Преглед изворни кода

[sentry] Convert API to always provide the component

Romain Rigaux пре 10 година
родитељ
комит
6a23f26

+ 32 - 19
apps/security/src/security/api/sentry.py

@@ -55,6 +55,7 @@ def fetch_hive_path(request):
 
 def list_sentry_roles_by_group(request):
   result = {'status': -1, 'message': 'Error'}
+  component = request.POST['component']
 
   try:
     if request.POST['groupName']:
@@ -62,7 +63,7 @@ def list_sentry_roles_by_group(request):
     else:
       # Admins can see everything, other only the groups they belong too
       groupName = None if request.user.groups.filter(name__in=get_sentry_server_admin_groups()).exists() else '*'
-    roles = get_api(request.user).list_sentry_roles_by_group(groupName)
+    roles = get_api(request.user, component).list_sentry_roles_by_group(groupName)
     result['roles'] = sorted(roles, key=lambda role: role['name'])
     result['message'] = ''
     result['status'] = 0
@@ -80,10 +81,11 @@ def list_sentry_roles_by_group(request):
 
 def list_sentry_privileges_by_role(request):
   result = {'status': -1, 'message': 'Error'}
+  component = request.POST['component']
 
   try:
     roleName = request.POST['roleName']
-    sentry_privileges = get_api(request.user).list_sentry_privileges_by_role(roleName)
+    sentry_privileges = get_api(request.user, component).list_sentry_privileges_by_role(roleName)
     result['sentry_privileges'] = sorted(sentry_privileges, key=lambda privilege: '%s.%s.%s.%s' % (privilege['server'], privilege['database'], privilege['table'], privilege['URI']))
     result['message'] = ''
     result['status'] = 0
@@ -109,8 +111,8 @@ def _to_sentry_privilege(privilege):
   }
 
 
-def _hive_add_privileges(user, role, privileges):
-    api = get_api(user)
+def _hive_add_privileges(user, role, privileges, component):
+    api = get_api(user, component)
 
     _privileges = []
 
@@ -157,8 +159,8 @@ def _get_splitted_path(path):
   return db, table, column
 
 
-def _drop_sentry_privilege(user, role, authorizable):
-  return get_api(user).alter_sentry_role_revoke_privilege(role['name'], _to_sentry_privilege(authorizable))
+def _drop_sentry_privilege(user, role, authorizable, component):
+  return get_api(user, component).alter_sentry_role_revoke_privilege(role['name'], _to_sentry_privilege(authorizable))
 
 
 def create_role(request):
@@ -166,13 +168,14 @@ def create_role(request):
 
   try:
     role = json.loads(request.POST['role'])
+    component = json.loads(request.POST['component'])
 
-    api = get_api(request.user)
+    api = get_api(request.user, component)
 
     api.create_sentry_role(role['name'])
 
     privileges = [privilege for privilege in role['privileges'] if privilege['status'] not in ('deleted', 'alreadydeleted')]
-    result['privileges'] = _hive_add_privileges(request.user, role, privileges)
+    result['privileges'] = _hive_add_privileges(request.user, role, privileges, component)
     api.alter_sentry_role_add_groups(role['name'], role['groups'])
 
     result['role'] = {"name": role['name'], "groups": role['groups']}
@@ -192,11 +195,12 @@ def update_role_groups(request):
 
   try:
     role = json.loads(request.POST['role'])
+    component = request.POST['component']
 
     new_groups = set(role['groups']) - set(role['originalGroups'])
     deleted_groups = set(role['originalGroups']) - set(role['groups'])
 
-    api = get_api(request.user)
+    api = get_api(request.user, component)
 
     if new_groups:
       api.alter_sentry_role_add_groups(role['name'], new_groups)
@@ -218,9 +222,10 @@ def save_privileges(request):
 
   try:
     role = json.loads(request.POST['role'])
+    component = json.loads(request.POST['component'])
 
     new_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'new']
-    result['privileges'] = _hive_add_privileges(request.user, role, new_privileges)
+    result['privileges'] = _hive_add_privileges(request.user, role, new_privileges, component)
 
     deleted_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'deleted']
     for privilege in deleted_privileges:
@@ -228,7 +233,7 @@ def save_privileges(request):
 
     modified_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'modified']
     old_privileges_ids = [privilege['id'] for privilege in modified_privileges]
-    _hive_add_privileges(request.user, role, modified_privileges)
+    _hive_add_privileges(request.user, role, modified_privileges, component)
     for privilege in role['originalPrivileges']:
       if privilege['id'] in old_privileges_ids:
         _drop_sentry_privilege(request.user, role, privilege)
@@ -249,8 +254,9 @@ def grant_privilege(request):
   try:
     roleName = json.loads(request.POST['roleName'])
     privilege = json.loads(request.POST['privilege'])
+    component = json.loads(request.POST['component'])
 
-    result['privileges'] = _hive_add_privileges(request.user, {'name': roleName}, [privilege])
+    result['privileges'] = _hive_add_privileges(request.user, {'name': roleName}, [privilege], component)
 
     result['message'] = _('Privilege granted successfully to %s.') % roleName
     result['status'] = 0
@@ -267,8 +273,9 @@ def create_sentry_role(request):
 
   try:
     roleName = request.POST['roleName']
+    component = json.loads(request.POST['component'])
 
-    get_api(request.user).create_sentry_role(roleName)
+    get_api(request.user, component).create_sentry_role(roleName)
     result['message'] = _('Role and privileges created.')
     result['status'] = 0
   except Exception, e:
@@ -284,8 +291,9 @@ def drop_sentry_role(request):
 
   try:
     roleName = request.POST['roleName']
+    component = request.POST['component']
 
-    get_api(request.user).drop_sentry_role(roleName)
+    get_api(request.user, component).drop_sentry_role(roleName)
     result['message'] = _('Role and privileges deleted.')
     result['status'] = 0
   except Exception, e:
@@ -302,10 +310,11 @@ def list_sentry_privileges_by_authorizable(request):
   try:
     groups = [request.POST['groupName']] if request.POST['groupName'] else None
     authorizableSet = [json.loads(request.POST['authorizableHierarchy'])]
+    component = request.POST['component']
 
     _privileges = []
 
-    for authorizable, roles in get_api(request.user).list_sentry_privileges_by_authorizable(authorizableSet=authorizableSet, groups=groups):
+    for authorizable, roles in get_api(request.user, component).list_sentry_privileges_by_authorizable(authorizableSet=authorizableSet, groups=groups):
       for role, privileges in roles.iteritems():
         for privilege in privileges:
           privilege['roleName'] = role
@@ -329,6 +338,7 @@ def bulk_delete_privileges(request):
   try:
     checkedPaths = json.loads(request.POST['checkedPaths'])
     authorizableHierarchy = json.loads(request.POST['authorizableHierarchy'])
+    component = request.POST['component']
 
     for path in [path['path'] for path in checkedPaths]:
       db, table, column = _get_splitted_path(path)
@@ -337,7 +347,7 @@ def bulk_delete_privileges(request):
         'table': table,
         'column': column,
       })
-      get_api(request.user).drop_sentry_privileges(authorizableHierarchy)
+      get_api(request.user, component).drop_sentry_privileges(authorizableHierarchy)
     result['message'] = _('Privileges deleted.')
     result['status'] = 0
   except Exception, e:
@@ -355,6 +365,7 @@ def bulk_add_privileges(request):
     privileges = json.loads(request.POST['privileges'])
     checkedPaths = json.loads(request.POST['checkedPaths'])
     authorizableHierarchy = json.loads(request.POST['authorizableHierarchy'])
+    component = json.loads(request.POST['component'])
 
     privileges = [privilege for privilege in privileges if privilege['status'] == '']
 
@@ -373,7 +384,7 @@ def bulk_add_privileges(request):
         privilege['tableName'] = table
         privilege['columnName'] = column
         privilege['privilegeScope'] = privilegeScope
-        _hive_add_privileges(request.user, {'name': privilege['roleName']}, [privilege])
+        _hive_add_privileges(request.user, {'name': privilege['roleName']}, [privilege], component)
 
     result['message'] = _('Privileges added.')
     result['status'] = 0
@@ -391,8 +402,9 @@ def rename_sentry_privilege(request):
   try:
     oldAuthorizable = json.loads(request.POST['oldAuthorizable'])
     newAuthorizable = json.loads(request.POST['newAuthorizable'])
+    component = request.POST['component']
 
-    get_api(request.user).rename_sentry_privilege(oldAuthorizable, newAuthorizable)
+    get_api(request.user, component).rename_sentry_privilege(oldAuthorizable, newAuthorizable)
     result['message'] = _('Privilege deleted.')
     result['status'] = 0
   except Exception, e:
@@ -410,8 +422,9 @@ def list_sentry_privileges_for_provider(request):
     groups = json.loads(request.POST['groups'])
     roleSet = json.loads(request.POST['roleSet'])
     authorizableHierarchy = json.loads(request.POST['authorizableHierarchy'])
+    component = request.POST['component']
 
-    sentry_privileges = get_api(request.user).list_sentry_privileges_for_provider(groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
+    sentry_privileges = get_api(request.user, component).list_sentry_privileges_for_provider(groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
     result['sentry_privileges'] = sentry_privileges
     result['message'] = ''
     result['status'] = 0

+ 23 - 11
apps/security/src/security/static/security/js/sentry.ko.js

@@ -257,7 +257,8 @@ var Role = function (vm, role) {
   self.saveGroups = function () {
     $(".jHueNotify").hide();
     $.post("/security/api/sentry/update_role_groups", {
-      role: ko.mapping.toJSON(self)
+      role: ko.mapping.toJSON(self),
+      component: vm.component()
     }, function (data) {
       if (data.status == 0) {
         self.showEditGroups(false);
@@ -276,7 +277,8 @@ var Role = function (vm, role) {
   self.create = function () {
     $(".jHueNotify").hide();
     $.post("/security/api/sentry/create_role", {
-      role: ko.mapping.toJSON(self)
+      role: ko.mapping.toJSON(self),
+      component: vm.component()
     }, function (data) {
       if (data.status == 0) {
         $(document).trigger("info", data.message);
@@ -298,7 +300,8 @@ var Role = function (vm, role) {
   self.update = function () {
     $(".jHueNotify").hide();
     $.post("/security/api/sentry/save_privileges", {
-      role: ko.mapping.toJSON(self)
+      role: ko.mapping.toJSON(self),
+      component: vm.component()
     }, function (data) {
       if (data.status == 0) {
         $(document).trigger("info", data.message);
@@ -316,7 +319,8 @@ var Role = function (vm, role) {
   self.remove = function (role) {
     $(".jHueNotify").hide();
     $.post("/security/api/sentry/drop_sentry_role", {
-      roleName: role.name
+      roleName: role.name,
+      component: vm.component()
     }, function (data) {
       if (data.status == 0) {
         vm.removeRole(role.name());
@@ -333,7 +337,8 @@ var Role = function (vm, role) {
   self.savePrivileges = function (role) {
     $(".jHueNotify").hide();
     $.post("/security/api/sentry/save_privileges", {
-      role: ko.mapping.toJSON(role)
+      role: ko.mapping.toJSON(role),
+      component: vm.component()
     }, function (data) {
       if (data.status == 0) {
         vm.list_sentry_privileges_by_authorizable();
@@ -815,6 +820,7 @@ var HiveViewModel = function (initial) {
   self.privilegeFilter = ko.observable("");
 
   // Models
+  self.component = ko.observable(initial.component);
   self.roles = ko.observableArray();
   self.tempRoles = ko.observableArray();
   self.originalRoles = ko.observableArray();
@@ -966,7 +972,8 @@ var HiveViewModel = function (initial) {
       type: "POST",
       url: "/security/api/sentry/list_sentry_roles_by_group",
       data: {
-        'groupName': $('#selectedGroup').val()
+        'groupName': $('#selectedGroup').val(),
+        'component': self.component()
       },
       success: function (data) {
         if (typeof data.status !== "undefined" && data.status == -1) {
@@ -1014,7 +1021,8 @@ var HiveViewModel = function (initial) {
       type: "POST",
       url: "/security/api/sentry/list_sentry_privileges_by_role",
       data: {
-        'roleName': role.name
+        'roleName': role.name,
+        'component': self.component()
       },
       success: function (data) {
         if (typeof data.status !== "undefined" && data.status == -1) {
@@ -1083,7 +1091,8 @@ var HiveViewModel = function (initial) {
       url: "/security/api/sentry/grant_privilege",
       data: {
         'privilege': ko.mapping.toJSON(self.grantToPrivilege()),
-        'roleName': ko.mapping.toJSON(self.grantToPrivilegeRole())
+        'roleName': ko.mapping.toJSON(self.grantToPrivilegeRole()),
+        'component': self.component()
       },
       success: function (data) {
         if (data.status == 0) {
@@ -1132,7 +1141,8 @@ var HiveViewModel = function (initial) {
       data: {
         groupName: $('#selectedGroup').val(),
         roleSet: ko.mapping.toJSON({all: true, roles: []}),
-        authorizableHierarchy: ko.mapping.toJSON(_create_authorizable_from_ko(_path))
+        authorizableHierarchy: ko.mapping.toJSON(_create_authorizable_from_ko(_path)),
+        component: self.component()
       },
       success: function (data) {
     	if (data.status == 0) {
@@ -1198,7 +1208,8 @@ var HiveViewModel = function (initial) {
     $.post("/security/api/sentry/bulk_delete_privileges", {
       'authorizableHierarchy': ko.mapping.toJSON(_create_authorizable_from_ko()),
       'checkedPaths': ko.mapping.toJSON(checkedPaths),
-      'recursive': false
+      'recursive': false,
+      'component': self.component()
     }, function (data) {
       if (data.status == 0) {
         if (norefresh == undefined) {
@@ -1220,7 +1231,8 @@ var HiveViewModel = function (initial) {
       'privileges': ko.mapping.toJSON(self.assist.privileges),
       'authorizableHierarchy': ko.mapping.toJSON(_create_authorizable_from_ko()),
       'checkedPaths': ko.mapping.toJSON(checkedPaths),
-      'recursive': false
+      'recursive': false,
+      'component': self.component()
     }, function (data) {
       if (data.status == 0) {
         self.list_sentry_privileges_by_authorizable(); // Refresh

+ 6 - 10
apps/security/src/security/views.py

@@ -35,21 +35,17 @@ def hive(request):
 
 
 def hive2(request):
-
-  return render("sentry.mako", request, {
-      'initial': json.dumps({
-          'user': request.user.username,
-          'sentry_provider': get_hive_sentry_provider(),
-          'is_sentry_admin': request.user.groups.filter(name__in=get_sentry_server_admin_groups()).exists()
-      }),
-      'has_impersonation_perm': _has_impersonation_perm(request.user),
-  })
+  return _sentry(request, component='hive')
 
 
 def solr(request):
+  return _sentry(request, component='solr')
 
-  return render("hive.mako", request, {
+
+def _sentry(request, component):
+  return render("sentry.mako", request, {
       'initial': json.dumps({
+          'component': component,
           'user': request.user.username,
           'sentry_provider': get_hive_sentry_provider(),
           'is_sentry_admin': request.user.groups.filter(name__in=get_sentry_server_admin_groups()).exists()

+ 5 - 5
desktop/libs/libsentry/src/libsentry/api2.py

@@ -57,14 +57,14 @@ def ha_error_handler(func):
           global _api_cache
           _api_cache = None
           time.sleep(1)
-          args[0].client = _get_client(args[0].client.username)
+          args[0].client = _get_client(args[0].client.username, args[0].client.component)
           LOG.info('Picked %s' % args[0].client)
 
   return decorator
 
 
-def get_api(user):
-  client = _get_client(user.username)
+def get_api(user, component):
+  client = _get_client(user.username, component)
 
   return SentryApi(client)
 
@@ -230,7 +230,7 @@ class SentryException(Exception):
     return self.message
 
 
-def _get_client(username):
+def _get_client(username, component):
   if get_sentry_server_ha_enabled():
     servers = _get_server_properties()
     if servers:
@@ -243,7 +243,7 @@ def _get_client(username):
         'port': PORT.get()
     }
 
-  return SentryClient(server['hostname'], server['port'], username)
+  return SentryClient(server['hostname'], server['port'], username, component)
 
 
 def _get_server_properties():