User permission manager #1873

bright-starry-sky · 2020-03-05T05:50:34Z

1, moved ClientSession to common layer . and rename to Session.
2, Added Permission Manager .
3, Added Permission Check.

This PR depend on #1842 ，I will create more test cases after #1842 is done.

bright-starry-sky · 2020-03-16T08:08:31Z

Ready to review. come on teachers. thanks.

dangleptr

Just skim the pr. It looks good to me totally. Very nice~

src/common/permission/PermissionManager.cpp

src/common/session/Session.h

src/meta/client/MetaClient.cpp

src/common/session/Session.h

src/graph/ShowExecutor.cpp

src/meta/client/MetaClient.cpp

src/meta/processors/usersMan/AuthenticationProcessor.cpp

src/common/session/Session.h

bright-starry-sky · 2020-03-17T08:24:09Z

Addressed dangleptr's comments as below :
1,Cached user password via meta client;
2,Check god by user name root;
3,Moved FLAGS_enable_authorize to PermissionManager;
4,Skip space check for kDefaultSpaceId when list roles

dangleptr

Well done. The pr looks good to me now.

dangleptr · 2020-03-17T11:28:54Z

src/graph/PermissionCheck.cpp

+        case Sentence::Kind::kDescribeSpace : {
+            /**
+             * Use space and Describe space are special operations.
+             * Permission checking needs to be done in their executor.


why? Miss the spaceId?

why? Miss the spaceId?

Yes, Usually we need to get the space id from the session when check permission.
We can't get the space ID form session when Use Space or Describe space , so we need get the space id in their executor.

dangleptr · 2020-03-17T11:30:18Z

src/graph/PermissionCheck.cpp

+        case Sentence::Kind::kLimit :
+        case Sentence::Kind::KGroupBy :
+        case Sentence::Kind::kReturn : {
+            return permission::PermissionManager::canReadSchemaData(session);


Maybe canReadSchemaOrData is a better name.

Maybe canReadSchemaOrData is a better name.

Good idea. Changed method name from canReadSchemaData to canReadSchemaOrData

codecov-io · 2020-03-17T13:29:29Z

Codecov Report

Merging #1873 into master will increase coverage by 0.13%.
The diff coverage is 93.21%.

@@            Coverage Diff             @@
##           master    #1873      +/-   ##
==========================================
+ Coverage   86.90%   87.03%   +0.13%     
==========================================
  Files         636      640       +4     
  Lines       59819    60632     +813     
==========================================
+ Hits        51984    52772     +788     
- Misses       7835     7860      +25

Impacted Files	Coverage Δ
src/graph/DescribeSpaceExecutor.h	`0.00% <ø> (ø)`
src/graph/GoExecutor.cpp	`75.45% <0.00%> (ø)`
src/graph/GraphService.h	`100.00% <ø> (ø)`
src/graph/PrivilegeExecutor.h	`69.56% <ø> (+13.04%)`	⬆️
src/graph/SequentialExecutor.h	`0.00% <ø> (ø)`
src/graph/UseExecutor.h	`0.00% <ø> (ø)`
src/graph/test/TestEnv.h	`100.00% <ø> (ø)`
src/kvstore/raftex/RaftPart.cpp	`77.06% <ø> (-0.88%)`	⬇️
src/meta/MetaServiceHandler.h	`100.00% <ø> (ø)`
src/meta/MetaServiceUtils.h	`100.00% <ø> (ø)`
... and 71 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0aebc92...abf0444. Read the comment docs.

dangleptr

Well done.

panda-sheep · 2020-03-19T02:53:44Z

src/common/permission/PermissionManager.cpp

+    }
+    bool havePermission = false;
+    switch (session->roleWithSpace(spaceId)) {
+        case session::Role::GOD :


What is the difference between session->isGod() and session::Role::GOD ？

What is the difference between session->isGod() and session::Role::GOD ？

session->isGod just check if the user is god.
session->roleWithSpace(spaceId) check what role of in this space.
case session::Role::GOD still there because the compilation requirement of switch block .

critical27 · 2020-03-19T03:13:27Z

src/graph/SequentialExecutor.cpp

+             * Skip special operations check at here. they are :
+             * kUse, kDescribeSpace, kRevoke and kGrant.
+             */
+            if (!PermissionCheck::permissionCheck(session, sentence)) {


What if the query is "use space test; sth else", can we work? I guess it would fail, although this is a quite usual usage.

I suppose we don't need this code block, because we could check it in each executor just like you did.

What if the query is "use space test; sth else", can we work? But this is a quite usual.

Good question. you are right . it's fail when "use space ; sth else" .
because our permission check is in the preparation phase, have not set the space id in the session yet in the preparation phase. so the second statement should be fail.
I originally intended to check permissions in each executor, but this would result in too much code clutter.

critical27 · 2020-03-19T03:26:07Z

Clean code!

critical27

Great work

panda-sheep · 2020-03-19T03:30:25Z

src/common/session/Session.h

+    std::string       account_;
+    time::Duration    idleDuration_;
+    /*
+     * map<space name, role>


map<space Id, role> ?

panda-sheep · 2020-03-19T03:31:58Z

src/common/session/Session.h

+            }
+        }
+        return Role::INVALID_ROLE;
+    }


move toRole to Session.cpp better ?

panda-sheep

Great work

…uthorize to PermissionManager;4,skip space check for kDefaultSpaceId when list roles

* user permission manager * Addressed dangleptr's comments * 1,cache user pwd; 2,check god by user name root;3,move FLAGS_enable_authorize to PermissionManager;4,skip space check for kDefaultSpaceId when list roles * Changed the method name from canReadSchemaData to canReadSchemaOrData * fixed comment typo error

bright-starry-sky requested review from dangleptr, dutor, laura-ding, CPWstatic, critical27, darionyaphet, liuyu85cn, sherman-the-tank and yixinglu March 5, 2020 05:51

jude-zhu added this to the R201910_RC4 milestone Mar 6, 2020

This was referenced Mar 9, 2020

User privilege manager in graph layer. #502

Closed

Implement user password check in graph layer #513

Closed

Amber1990Zhang self-assigned this Mar 11, 2020

bright-starry-sky added the ready-for-testing PR: ready for the CI test label Mar 12, 2020

Amber1990Zhang mentioned this pull request Mar 13, 2020

[doc]User management #1917

Merged

dangleptr reviewed Mar 16, 2020

View reviewed changes

dangleptr reviewed Mar 17, 2020

View reviewed changes

jude-zhu requested a review from dangleptr March 17, 2020 09:07

dangleptr previously approved these changes Mar 17, 2020

View reviewed changes

bright-starry-sky dismissed dangleptr’s stale review via b1fdc29 March 17, 2020 11:52

Amber1990Zhang mentioned this pull request Mar 18, 2020

[doc] user-permission-mng #1929

Merged

jude-zhu requested a review from dangleptr March 18, 2020 07:19

dangleptr previously approved these changes Mar 18, 2020

View reviewed changes

panda-sheep reviewed Mar 19, 2020

View reviewed changes

critical27 reviewed Mar 19, 2020

View reviewed changes

critical27 previously approved these changes Mar 19, 2020

View reviewed changes

panda-sheep reviewed Mar 19, 2020

View reviewed changes

panda-sheep previously approved these changes Mar 19, 2020

View reviewed changes

bright-starry-sky added 5 commits March 19, 2020 11:57

user permission manager

4e8673c

Addressed dangleptr's comments

e61cb6a

1,cache user pwd; 2,check god by user name root;3,move FLAGS_enable_a…

d57fff8

…uthorize to PermissionManager;4,skip space check for kDefaultSpaceId when list roles

Changed the method name from canReadSchemaData to canReadSchemaOrData

a9436b8

fixed comment typo error

03a20e0

bright-starry-sky dismissed stale reviews from panda-sheep, critical27, and dangleptr via 03a20e0 March 19, 2020 03:59

panda-sheep approved these changes Mar 19, 2020

View reviewed changes

dangleptr approved these changes Mar 19, 2020

View reviewed changes

dangleptr merged commit 3b08e0b into vesoft-inc:master Mar 19, 2020

bright-starry-sky deleted the user_permission_manager branch March 19, 2020 08:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

User permission manager #1873

User permission manager #1873

bright-starry-sky commented Mar 5, 2020

bright-starry-sky commented Mar 16, 2020

dangleptr left a comment

bright-starry-sky commented Mar 17, 2020

dangleptr left a comment

dangleptr Mar 17, 2020

bright-starry-sky Mar 17, 2020

dangleptr Mar 17, 2020 •

edited

Loading

bright-starry-sky Mar 17, 2020

codecov-io commented Mar 17, 2020 •

edited

Loading

dangleptr left a comment

panda-sheep Mar 19, 2020

bright-starry-sky Mar 19, 2020

critical27 Mar 19, 2020 •

edited

Loading

bright-starry-sky Mar 19, 2020

critical27 Mar 19, 2020

critical27 commented Mar 19, 2020

critical27 left a comment

panda-sheep Mar 19, 2020

panda-sheep Mar 19, 2020

panda-sheep left a comment

User permission manager #1873

User permission manager #1873

Conversation

bright-starry-sky commented Mar 5, 2020

bright-starry-sky commented Mar 16, 2020

dangleptr left a comment

Choose a reason for hiding this comment

bright-starry-sky commented Mar 17, 2020

dangleptr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dangleptr Mar 17, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-io commented Mar 17, 2020 • edited Loading

Codecov Report

dangleptr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

critical27 Mar 19, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

critical27 commented Mar 19, 2020

critical27 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

panda-sheep left a comment

Choose a reason for hiding this comment

dangleptr Mar 17, 2020 •

edited

Loading

codecov-io commented Mar 17, 2020 •

edited

Loading

critical27 Mar 19, 2020 •

edited

Loading