Bläddra i källkod

HUE-4560 [core] Add permissions controls to authorize access to S3 across all components

Jenny Kim 9 år sedan
förälder
incheckning
5b2879d

+ 5 - 2
apps/filebrowser/src/filebrowser/api.py

@@ -23,6 +23,8 @@ from desktop.lib.django_util import JsonResponse
 from desktop.lib.fsmanager import FS_GETTERS
 from desktop.lib.i18n import smart_unicode
 
+from aws.conf import has_s3_access
+
 
 LOG = logging.getLogger(__name__)
 
@@ -46,8 +48,9 @@ def get_filesystems(request):
 
   filesystems = {}
   for k, v in FS_GETTERS.items():
-    # TODO: Remove when we consolidate s3 with s3a
-    if k != 's3a':
+    if k.startswith('s3') and has_s3_access(request.user):
+      filesystems[k] = v is not None
+    else:
       filesystems[k] = v is not None
 
   response['status'] = 0

+ 4 - 0
apps/filebrowser/src/filebrowser/settings.py

@@ -20,3 +20,7 @@ NICE_NAME = "File Browser"
 REQUIRES_HADOOP = False
 ICON = "filebrowser/art/icon_filebrowser_48.png"
 MENU_INDEX = 20
+
+PERMISSION_ACTIONS = (
+  ("s3_access", "Access to S3 from filebrowser and filepicker."),
+)

+ 0 - 1
desktop/core/src/desktop/lib/fsmanager.py

@@ -32,7 +32,6 @@ DEFAULT_SCHEMA = 'hdfs'
 
 FS_GETTERS = {
   "hdfs": cluster.get_hdfs,
-  "s3": aws.get_s3fs if is_s3_enabled() else None,
   "s3a": aws.get_s3fs if is_s3_enabled() else None
 }
 

+ 2 - 3
desktop/core/src/desktop/templates/common_header.mako

@@ -15,7 +15,6 @@
 ## limitations under the License.
 
 <%!
-from aws.conf import is_enabled as is_s3_enabled
 from desktop import conf
 from desktop.lib.i18n import smart_unicode
 from django.utils.translation import ugettext as _
@@ -424,7 +423,7 @@ if USE_NEW_EDITOR.get():
   <ul class="nav nav-pills">
     <li class="divider-vertical"></li>
     % if 'filebrowser' in apps:
-      % if not is_s3_enabled():
+      % if not is_s3_enabled:
       <li class="hide1380">
         <a title="${_('Manage HDFS')}" rel="navigator-tooltip" href="/${apps['filebrowser'].display_name}">
           <i class="fa fa-file"></i>&nbsp;${_('File Browser')}&nbsp;
@@ -451,7 +450,7 @@ if USE_NEW_EDITOR.get():
         </a>
       </li>
       <li class="hideMoreThan1380">
-        % if is_s3_enabled():
+        % if is_s3_enabled:
           <a title="${_('S3 Browser')}" rel="navigator-tooltip" href="/${apps['filebrowser'].display_name}/view=S3A://">
             <i class="fa fa-cloud"></i>
           </a>

+ 2 - 0
desktop/core/src/desktop/views.py

@@ -54,6 +54,7 @@ from desktop.log import set_all_debug as _set_all_debug, reset_all_debug as _res
 from desktop.models import UserPreferences, Settings, hue_version
 from desktop import appmanager
 
+from aws.conf import is_enabled as is_s3_enabled, has_s3_access
 
 
 LOG = logging.getLogger(__name__)
@@ -411,6 +412,7 @@ def commonheader(title, section, user, padding="90px", skip_topbar=False, skip_i
     },
     'is_demo': desktop.conf.DEMO_ENABLED.get(),
     'is_ldap_setup': 'desktop.auth.backend.LdapBackend' in desktop.conf.AUTH.BACKEND.get(),
+    'is_s3_enabled': is_s3_enabled() and has_s3_access(user)
   })
 
 def commonshare():

+ 5 - 0
desktop/libs/aws/src/aws/conf.py

@@ -60,6 +60,11 @@ def is_default_configured():
   return is_enabled() and AWS_ACCOUNTS['default'].ACCESS_KEY_ID.get() is not None
 
 
+def has_s3_access(user):
+  return user.is_authenticated and user.is_active and \
+         (user.is_superuser or user.has_hue_permission(action="s3_access", app="filebrowser"))
+
+
 def config_validator(user):
   res = []