Pārlūkot izejas kodu

HUE-5275 [libsentry] Privilege checker should return filtered list of the original objects

Jenny Kim 9 gadi atpakaļ
vecāks
revīzija
8401c82

+ 17 - 10
desktop/libs/libsentry/src/libsentry/privilege_checker.py

@@ -75,32 +75,39 @@ class PrivilegeChecker(object):
     filtered_objects = []
 
     # Apply Sentry formatting key function
-    authorizableSet = self._to_sentry_authorizables(objects=objects, key=key)
+    object_authorizables = self._to_sentry_authorizables(objects=objects, key=key)
 
     # Separate V1 (Hive) and V2 (Solr) authorizable objects
-    v1_authorizables = [obj for obj in authorizableSet if 'db' in obj]
-    v2_authorizables = [obj for obj in authorizableSet if 'component' in obj]
+    v1_authorizables = [(obj, auth) for (obj, auth) in object_authorizables if 'db' in auth]
+    v2_authorizables = [(obj, auth) for (obj, auth) in object_authorizables if 'component' in auth]
 
     if v1_authorizables:
       privileges = self._get_privileges_for_user(self.api_v1)
       privilege_hierarchy = self._to_privilege_hierarchy_v1(privileges)
 
-      for authorizable in v1_authorizables:
+      for (object, authorizable) in v1_authorizables:
         if self._is_object_action_authorized_v1(hierarchy=privilege_hierarchy, object=authorizable, action=action):
-          filtered_objects.append(authorizable)
+          filtered_objects.append(object)
 
     if v2_authorizables:
       privileges = self._get_privileges_for_user(self.api_v2)
       privilege_hierarchy = self._to_privilege_hierarchy_v2(privileges)
 
-      for authorizable in v2_authorizables:
+      for (object, authorizable) in v2_authorizables:
         if self._is_object_action_authorized_v2(hierarchy=privilege_hierarchy, object=authorizable, action=action):
-          filtered_objects.append(authorizable)
+          filtered_objects.append(object)
 
     return filtered_objects
 
 
   def _to_sentry_authorizables(self, objects, key):
+    """
+    Given a list of objects, return a list of tuples where the first item is the original object and second item is the
+    converted Sentry authorizable. Any non-Sentry objects are filtered out of the returned dictionary.
+    :param objects: original list of objects to convert to Sentry authorizables using they key function
+    :param key: a function that will be applied to each object to convert to a Sentry format
+    :return: a list of tuples (object, authorizable)
+    """
     def add_default_server(object):
       if 'db' in object and not object.get('server'):  # V1
         object.update({'server': 'server1'})
@@ -108,9 +115,9 @@ class PrivilegeChecker(object):
         object.update({'serviceName': 'server1'})
       return object
 
-    authorizables = [key(obj) for obj in objects if key(obj)]
-    authorizables = [add_default_server(obj) for obj in authorizables]
-    return authorizables
+    object_authorizables = [(obj, key(obj)) for obj in objects if key(obj)]
+    object_authorizables = [(obj, add_default_server(auth)) for (obj, auth) in object_authorizables]
+    return object_authorizables
 
 
   def _get_privileges_for_user(self, api):

+ 26 - 78
desktop/libs/libsentry/src/libsentry/test_privilege_checker.py

@@ -105,9 +105,9 @@ class TestPrivilegeChecker(object):
   def test_to_sentry_authorizables(self):
     objectSet = ['foo', 'bar', 'baz', 'boom']
     expectedSet = [
-      {'db': 'foo', 'server': 'server1'},
-      {'db': 'bar', 'server': 'server1'},
-      {'db': 'baz', 'server': 'server1'},
+      ('foo', {'db': 'foo', 'server': 'server1'}),
+      ('bar', {'db': 'bar', 'server': 'server1'}),
+      ('baz', {'db': 'baz', 'server': 'server1'}),
     ]
 
     def test_key_fn(obj):
@@ -121,82 +121,30 @@ class TestPrivilegeChecker(object):
     # Original list of objects should not be mutated
     assert_true(['bar', 'baz', 'foo'], sorted(objectSet, reverse=True))
 
-    objectSet = [
-      {
-          u'identity': u'9282adb88478c2ce4beb13dbba997ef5',
-          u'serDeLibName': u'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe',
-          u'outputFormat': u'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat',
-          u'sourceType': u'HIVE',
-          u'inputFormat': u'org.apache.hadoop.mapred.TextInputFormat',
-          u'created': u'2016-07-25T17: 22: 18.000Z',
-          u'sourceId': u'4fbdadc6899638782fc8cb626176dc7b',
-          u'tags': [
-              u'asdf'
-          ],
-          u'deleted': False,
-          u'_version_': 1549818955715051520,
-          u'userEntity': False,
-          u'properties': {
-              u'1': u'2'
-          },
-          u'extractorRunId': u'4fbdadc6899638782fc8cb626176dc7b##1',
-          u'compressed': False,
-          u'parentPath': u'/default',
-          u'owner': u'admin',
-          u'originalName': u'sample_08',
-          u'type': u'TABLE',
-          u'lastAccessed': u'1970-01-01T00: 00: 00.000Z',
-          u'fileSystemPath': u'hdfs: //hue-team-1.vpc.cloudera.com: 8020/user/hive/warehouse/sample_08',
-          u'internalType': u'hv_table'
-      },
-      {
-          u'serDeLibName': u'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe',
-          u'owner': u'admin',
-          u'fileSystemPath': u'hdfs: //hue-team-1.vpc.cloudera.com: 8020/user/hive/warehouse/sample_07',
-          u'lastModifiedBy': u'admin',
-          u'_version_': 1550478188023382016,
-          u'type': u'TABLE',
-          u'internalType': u'hv_table',
-          u'sourceType': u'HIVE',
-          u'inputFormat': u'org.apache.hadoop.mapred.TextInputFormat',
-          u'tags': [
-              u'hue-bugblitz',
-              u'vvvvv',
-              u'asdf',
-              u'ffff'
-          ],
-          u'deleted': False,
-          u'userEntity': False,
-          u'originalDescription': u'HueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.\n\nHueisaWebinterfaceforanalyzingdatawithApacheHadoop.HueisaWebinterfaceforanalyzingdatawithApacheHadoop.',
-          u'compressed': False,
-          u'identity': u'ea27302e11370a3927ac11cbb920891d',
-          u'outputFormat': u'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat',
-          u'extractorRunId': u'4fbdadc6899638782fc8cb626176dc7b##8979',
-          u'created': u'2016-07-25T17: 22: 15.000Z',
-          u'sourceId': u'4fbdadc6899638782fc8cb626176dc7b',
-          u'lastModified': u'2016-09-28T16: 25: 07.000Z',
-          u'parentPath': u'/default',
-          u'originalName': u'sample_07',
-          u'lastAccessed': u'1970-01-01T00: 00: 00.000Z'
-      }
-    ]
-    expectedSet = [
-      {u'column': None, u'table': u'sample_08', u'db': u'default', 'server': 'server1'},
-      {u'column': None, u'table': u'sample_07', u'db': u'default', 'server': 'server1'}
-    ]
-
-    def test_key_fn(obj):
-      return {
-        'column': None,
-        'table': obj.get('originalName'),
-        'db': obj.get('parentPath', '').strip('/')
-      }
 
-    authorizableSet = self.checker._to_sentry_authorizables(objects=objectSet, key=test_key_fn)
-    assert_equal(expectedSet, authorizableSet, authorizableSet)
-    # Original list of objects should not be mutated
-    assert_true(all('server' not in obj for obj in objectSet))
-    assert_true(all('db' not in obj for obj in objectSet))
+  def test_end_to_end(self):
+      action = 'SELECT'
+      objectSet = [
+        {'name': 'test_table_select', 'db': 'default'},
+        {'name': 'test_table_insert', 'db': 'default'},
+        {'name': 'test_db_select', 'db': 'test_db_select'},
+        {'name': 'test_none', 'db': 'default'},
+        {'name': 'invalid_object'}
+      ]
+      expectedSet = [
+          {'name': 'test_table_select', 'db': 'default'},
+          {'name': 'test_table_insert', 'db': 'default'},
+          {'name': 'test_db_select', 'db': 'test_db_select'},
+      ]
+
+      def test_key_fn(obj):
+        if 'name' in obj and 'db' in obj:
+          return {'column': '', 'table': obj['name'], 'db': obj['db']}
+        else:
+          return None
+
+      filtered_set = self.checker.filter_objects(objects=objectSet, action=action, key=test_key_fn)
+      assert_equal(expectedSet, filtered_set, filtered_set)
 
 
   def test_columns_select(self):