Bladeren bron

[security] Bulk delete Sentry privileges

Romain Rigaux 11 jaren geleden
bovenliggende
commit
478f88b85c

+ 26 - 0
apps/security/src/security/api/hive.py

@@ -225,6 +225,32 @@ def list_sentry_privileges_by_authorizable(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
+def bulk_delete_privileges(request):
+  result = {'status': -1, 'message': 'Error'}
+
+  try:
+    checkedPaths = json.loads(request.POST['checkedPaths'])
+    recursive = json.loads(request.POST['recursive'])
+    authorizableHierarchy = json.loads(request.POST['authorizableHierarchy'])
+
+    for path in [path['path'] for path in checkedPaths]:
+      if '.' in path:
+        db, table = path.split('.')
+      else:
+        db, table = path, ''
+      authorizableHierarchy.update({
+        'db': db,
+        'table': table,
+      })
+      get_api(request.user).drop_sentry_privileges(authorizableHierarchy)
+    result['message'] = _('Privileges deleted.')
+    result['status'] = 0
+  except Exception, e:
+    result['message'] = unicode(str(e), "utf8")
+
+  return HttpResponse(json.dumps(result), mimetype="application/json")
+
+
 def rename_sentry_privilege(request):
   result = {'status': -1, 'message': 'Error'}
 

+ 3 - 3
apps/security/src/security/templates/hdfs.mako

@@ -116,13 +116,13 @@ ${ layout.menubar(section='hdfs') }
                     <i class="fa fa-group" title="List of groups in popover for this user?"></i>
                   </div>                  
                   <div>
-                    <a href="javascript: void(0)" data-bind="click: $root.assist.bulkAddAcls" title="${ _('Add current ACL to checkbox selection') }">
+                    <a href="javascript: void(0)" data-bind="click: $root.assist.bulkAddAcls" title="${ _('Add current ACLs to checkbox selection') }">
                       <i class="fa fa-plus"></i>
                     </a>
-                    <a href="javascript: void(0)" data-bind="click: $root.assist.bulkSyncAcls" title="${ _('Sync current ACL to checkbox selection') }">
+                    <a href="javascript: void(0)" data-bind="click: $root.assist.bulkSyncAcls" title="${ _('Replace current ACLs to checkbox selection') }">
                       <i class="fa fa-copy"></i>
                     </a>
-                    <a href="javascript: void(0)" data-bind="click: function(){ $('#deleteAclsModal').modal('show'); }" title="${ _('Remove ACLs of checkbox selection') }">
+                    <a href="javascript: void(0)" data-bind="click: function(){ $('#deleteAclsModal').modal('show'); }" title="${ _('Remove all ACLs of checkbox selection') }">
                       <i class="fa fa-times"></i>
                     </a>
                     <label><input type="checkbox" data-bind="checked: $root.assist.recursive"> ${ _('Recursive') }</label>

+ 18 - 6
apps/security/src/security/templates/hive.mako

@@ -118,6 +118,12 @@ ${ layout.menubar(section='hive') }
                 <div class="clearfix"></div>
                 <div class="tree-toolbar">
                   <div class="pull-right">
+                    <a href="javascript: void(0)" data-bind="click: $root.assist.collapseOthers">
+                      <i class="fa fa-compress"></i> ${_('Close others')}
+                    </a>
+                    <a href="javascript: void(0)" data-bind="click: $root.assist.refreshTree">
+                      <i class="fa fa-refresh"></i>  ${_('Refresh')}
+                    </a>                  
                     <div class="dropdown inline-block" style="margin-right: 6px">
                       <a class="dropdown-toggle" data-toggle="dropdown" href="#">
                         <i class="fa fa-eye-slash" data-bind="visible: $root.assist.isDiffMode"></i>
@@ -137,12 +143,18 @@ ${ layout.menubar(section='hive') }
                     <select class="user-list" data-bind="options: $root.selectableHadoopUsers, select2: { placeholder: '${ _("Select a user") }', update: $root.doAs, type: 'user'}" style="width: 120px"></select>
                     <i class="fa fa-group" title="${ _('List of groups in popover for this user?') }"></i>
                   </div>
-                  <a href="javascript: void(0)" data-bind="click: $root.assist.collapseOthers">
-                    <i class="fa fa-compress"></i> ${_('Close others')}
-                  </a>
-                  <a href="javascript: void(0)" data-bind="click: $root.assist.refreshTree">
-                    <i class="fa fa-refresh"></i>  ${_('Refresh')}
-                  </a>
+                  <div>
+                    <a href="javascript: void(0)" data-bind="click: $root.assist.bulkAddAcls" title="${ _('Add current current privileges to checkbox selection') }">
+                      <i class="fa fa-plus"></i>
+                    </a>
+                    <a href="javascript: void(0)" data-bind="click: $root.assist.bulkSyncAcls" title="${ _('Replace checkbox selection with current privileges') }">
+                      <i class="fa fa-copy"></i>
+                    </a>
+                    <a href="javascript: void(0)" data-bind="click: $root.bulk_delete_privileges" title="${ _('Remove privileges of checkbox selection') }">
+                      <i class="fa fa-times"></i>
+                    </a>
+                    <label><input type="checkbox" data-bind="checked: $root.assist.recursive"> ${ _('Recursive') }</label>
+                  </div>
                   <i class="fa fa-spinner fa-spin" data-bind="visible: $root.assist.isLoadingTree()"></i>
                 </div>
               </div>

+ 3 - 1
apps/security/src/security/urls.py

@@ -45,5 +45,7 @@ urlpatterns += patterns('security.api.hive',
   url(r'^api/hive/drop_sentry_role', 'drop_sentry_role', name='drop_sentry_role'),
   url(r'^api/hive/create_role$', 'create_role', name='create_role'),
   url(r'^api/hive/save_privileges$', 'save_privileges', name='save_privileges'),
-  url(r'^api/hive/rename_sentry_privilege', 'rename_sentry_privilege', name='rename_sentry_privilege'),
+  url(r'^api/hive/bulk_delete_privileges', 'bulk_delete_privileges', name='bulk_delete_privileges'),
+  
+  url(r'^api/hive/rename_sentry_privilege', 'rename_sentry_privilege', name='rename_sentry_privilege'),  
 )

+ 29 - 7
apps/security/static/js/hive.ko.js

@@ -635,6 +635,7 @@ var HiveViewModel = function (initial) {
 
   // Editing
   self.showCreateRole = ko.observable(false);
+  self.recursive = ko.observable(false);
   self.role = new Role(self, {});
   self.privilege = new Privilege(self, {});
 
@@ -788,6 +789,14 @@ var HiveViewModel = function (initial) {
     return _privilege;
   }
 
+  function _create_authorizable_from_ko(privilege) {
+    return {
+      'server': self.assist.server(),
+      'db': self.assist.db(),
+      'table': self.assist.table()
+    }
+  }
+  
   self.list_sentry_privileges_by_authorizable = function () {
     if (self.assist.path() != "") {
       $.ajax({
@@ -796,11 +805,7 @@ var HiveViewModel = function (initial) {
         data: {
           groupName: $('#selectedGroup').val(),
           roleSet: ko.mapping.toJSON({all: true, roles: []}),
-          authorizableHierarchy: ko.mapping.toJSON({
-            'server': self.assist.server(),
-            'db': self.assist.db(),
-            'table': self.assist.table()
-          })
+          authorizableHierarchy: ko.mapping.toJSON(_create_authorizable_from_ko())
         },
         success: function (data) {
           self.assist.roles.removeAll();
@@ -816,9 +821,8 @@ var HiveViewModel = function (initial) {
               var _idx = self.assist.roles.push(new Role(self, { name: item.roleName }));
               _role = self.assist.roles()[_idx - 1];
             }
-
             _role.privileges.push(_create_ko_privilege(item));
-        	  self.assist.privileges.push(_create_ko_privilege(item));
+        	self.assist.privileges.push(_create_ko_privilege(item));
           });
         }
       }).fail(function (xhr, textStatus, errorThrown) {
@@ -827,6 +831,24 @@ var HiveViewModel = function (initial) {
     }
   };
 
+  self.bulk_delete_privileges = function (role) {
+    $(".jHueNotify").hide();
+    var checkedPaths = self.assist.getCheckedItems();
+    $.post("/security/api/hive/bulk_delete_privileges", {
+      'authorizableHierarchy': ko.mapping.toJSON(_create_authorizable_from_ko()),
+      'checkedPaths': ko.mapping.toJSON(checkedPaths),
+      'recursive': ko.mapping.toJSON(self.recursive()),
+    }, function (data) {
+      if (data.status == 0) {
+        self.list_sentry_privileges_by_authorizable(); // Refresh
+      } else {
+        $(document).trigger("error", data.message);
+      }
+    }).fail(function (xhr, textStatus, errorThrown) {
+      $(document).trigger("error", xhr.responseText);
+    });
+  }  
+  
   self.fetchUsers = function () {
     $.getJSON('/desktop/api/users/autocomplete', {
       'include_myself': true,

+ 2 - 3
desktop/libs/libsentry/src/libsentry/api.py

@@ -128,8 +128,7 @@ class SentryApi(object):
       raise SentryException(response)
 
 
-  # Use alter_sentry_role_revoke_privilege instead?
-  def drop_sentry_privilege(self, authorizableHierarchy):
+  def drop_sentry_privileges(self, authorizableHierarchy):
     response = self.client.drop_sentry_privilege(authorizableHierarchy)
 
     if response.status.value == 0:
@@ -138,7 +137,7 @@ class SentryApi(object):
       raise SentryException(response)
 
 
-  def rename_sentry_privilege(self, oldAuthorizable, newAuthorizable):
+  def rename_sentry_privileges(self, oldAuthorizable, newAuthorizable):
     response = self.client.rename_sentry_privilege(oldAuthorizable, newAuthorizable)
 
     if response.status.value == 0: