Преглед на файлове

HUE-8758 [connectors] Combine app permissions with connector permissions

Core apps are: editor, notebook, filebrowser, jobbrowser, metastore,
importer, home
Romain преди 5 години
родител
ревизия
8798b32891
променени са 4 файла, в които са добавени 25 реда и са изтрити 17 реда
  1. 2 0
      apps/useradmin/src/useradmin/models.py
  2. 5 1
      desktop/core/src/desktop/appmanager.py
  3. 17 16
      desktop/core/src/desktop/middleware.py
  4. 1 0
      desktop/core/src/desktop/models.py

+ 2 - 0
apps/useradmin/src/useradmin/models.py

@@ -111,6 +111,8 @@ class UserProfile(models.Model):
         return self.user.is_superuser
     if self.user.is_superuser:
       return True
+    if ENABLE_CONNECTORS.get() and app in ('jobbrowser', 'metastore', 'filebrowser', 'indexer'):
+      return True
 
     group_ids = self.user.groups.values_list('id', flat=True)
     return GroupPermission.objects.filter(group__id__in=group_ids, hue_permission=perm).exists()

+ 5 - 1
desktop/core/src/desktop/appmanager.py

@@ -205,7 +205,11 @@ class DesktopModuleInfo(object):
     return "DesktopModule(%s: %s)" % (self.nice_name, self.module.__name__)
 
 def get_apps(user):
-  return [app for app in DESKTOP_APPS if user.has_hue_permission(action="access", app=app.display_name)]
+  return [
+    app
+      for app in DESKTOP_APPS
+      if user.has_hue_permission(action="access", app=app.display_name)
+  ]
 
 def get_apps_dict(user=None):
   if user is not None:

+ 17 - 16
desktop/core/src/desktop/middleware.py

@@ -49,9 +49,10 @@ from hadoop import cluster
 from useradmin.models import User
 
 import desktop.views
+from desktop import appmanager, metrics
 from desktop.auth.backend import is_admin
 from desktop.conf import AUTH, HTTP_ALLOWED_METHODS, ENABLE_PROMETHEUS, KNOX, DJANGO_DEBUG_MODE, AUDIT_EVENT_LOG_DIR, \
-    SERVER_USER, REDIRECT_WHITELIST, SECURE_CONTENT_SECURITY_POLICY
+    SERVER_USER, REDIRECT_WHITELIST, SECURE_CONTENT_SECURITY_POLICY, ENABLE_CONNECTORS
 from desktop.context_processors import get_app_name
 from desktop.lib import apputil, i18n, fsmanager
 from desktop.lib.django_util import JsonResponse, render, render_json
@@ -59,8 +60,6 @@ from desktop.lib.exceptions import StructuredException
 from desktop.lib.exceptions_renderable import PopupException
 from desktop.log import get_audit_logger
 from desktop.log.access import access_log, log_page_hit, access_warn
-from desktop import appmanager
-from desktop import metrics
 
 
 LOG = logging.getLogger(__name__)
@@ -284,11 +283,12 @@ class LoginAndPermissionMiddleware(object):
     request.ts = time.time()
     request.view_func = view_func
     access_log_level = getattr(view_func, 'access_log_level', None)
-    # skip loop for oidc
+
+    # Skip loop for oidc
     if request.path in ['/oidc/authenticate/', '/oidc/callback/', '/oidc/logout/', '/hue/oidc_failed/']:
       return None
 
-    # First, skip views not requiring login
+    # Skip views not requiring login
 
     # If the view has "opted out" of login required, skip
     if hasattr(view_func, "login_notrequired"):
@@ -301,34 +301,35 @@ class LoginAndPermissionMiddleware(object):
       log_page_hit(request, view_func, level=access_log_level or logging.DEBUG)
       return None
 
-    # If user is logged in, check that he has permissions to access the
-    # app.
+    # If user is logged in, check that he has permissions to access the app
     if request.user.is_active and request.user.is_authenticated():
       AppSpecificMiddleware.augment_request_with_app(request, view_func)
 
-      # Until we get Django 1.3 and resolve returning the URL name, we just do a match of the name of the view
+      # Until Django 1.3 which resolves returning the URL name, just do a match of the name of the view
       try:
         access_view = 'access_view:%s:%s' % (request._desktop_app, resolve(request.path)[0].__name__)
       except Exception as e:
         access_log(request, 'error checking view perm: %s' % e, level=access_log_level)
         access_view = ''
 
-      # Accessing an app can access an underlying other app.
-      # e.g. impala or spark uses code from beeswax and so accessing impala shows up as beeswax here.
-      # Here we trust the URL to be the real app we need to check the perms.
       app_accessed = request._desktop_app
-      ui_app_accessed = get_app_name(request)
-      if app_accessed != ui_app_accessed and ui_app_accessed not in ('logs', 'accounts', 'login'):
-        app_accessed = ui_app_accessed
+      app_libs_whitelist = ("desktop", "home", "home2", "about", "hue", "editor", "notebook", "indexer", "404", "500", "403")
+      if not ENABLE_CONNECTORS.get():
+        # Accessing an app can access an underlying other app.
+        # e.g. impala or spark uses code from beeswax and so accessing impala shows up as beeswax here.
+        # Here we trust the URL to be the real app we need to check the perms.
+        ui_app_accessed = get_app_name(request)
+        if app_accessed != ui_app_accessed and ui_app_accessed not in ('logs', 'accounts', 'login'):
+          app_accessed = ui_app_accessed
 
       if app_accessed and \
-          app_accessed not in ("desktop", "home", "home2", "about", "hue", "editor", "notebook", "indexer", "404", "500", "403") and \
+          app_accessed not in app_libs_whitelist and \
           not (
               is_admin(request.user) or
               request.user.has_hue_permission(action="access", app=app_accessed) or
               request.user.has_hue_permission(action=access_view, app=app_accessed)
           ) and \
-          not (app_accessed == '__debug__' and DJANGO_DEBUG_MODE):
+          not (app_accessed == '__debug__' and DJANGO_DEBUG_MODE.get()):
         access_log(request, 'permission denied', level=access_log_level)
         return PopupException(
             _("You do not have permission to access the %(app_name)s application.") % {'app_name': app_accessed.capitalize()},

+ 1 - 0
desktop/core/src/desktop/models.py

@@ -2040,6 +2040,7 @@ class ClusterConfig(object):
   def get_hive_metastore_interpreters(self):
     return [interpreter['type'] for interpreter in get_ordered_interpreters(self.user) if interpreter['type'] == 'hive' or interpreter['type'] == 'hms']
 
+
 class Cluster(object):
 
   def __init__(self, user):