35 @@ solrAdminApp.controller('SchemaDesignerController', function ($scope, $timeout,
     $scope.query = {q: '*:*', sortBy: 'score', sortDir: 'desc'};
 
     SchemaDesigner.get({path: "configs"}, function (data) {
+
       $scope.schemas = [];
-      $scope.schemasWithDefault = [];
-      $scope.schemasWithDefault.push("_default");
+      $scope.publishedSchemas = ["_default"];
 
       for (var s in data.configSets) {
-        $scope.schemasWithDefault.push(s);
-        if (data.configSets[s]) {
+        // 1 means published but not editable
+        if (data.configSets[s] !== 1) {
           $scope.schemas.push(s);
         }
+
+        // 0 means not published yet (so can't copy from it yet)
+        if (data.configSets[s] > 0) {
+          $scope.publishedSchemas.push(s);
+        }
       }
+
       $scope.schemas.sort();
-      $scope.schemasWithDefault.sort();
+      $scope.publishedSchemas.sort();
 
       // if no schemas available to select, open the pop-up immediately
-      if ($scope.schemas.length == 0) {
+      if ($scope.schemas.length === 0) {
         $scope.firstSchemaMessage = true;
         $scope.showNewSchemaDialog();
       }
+    }, function(e) {
+      if (e.status === 403) {
+        $scope.isSchemaDesignerEnabled = false;
+        $scope.hideAll();
+      }
     });
   };
 
@@ -249,6 +262,7 @@ solrAdminApp.controller('SchemaDesignerController', function ($scope, $timeout,
 
   $scope.addSchema = function () {
     $scope.firstSchemaMessage = false;
+    delete $scope.addMessage;
 
     if (!$scope.newSchema) {
       $scope.addMessage = "Please provide a schema name!";
@@ -266,18 +280,18 @@ solrAdminApp.controller('SchemaDesignerController', function ($scope, $timeout,
       return;
     }
 
-    if ($scope.schemasWithDefault.includes($scope.newSchema)) {
+    if ($scope.publishedSchemas.includes($scope.newSchema) || $scope.schemas.includes($scope.newSchema)) {
       $scope.addMessage = "Schema '" + $scope.newSchema + "' already exists!";
       return;
     }
 
+    delete $scope.addMessage;
     if (!$scope.copyFrom) {
       $scope.copyFrom = "_default";
     }
 
     $scope.resetSchema();
     $scope.schemas.push($scope.newSchema);
-    $scope.schemasWithDefault.push($scope.newSchema);
     $scope.showNewSchema = false;
     $scope.currentSchema = $scope.newSchema;
     $scope.sampleMessage = "Please upload or paste some sample documents to analyze for building the '" + $scope.currentSchema + "' schema.";

solr/webapp/web/partials/schema-designer.html

@@ -14,7 +14,10 @@
 See the License for the specific language governing permissions and
 limitations under the License.
 -->
-<div id="designer">
+<div ng-show="!isSchemaDesignerEnabled">
+  <p class="error-msg"><img src="img/ico/prohibition.png"/>&nbsp;Current user not authorized to use the Schema Designer!</p>
+</div>
+<div id="designer" ng-show="isSchemaDesignerEnabled">
   <div class="clearfix">
     <div id="designer-top">
     <div id="actions" class="actions">
@@ -443,7 +446,7 @@
             <select id="copy_schema"
                     ng-model="copyFrom"
                     chosen
-                    ng-options="schema for schema in schemasWithDefault"></select><a ng-click="showHelp('copyFromHelp')"><img class="help-ico" src="img/ico/question-white.png"/></a>
+                    ng-options="schema for schema in publishedSchemas"></select><a ng-click="showHelp('copyFromHelp')"><img class="help-ico" src="img/ico/question-white.png"/></a>
             <div id="copyFromHelp" class="help" ng-show="helpId === 'copyFromHelp'" escape-pressed="hideAll()">
               <div class="help">
               <p>Copy an existing Configset (schema, solrconfig.xml, and supporting files) as the starting point for your new schema. The <b>_default</b> Configset includes a schema with field guessing enabled, dynamic fields for common field types, and field types for analyzing text data for a number of common languages supported by Lucene. For more information about Configsets, see: <div class="help-anchor"><a target="_blank" href="https://solr.apache.org/guide/config-sets.html">Configsets</a></div></p>