ソースを参照

HUE-7107 [core] HUE4 group access doesn't reflect on Interface

Ying Chen 8 年 前
コミット
8b2341503d

+ 67 - 0
desktop/core/src/desktop/tests.py

@@ -493,12 +493,16 @@ def test_app_permissions():
     check_app(401, 'impala')
     check_app(401, 'hbase')
     check_app(401, 'pig')
+    check_app(401, 'search')
+    check_app(401, 'spark')
     check_app(401, 'oozie')
 
     apps = ClusterConfig(user=user).get_apps()
     assert_false('hive' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('impala' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('pig' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('browser' in apps, apps)
     assert_false('scheduler' in apps, apps)
     assert_false('dashboard' in apps, apps)
@@ -511,12 +515,16 @@ def test_app_permissions():
     check_app(401, 'impala')
     check_app(401, 'hbase')
     check_app(401, 'pig')
+    check_app(401, 'search')
+    check_app(401, 'spark')
     check_app(401, 'oozie')
 
     apps = ClusterConfig(user=user).get_apps()
     assert_true('hive' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('impala' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('pig' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('browser' in apps, apps)
     assert_false('scheduler' in apps, apps)
     assert_false('dashboard' in apps, apps)
@@ -529,6 +537,8 @@ def test_app_permissions():
     check_app(401, 'impala')
     check_app(200, 'hbase')
     check_app(401, 'pig')
+    check_app(401, 'search')
+    check_app(401, 'spark')
     check_app(401, 'oozie')
 
     apps = ClusterConfig(user=user).get_apps()
@@ -538,6 +548,8 @@ def test_app_permissions():
     if 'hbase' not in desktop.conf.APP_BLACKLIST.get():
       assert_true('browser' in apps, apps)
       assert_true('hbase' in apps['browser']['interpreter_names'], apps['browser'])
+    assert_false('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('scheduler' in apps, apps)
     assert_false('dashboard' in apps, apps)
     assert_false('scheduler' in apps, apps)
@@ -549,12 +561,16 @@ def test_app_permissions():
     check_app(401, 'impala')
     check_app(401, 'hbase')
     check_app(401, 'pig')
+    check_app(401, 'search')
+    check_app(401, 'spark')
     check_app(401, 'oozie')
 
     apps = ClusterConfig(user=user).get_apps()
     assert_false('hive' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('impala' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('pig' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('browser' in apps, apps)
     assert_false('scheduler' in apps, apps)
     assert_false('dashboard' in apps, apps)
@@ -567,12 +583,16 @@ def test_app_permissions():
     check_app(200, 'impala')
     check_app(401, 'hbase')
     check_app(401, 'pig')
+    check_app(401, 'search')
+    check_app(401, 'spark')
     check_app(401, 'oozie')
 
     apps = ClusterConfig(user=user).get_apps()
     assert_false('hive' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_true('impala' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('pig' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_false('browser' in apps, apps)
     assert_false('scheduler' in apps, apps)
     assert_false('dashboard' in apps, apps)
@@ -585,23 +605,70 @@ def test_app_permissions():
     check_app(200, 'impala')
     check_app(401, 'hbase')
     check_app(401, 'pig')
+    check_app(401, 'search')
+    check_app(401, 'spark')
     check_app(200, 'oozie')
 
     apps = ClusterConfig(user=user).get_apps()
     assert_true('scheduler' in apps, apps)
     assert_false('browser' in apps, apps) # Actually should be true, but logic not implemented
+    assert_false('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
 
     grant_access(USERNAME, GROUPNAME, "pig")
     check_app(401, 'beeswax')
     check_app(200, 'impala')
     check_app(401, 'hbase')
     check_app(200, 'pig')
+    check_app(401, 'search')
+    check_app(401, 'spark')
     check_app(200, 'oozie')
 
     apps = ClusterConfig(user=user).get_apps()
     assert_false('hive' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_true('impala' in apps.get('editor', {}).get('interpreter_names', []), apps)
     assert_true('pig' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+    assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
+
+    if 'search' not in desktop.conf.APP_BLACKLIST.get():
+      grant_access(USERNAME, GROUPNAME, "search")
+      check_app(401, 'beeswax')
+      check_app(200, 'impala')
+      check_app(401, 'hbase')
+      check_app(200, 'pig')
+      check_app(200, 'search')
+      check_app(401, 'spark')
+      check_app(200, 'oozie')
+
+      apps = ClusterConfig(user=user).get_apps()
+      assert_false('hive' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('impala' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('pig' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_false('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
+
+    if 'spark' not in desktop.conf.APP_BLACKLIST.get():
+      grant_access(USERNAME, GROUPNAME, "spark")
+      check_app(401, 'beeswax')
+      check_app(200, 'impala')
+      check_app(401, 'hbase')
+      check_app(200, 'pig')
+      check_app(200, 'search')
+      check_app(200, 'spark')
+      check_app(200, 'oozie')
+
+      apps = ClusterConfig(user=user).get_apps()
+      assert_false('hive' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('impala' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('pig' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('solr' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('spark' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('pyspark' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('r' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('jar' in apps.get('editor', {}).get('interpreter_names', []), apps)
+      assert_true('py' in apps.get('editor', {}).get('interpreter_names', []), apps)
+
   finally:
     for f in resets:
       f()

+ 9 - 5
desktop/libs/notebook/src/notebook/conf.py

@@ -44,6 +44,14 @@ SHOW_NOTEBOOKS = Config(
 def _remove_duplications(a_list):
   return list(OrderedDict.fromkeys(a_list))
 
+def check_permissions(user, interpreter):
+  user_apps = appmanager.get_apps_dict(user)
+  return (interpreter == 'hive' and 'beeswax' not in user_apps) or \
+         (interpreter == 'impala' and 'impala' not in user_apps) or \
+         (interpreter == 'pig' and 'pig' not in user_apps) or \
+         (interpreter == 'solr' and 'search' not in user_apps) or \
+         (interpreter in ('spark', 'pyspark', 'r', 'jar', 'py') and 'spark' not in user_apps) or \
+         (interpreter in ('java', 'spark2', 'mapreduce', 'shell', 'sqoop1', 'distcp') and 'oozie' not in user_apps)
 
 def get_ordered_interpreters(user=None):
   if not INTERPRETERS.get():
@@ -52,13 +60,9 @@ def get_ordered_interpreters(user=None):
   interpreters = INTERPRETERS.get()
   interpreters_shown_on_wheel = _remove_duplications(INTERPRETERS_SHOWN_ON_WHEEL.get())
 
-  user_apps = appmanager.get_apps_dict(user)
   user_interpreters = []
   for interpreter in interpreters:
-    if (interpreter == 'hive' and 'beeswax' not in user_apps) or \
-        (interpreter == 'impala' and 'impala' not in user_apps) or \
-        (interpreter == 'pig' and 'pig' not in user_apps) or \
-        (interpreter in ('java', 'spark2', 'mapreduce', 'shell', 'sqoop1', 'distcp') and 'oozie' not in user_apps):
+    if (check_permissions(user, interpreter)):
       pass # Not allowed
     else:
       user_interpreters.append(interpreter)

+ 11 - 0
desktop/libs/notebook/src/notebook/decorators.py

@@ -30,12 +30,23 @@ from desktop.lib.rest.http_client import RestException
 from desktop.models import Document2, Document, FilesystemException
 from dashboard.api import extract_solr_exception_message
 
+from notebook.conf import check_permissions
 from notebook.connectors.base import QueryExpired, QueryError, SessionExpired, AuthenticationRequired, OperationTimeout,\
   OperationNotSupported
 
 
 LOG = logging.getLogger(__name__)
 
+def check_editor_access_permission():
+  def inner(view_func):
+    def decorate(request, *args, **kwargs):
+      editor_id = request.GET.get('type', 'hive')
+
+      if check_permissions(request.user, editor_id):
+        raise PopupException(_('Missing permission to access the %s Editor' % editor_id), error_code=401)
+      return view_func(request, *args, **kwargs)
+    return wraps(view_func)(decorate)
+  return inner
 
 def check_document_access_permission():
   def inner(view_func):

+ 2 - 2
desktop/libs/notebook/src/notebook/views.py

@@ -35,7 +35,7 @@ from metadata.conf import has_optimizer, has_navigator
 from notebook.conf import get_ordered_interpreters, SHOW_NOTEBOOKS
 from notebook.connectors.base import Notebook, get_api, _get_snippet_name
 from notebook.connectors.spark_shell import SparkApi
-from notebook.decorators import check_document_access_permission, check_document_modify_permission
+from notebook.decorators import check_editor_access_permission, check_document_access_permission, check_document_modify_permission
 from notebook.management.commands.notebook_setup import Command
 from notebook.models import make_notebook
 
@@ -96,7 +96,7 @@ def notebook(request, is_embeddable=False):
 def notebook_embeddable(request):
   return notebook(request, True)
 
-
+@check_editor_access_permission()
 @check_document_access_permission()
 def editor(request, is_mobile=False, is_embeddable=False):
   editor_id = request.GET.get('editor')