Browse Source

[security] Support adding new privileges to existing Sentry roles

Romain Rigaux 11 năm trước cách đây
mục cha
commit
84e10c983f

+ 15 - 7
apps/security/src/security/api/hive.py

@@ -55,10 +55,10 @@ def list_sentry_privileges_by_role(request):
 def _hive_add_privileges(user, role, privileges):
     api = get_api(user)
 
-    _priviledges = {}
+    _priviledges = []
 
     for priviledge in privileges:
-      if priviledge['status'] not in ('deleted'):
+      if priviledge['status'] not in ('deleted',):
         api.alter_sentry_role_grant_privilege(role['name'], {
             'privilegeScope': priviledge['privilegeScope'],
             'serverName': priviledge['serverName'],
@@ -67,11 +67,19 @@ def _hive_add_privileges(user, role, privileges):
             'URI': priviledge['URI'],
             'action': priviledge['action']
         })
+        # Mocked until Sentry API returns the info!
+        _priviledges.append({
+            "name": "%s+%s+%s" % (priviledge.get('serverName', ''), priviledge.get('dbName', ''), priviledge.get('tableName', '')),
+            "timestamp": 1406160830864, "database": priviledge.get('dbName', ''), "action": priviledge.get('action', ''), 
+            "scope": priviledge.get('privilegeScope', ''), "table": priviledge.get('tableName', ''),
+            "URI": priviledge.get('URI', ''), "grantor": user.username,
+            "server": priviledge.get('serverName', '')
+        })
 
     return _priviledges
 
 
-def hive_create_role(request):
+def create_role(request):
   result = {'status': -1, 'message': 'Error'}
 
   try:
@@ -93,14 +101,14 @@ def hive_create_role(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
-def hive_add_privileges(request):
+def save_privileges(request):
   result = {'status': -1, 'message': 'Error'}
 
   try:
     role = json.loads(request.POST['role'])
 
-    result['privileges'] = _hive_add_privileges(request.user, role, role['newPrivileges'])
-
+    new_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'new']
+    result['privileges'] = _hive_add_privileges(request.user, role, new_privileges)
     result['message'] = ''
     result['status'] = 0
   except Exception, e:
@@ -139,7 +147,7 @@ def drop_sentry_role(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
-# Mocked!
+# Mocked until Sentry API returns the info!
 def list_sentry_privileges_by_authorizable(request):
   result = {'status': -1, 'message': 'Error'}
 

+ 2 - 2
apps/security/src/security/templates/hive.mako

@@ -132,7 +132,7 @@ ${ layout.menubar(section='hive') }
 		
 		    <%def name="actions()">
               <div class="btn-toolbar" style="display: inline; vertical-align: middle">
-                <button class="btn toolbarBtn"><i class="fa fa-pencil"></i> ${ _('Edit') }</button>
+                <button class="btn toolbarBtn"><i class="fa fa-expand"></i> ${ _('Expand') }</button>
               </div>
 		      <div class="btn-toolbar" style="display: inline; vertical-align: middle">
 		        <button class="btn toolbarBtn"><i class="fa fa-times"></i> ${ _('Delete') }</button>
@@ -226,7 +226,7 @@ ${ layout.menubar(section='hive') }
             <tr data-bind="visible: privilegesChanged().length">
               <td colspan="5">
                 <button type="button" rel="tooltip" data-placement="bottom" data-loading-text="${ _('Saving...') }" data-original-title="${ _('Save') }" class="btn"
-                  data-bind="click: $root.role.create">
+                  data-bind="click: $root.role.savePrivileges">
                   <i class="fa fa-save"></i>
                 </button>
               </td>

+ 2 - 2
apps/security/src/security/urls.py

@@ -39,6 +39,6 @@ urlpatterns += patterns('security.api.hive',
   url(r'^api/hive/list_sentry_privileges_by_authorizable', 'list_sentry_privileges_by_authorizable', name='list_sentry_privileges_by_authorizable'),
   url(r'^api/hive/create_sentry_role', 'create_sentry_role', name='create_sentry_role'),
   url(r'^api/hive/drop_sentry_role', 'drop_sentry_role', name='drop_sentry_role'),
-  url(r'^api/hive/create_role$', 'hive_create_role', name='hive_create_role'),
-  url(r'^api/hive/add_privileges$', 'hive_add_privileges', name='hive_add_privileges'),
+  url(r'^api/hive/create_role$', 'create_role', name='create_role'),
+  url(r'^api/hive/save_privileges$', 'save_privileges', name='save_privileges'),
 )

+ 18 - 19
apps/security/static/js/hive.ko.js

@@ -104,19 +104,14 @@ var Role = function(vm, role) {
     });
   }
 
-  self.saveNewPrivileges = function(role) {
+  self.savePrivileges = function(role) {
 	$(".jHueNotify").hide();
-    $.post("/security/api/hive/add_privileges", {
+    $.post("/security/api/hive/save_privileges", {
         role: ko.mapping.toJSON(role)
       }, function (data) {
         if (data.status == 0) {
-          $.each(data.privileges, function(index, privileges) { // TODO: get back a set<TSentryPrivilege>
-            //role['privileges'] = ko.observableArray();
-            //vm.roles.unshift(data.role); privileges
-          });
-          // self.reset();
-        }
-        else {
+          vm.list_sentry_privileges_by_role(role);
+        } else {
           $(document).trigger("error", data.message);
         }
     }).fail(function (xhr, textStatus, errorThrown) {
@@ -224,16 +219,7 @@ var HiveViewModel = function (initial) {
       success: function (data) {
     	role.privileges.removeAll();
         $.each(data.sentry_privileges, function(index, item) {
-          var privilege = new Privilege(self, {
-        	  'privilegeScope': item.scope,
-               'serverName': item.server,
-               'dbName': item.database,
-               'tableName': item.table,
-               'URI': item.URI,
-               'action': item.action
-          });
-          privilege.properties = ko.mapping.fromJS(item);
-          role.privileges.push(privilege);
+          role.privileges.push(_create_ko_privilege(item));
         });
         role.showPrivileges(true);
       }
@@ -241,6 +227,19 @@ var HiveViewModel = function (initial) {
       $(document).trigger("error", xhr.responseText);
     });
   };
+  
+  function _create_ko_privilege(privilege) {
+	var _privilege = new Privilege(self, {
+        'privilegeScope': privilege.scope,
+        'serverName': privilege.server,
+        'dbName': privilege.database,
+        'tableName': privilege.table,
+        'URI': privilege.URI,
+        'action': privilege.action
+    });
+    _privilege.properties = ko.mapping.fromJS(privilege);
+    return _privilege;
+  }
 
   self.list_sentry_privileges_by_authorizable = function(path) {
 	self.assist.path(path);