Commit d75485a1 authored by lgcareer's avatar lgcareer Committed by qiaozhanwei
Browse files

[Fix #1828]check whether has permission to download udf file or delete udf function (#1858) 

* fix issue 1828:get the udf resource path error when create udf function

* update grantResources

* first verify whether udf resource is bound by udf function

* update grantResources

* update testListAuthorizedUdfFunc

* update getUserInfo in order to run success

* check whether has permission to download udf file or delete udf file

* update listAuthorizedResourceById in ResourceMapper.xml
parent 269ba169

dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/controller/ResourcesController.java

+1 −1
Original line number Diff line number Diff line
@@ -620,7 +620,7 @@ public class ResourcesController extends BaseController{ 
        try{



            logger.info("login user {}, delete udf function id: {}", loginUser.getUserName(),udfFuncId);

            return udfFuncService.delete(udfFuncId);

            return udfFuncService.delete(loginUser,udfFuncId);

        }catch (Exception e){

            logger.error(DELETE_UDF_FUNCTION_ERROR.getMsg(),e);

            return error(Status.DELETE_UDF_FUNCTION_ERROR.getCode(), Status.DELETE_UDF_FUNCTION_ERROR.getMsg());

dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/UdfFuncService.java

+14 −3
Original line number Diff line number Diff line
@@ -302,12 +302,23 @@ public class UdfFuncService extends BaseService{ 
     * delete udf function

     *

     * @param id        udf function id

     * @param loginUser login user

     * @return delete result code

     */

    @Transactional(rollbackFor = Exception.class)

    public Result delete(int id) {

    public Result delete(User loginUser,int id) {

        Result result = new Result();



        UdfFunc udfFunc = udfFuncMapper.selectUdfById(id);

        if(udfFunc == null){

            putMsg(result,Status.UDF_FUNCTION_NOT_EXIST);

            return result;

        }



        if (!hasPerm(loginUser,udfFunc.getUserId())){

            putMsg(result,Status.USER_NO_OPERATION_PERM);

            return result;

        }

        udfFuncMapper.deleteById(id);

        udfUserMapper.deleteByUdfFuncId(id);

        putMsg(result, Status.SUCCESS);

dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/UsersService.java

+19 −10
Original line number Diff line number Diff line
@@ -438,21 +438,30 @@ public class UsersService extends BaseService { 
            return result;

        }

        String[] resourcesIdArr = resourceIds.split(",");

        //if resource type is UDF,need check whether it is bound by UDF functon

        Set<Integer> needAuthorizedIds = new HashSet<>();

        if (StringUtils.isNotEmpty(resourceIds)) {

            needAuthorizedIds = Arrays.stream(resourcesIdArr).map(t->Integer.parseInt(t)).collect(Collectors.toSet());

        }

        List<Resource> udfResourceList = resourceMapper.queryResourceList("", 0, ResourceType.UDF.ordinal());

        Set<Integer> allUdfResIds = udfResourceList.stream().map(t -> t.getId()).collect(Collectors.toSet());

        allUdfResIds.removeAll(needAuthorizedIds);

        List<UdfFunc> udfFuncs = udfFuncMapper.listUdfByResourceId(ArrayUtils.toPrimitive(allUdfResIds.toArray(new Integer[allUdfResIds.size()])));

        if (CollectionUtils.isNotEmpty(udfFuncs)) {

            logger.error("can't be deleted,because it is bound by UDF functions:{}",udfFuncs.toString());

            putMsg(result, Status.UDF_RESOURCE_IS_BOUND, udfFuncs.get(0).getFuncName());

        //if resource type is UDF,need check whether it is bound by UDF functon



        //get the authorized resource id list by user id and resource type

        List<Resource> oldAuthorizedUdfRes = resourceMapper.queryResourceListAuthored(userId, ResourceType.UDF.ordinal());

        Set<Integer> oldAuthorizedUdfResIds = oldAuthorizedUdfRes.stream().map(t -> t.getId()).collect(Collectors.toSet());





        //get the unauthorized resource id list

        oldAuthorizedUdfResIds.removeAll(needAuthorizedIds);



        if (CollectionUtils.isNotEmpty(oldAuthorizedUdfResIds)) {

            int[] unauthorizedResIds = ArrayUtils.toPrimitive(oldAuthorizedUdfResIds.toArray(new Integer[oldAuthorizedUdfResIds.size()]));

            List<UdfFunc> authorizedUdfFuncs = udfFuncMapper.listAuthorizedUdfByResourceId(userId, unauthorizedResIds);



            if (CollectionUtils.isNotEmpty(authorizedUdfFuncs)) {

                logger.error("can't be deleted,because it is bound by UDF functions:{}",authorizedUdfFuncs.toString());

                putMsg(result, Status.UDF_RESOURCE_IS_BOUND, authorizedUdfFuncs.get(0).getFuncName());

                return result;

            }



        }



        resourcesUserMapper.deleteResourceUser(userId, 0);

dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/service/UsersServiceTest.java

+5 −3
Original line number Diff line number Diff line
@@ -297,18 +297,19 @@ public class UsersServiceTest { 
        logger.info(result.toString());

        Assert.assertEquals(Status.SUCCESS, result.get(Constants.STATUS));



        List<Resource> udfResourceList = new ArrayList<Resource>() {{

        //the udf resources needAuthorizedUser has the permission to use

        List<Resource> oldAuthorizedUdfRes = new ArrayList<Resource>() {{

                add(createResource(getAdminUser(), ResourceType.UDF, 100000));

                add(createResource(getAdminUser(), ResourceType.UDF, 120000));

        }};

        when(resourceMapper.queryResourceList("", 0, ResourceType.UDF.ordinal())).thenReturn(udfResourceList);

        when(resourceMapper.queryResourceListAuthored(needAuthorizedUser.getId(), ResourceType.UDF.ordinal())).thenReturn(oldAuthorizedUdfRes);



        //mock udf function list

        UdfFunc udfFunc = createUdfFunc(getAdminUser(), 100000);

        List<UdfFunc> udfFuncs = new ArrayList<>();

        udfFuncs.add(udfFunc);



        when(udfFuncMapper.listUdfByResourceId(new int[]{100000})).thenReturn(udfFuncs);

        when(udfFuncMapper.listAuthorizedUdfByResourceId(needAuthorizedUser.getId(),new int[]{100000})).thenReturn(udfFuncs);



        //fail if udf resource is already bound by the udf function

        result = usersService.grantResources(adminUser, needAuthorizedUser.getId(), "120000");
@@ -316,6 +317,7 @@ public class UsersServiceTest { 


        result = usersService.grantResources(adminUser, needAuthorizedUser.getId(), "100000");

        Assert.assertEquals(Status.SUCCESS, result.get(Constants.STATUS));

        logger.info(result.toString());



    }

dolphinscheduler-common/src/main/java/org/apache/dolphinscheduler/common/enums/AuthorizationType.java

+4 −2
Original line number Diff line number Diff line
@@ -24,12 +24,14 @@ import com.baomidou.mybatisplus.annotation.EnumValue; 
public enum AuthorizationType {

    /**

     * 0 RESOURCE_FILE;

     * 1 UDF_FILE;

     * 1 DATASOURCE;

     * 2 UDF;

     */

    RESOURCE_FILE(0, "resource file"),

    DATASOURCE(1, "data source"),

    UDF(2, "udf function");

    UDF_FILE(1, "udf file"),

    DATASOURCE(2, "data source"),

    UDF(3, "udf function");



    AuthorizationType(int code, String descp){

        this.code = code;