Bläddra i källkod

[security] Adding delete privilege first version

Romain Rigaux 11 år sedan
förälder
incheckning
6377d91b6c

+ 49 - 21
apps/security/src/security/api/hive.py

@@ -43,7 +43,7 @@ def list_sentry_privileges_by_role(request):
   try:
     roleName = request.POST['roleName']
     sentry_privileges = get_api(request.user).list_sentry_privileges_by_role(roleName)
-    result['sentry_privileges'] = sentry_privileges
+    result['sentry_privileges'] = sorted(sentry_privileges, key= lambda privilege: privilege['name'])
     result['message'] = ''
     result['status'] = 0
   except Exception, e:
@@ -55,28 +55,32 @@ def list_sentry_privileges_by_role(request):
 def _hive_add_privileges(user, role, privileges):
     api = get_api(user)
 
-    _priviledges = []
+    _privileges = []
 
-    for priviledge in privileges:
-      if priviledge['status'] not in ('deleted',):
+    for privilege in privileges:
+      if privilege['status'] not in ('deleted',):
         api.alter_sentry_role_grant_privilege(role['name'], {
-            'privilegeScope': priviledge['privilegeScope'],
-            'serverName': priviledge['serverName'],
-            'dbName': priviledge['dbName'],
-            'tableName': priviledge['tableName'],
-            'URI': priviledge['URI'],
-            'action': priviledge['action']
+            'privilegeScope': privilege['privilegeScope'],
+            'serverName': privilege['serverName'],
+            'dbName': privilege['dbName'],
+            'tableName': privilege['tableName'],
+            'URI': privilege['URI'],
+            'action': privilege['action']
         })
         # Mocked until Sentry API returns the info!
-        _priviledges.append({
-            "name": "%s+%s+%s" % (priviledge.get('serverName', ''), priviledge.get('dbName', ''), priviledge.get('tableName', '')),
-            "timestamp": 1406160830864, "database": priviledge.get('dbName', ''), "action": priviledge.get('action', ''), 
-            "scope": priviledge.get('privilegeScope', ''), "table": priviledge.get('tableName', ''),
-            "URI": priviledge.get('URI', ''), "grantor": user.username,
-            "server": priviledge.get('serverName', '')
+        _privileges.append({
+            "name": "%s+%s+%s" % (privilege.get('serverName', ''), privilege.get('dbName', ''), privilege.get('tableName', '')),
+            "timestamp": 1406160830864, "database": privilege.get('dbName', ''), "action": privilege.get('action', ''),
+            "scope": privilege.get('privilegeScope', ''), "table": privilege.get('tableName', ''),
+            "URI": privilege.get('URI', ''), "grantor": user.username,
+            "server": privilege.get('serverName', '')
         })
 
-    return _priviledges
+    return _privileges
+
+
+def _drop_sentry_privilege(user, authorizable):
+  return get_api(user).drop_sentry_privilege(authorizable)
 
 
 def create_role(request):
@@ -108,9 +112,17 @@ def save_privileges(request):
     role = json.loads(request.POST['role'])
 
     new_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'new']
-    deleted_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'deleted']
-
     result['privileges'] = _hive_add_privileges(request.user, role, new_privileges)
+    
+    deleted_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'deleted']
+    for privilege in deleted_privileges:
+      _drop_sentry_privilege(request.user, {
+            'server': privilege['serverName'],
+            'uri': privilege['URI'] if privilege['URI'] else None,
+            'db': privilege['dbName'] if privilege['dbName'] else None,
+            'table': privilege['tableName'] if privilege['tableName'] else None,
+        })
+    
     result['message'] = ''
     result['status'] = 0
   except Exception, e:
@@ -163,9 +175,9 @@ def list_sentry_privileges_by_authorizable(request):
 
     for role in roles:
       for privilege in get_api(request.user).list_sentry_privileges_by_role(role['name']): # authorizableHierarchy not working here?
-        if privilege['database'] == authorizableHierarchy['db'] and ('table' not in authorizableHierarchy or privilege['table'] == authorizableHierarchy['table']): 
+        if privilege['database'] == authorizableHierarchy['db'] and ('table' not in authorizableHierarchy or privilege['table'] == authorizableHierarchy['table']):
           privileges.append(privilege)
-    
+
     result['privileges'] = privileges
 
     result['message'] = ''
@@ -176,6 +188,22 @@ def list_sentry_privileges_by_authorizable(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
+def rename_sentry_privilege(request):
+  result = {'status': -1, 'message': 'Error'}
+
+  try:
+    oldAuthorizable = json.loads(request.POST['oldAuthorizable'])
+    newAuthorizable = json.loads(request.POST['newAuthorizable'])
+
+    get_api(request.user).rename_sentry_privilege(oldAuthorizable, newAuthorizable)
+    result['message'] = _('Privilege deleted.')
+    result['status'] = 0
+  except Exception, e:
+    result['message'] = unicode(str(e), "utf8")
+
+  return HttpResponse(json.dumps(result), mimetype="application/json")
+
+
 def list_sentry_privileges_for_provider(request):
   result = {'status': -1, 'message': 'Error'}
 

+ 1 - 0
apps/security/src/security/urls.py

@@ -41,4 +41,5 @@ urlpatterns += patterns('security.api.hive',
   url(r'^api/hive/drop_sentry_role', 'drop_sentry_role', name='drop_sentry_role'),
   url(r'^api/hive/create_role$', 'create_role', name='create_role'),
   url(r'^api/hive/save_privileges$', 'save_privileges', name='save_privileges'),
+  url(r'^api/hive/rename_sentry_privilege', 'rename_sentry_privilege', name='rename_sentry_privilege'),
 )

+ 1 - 1
apps/security/static/js/hive.ko.js

@@ -110,7 +110,7 @@ var Role = function(vm, role) {
         role: ko.mapping.toJSON(role)
       }, function (data) {
         if (data.status == 0) {
-          vm.list_sentry_privileges_by_role(role);
+          vm.list_sentry_privileges_by_role(role); // Refresh all role privileges
         } else {
           $(document).trigger("error", data.message);
         }

+ 3 - 3
desktop/libs/libsentry/src/libsentry/client.py

@@ -111,9 +111,9 @@ class SentryClient(object):
     return self.client.list_sentry_privileges_by_role(request)
 
 
-  def drop_sentry_privilege(self, authorizableHierarchy):
-    authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy)
-    request = TDropPrivilegesRequest(requestorUserName=self.username, authorizableHierarchy=authorizableHierarchy)
+  def drop_sentry_privilege(self, authorizable):
+    authorizable = TSentryAuthorizable(**authorizable)
+    request = TDropPrivilegesRequest(requestorUserName=self.username, authorizable=authorizable)
     return self.client.drop_sentry_privilege(request)