소스 검색

HUE-5916 [metadata] Securely filter database, views and columns

Romain Rigaux 8 년 전
부모
커밋
8c3a27d

+ 14 - 4
desktop/libs/metadata/src/metadata/navigator_client.py

@@ -228,10 +228,20 @@ class NavigatorApi(object):
       action = 'SELECT'
 
       def getkey(result):
-        if result['type'] == 'TABLE':
-          return {u'column': None, u'table': result.get('originalName', ''), u'db': result.get('parentPath', '') and result.get('parentPath', '').strip('/'), 'server': get_hive_sentry_provider()}
-        else:
-          return {u'column': None, u'table': None, u'db': None, u'server': None}
+        key = {u'column': None, u'table': None, u'db': None, u'server': get_hive_sentry_provider()}
+
+        if result['type'] == 'TABLE' or result['type'] == 'VIEW':
+          key['db'] = result.get('parentPath', '') and result.get('parentPath', '').strip('/')
+          key['table'] = result.get('originalName', '')
+        elif result['type'] == 'DATABASE':
+          key['db'] = result.get('originalName', '')
+        elif result['type'] == 'FIELD':
+          parents = result.get('parentPath', '').strip('/').split('/')
+          if len(parents) == 2:
+            key['db'], key['table'] = parents
+            key['column'] = result.get('originalName', '')
+
+        return key
 
       return checker.filter_objects(results, action, key=getkey)
     else:

+ 40 - 9
desktop/libs/metadata/src/metadata/navigator_client_tests.py

@@ -27,7 +27,7 @@ from desktop.lib.django_test_util import make_logged_in_client
 from desktop.lib.test_utils import add_to_group, grant_access
 from hadoop.pseudo_hdfs4 import is_live_cluster
 
-from metadata.conf import has_navigator
+from metadata.conf import has_navigator, NAVIGATOR
 from metadata.navigator_client import NavigatorApi
 
 
@@ -39,7 +39,7 @@ class MockedRoot():
     return params
 
 
-class TestNavigatorclient:
+class NavigatorClientTest:
 
   @classmethod
   def setup_class(cls):
@@ -49,21 +49,52 @@ class TestNavigatorclient:
     add_to_group('test')
     grant_access("test", "test", "metadata")
 
-    if not is_live_cluster() or not has_navigator(cls.user):
+    if not has_navigator(cls.user):
       raise SkipTest
 
-  def test_search_entities(self):
-    api = NavigatorApi(self.user)
-    api._root = MockedRoot()
+    cls.api = NavigatorApi(cls.user)
+    cls.api._root = MockedRoot()
+
+
+class TestNavigatorClientSecure(NavigatorClientTest):
+
+  def setUp(self):
+    self.reset = NAVIGATOR.APPLY_SENTRY_PERMISSIONS.set_for_testing(True)
+
+  def tearDown(self):
+    self.reset()
+
+
+  def test_secure_results(self):
+    records = [
+      {u'type': u'DATABASE', u'description': None, u'params': None, u'internalType': u'hv_database', u'sourceType': u'HIVE', u'tags': None, u'originalDescription': None, u'metaClassName': u'hv_database', u'properties': None, u'identity': u'51002517', u'firstClassParentId': None, u'name': None, u'extractorRunId': u'845beb21b95783c4f55276a4ae38a332##3', u'sourceId': u'56850544', u'packageName': u'nav', u'parentPath': None, u'originalName': u'marketsriskcalc_work'}, {u'customProperties': None, u'deleteTime': None, u'fileSystemPath': u'hdfs://Enchilada/data/catssolprn/work/hive', u'description': None, u'params': None, u'type': u'DATABASE', u'internalType': u'hv_database', u'sourceType': u'HIVE', u'tags': None, u'deleted': False, u'technicalProperties': None, u'userEntity': False, u'originalDescription': None, u'metaClassName': u'hv_database', u'properties': None, u'identity': u'51188932', u'firstClassParentId': None, u'name': None, u'extractorRunId': u'845beb21b95783c4f55276a4ae38a332##3', u'sourceId': u'56850544', u'packageName': u'nav', u'parentPath': None, u'originalName': u'catssolprn_work'},
+      {u'type': u'TABLE', u'clusteredByColNames': None, u'customProperties': None, u'owner': u'elt', u'serdeName': None, u'sourceType': u'HIVE', u'serdeLibName': u'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe', u'internalType': u'hv_table', u'description': None, u'tags': None, u'originalDescription': None, u'compressed': False, u'metaClassName': u'hv_table', u'properties': None, u'identity': u'51340470', u'outputFormat': u'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat', u'firstClassParentId': None, u'name': None, u'extractorRunId': u'845beb21b95783c4f55276a4ae38a332##1185', u'created': u'2015-08-14T00:04:01.000Z', u'sourceId': u'56850544', u'lastModified': None, u'packageName': u'nav', u'parentPath': u'/finance_db', u'originalName': u'securitydataval_20150812', u'lastAccessed': u'1970-01-01T00:00:00.000Z'},
+      {u'type': u'FIELD', u'customProperties': None, u'deleteTime': None, u'description': None, u'dataType': u'string', u'internalType': u'hv_column', u'sourceType': u'HIVE', u'tags': None, u'technicalProperties': None, u'userEntity': False, u'originalDescription': None, u'metaClassName': u'hv_column', u'properties': None, u'identity': u'51001004', u'firstClassParentId': u'59444965', u'name': None, u'extractorRunId': u'845beb21b95783c4f55276a4ae38a332##1582', u'sourceId': u'56850544', u'packageName': u'nav', u'parentPath': u'/elt_db/finance', u'originalName': u'valc3'},
+      {u'type': u'VIEW', u'customProperties': None, u'deleteTime': None, u'description': None, u'lastModifiedBy': None, u'internalType': u'hv_view', u'sourceType': u'HIVE', u'tags': None, u'deleted': False, u'technicalProperties': None, u'userEntity': False, u'originalName': u'dsmt_frs_bu', u'originalDescription': None, u'metaClassName': u'hv_view', u'properties': None, u'identity': u'51012354', u'firstClassParentId': None, u'name': None, u'extractorRunId': u'845beb21b95783c4f55276a4ae38a332##394', u'created': u'2015-09-02T08:01:14.000Z', u'sourceId': u'56850544', u'lastModified': None, u'packageName': u'nav', u'parentPath': u'/elt2', u'queryText': u"SELECT * FROM etl.finance LIMIT 10", u'lastAccessed': u'1970-01-01T00:00:00.000Z'}
+    ]
 
+    results = list(self.api._secure_results(records))
+
+    assert_equal(len(records), len(results), results)
+
+
+class TestNavigatorClientTest(NavigatorClientTest):
+
+  def setUp(self):
+    self.reset = NAVIGATOR.APPLY_SENTRY_PERMISSIONS.set_for_testing(False)
+
+  def tearDown(self):
+    self.reset()
+
+  def test_search_entities(self):
     assert_equal(
         '((originalName:*cases*)OR(originalDescription:*cases*)OR(name:*cases*)OR(description:*cases*)OR(tags:*cases*)) AND (*) AND ((type:TABLE)OR(type:VIEW))',
-        api.search_entities(query_s='cases', sources=['hive'])[0][1]
+        self.api.search_entities(query_s='cases', sources=['hive'])[0][1]
     )
 
     assert_equal(
-        '* AND ((type:FIELD))',
-        api.search_entities(query_s='type:FIELD', sources=['hive'])[0][1]
+        '* AND ((type:FIELD*)) AND ((type:TABLE)OR(type:VIEW)OR(type:DATABASE)OR(type:PARTITION)OR(type:FIELD))',
+        self.api.search_entities(query_s='type:FIELD', sources=['hive'])[0][1]
     )
 
     # type:

+ 1 - 1
desktop/libs/metadata/src/metadata/navigator_tests.py

@@ -33,7 +33,7 @@ from hadoop.pseudo_hdfs4 import is_live_cluster
 from metadata.conf import has_navigator, NAVIGATOR, get_navigator_auth_password,\
   get_navigator_auth_username
 from metadata.navigator_api import _augment_highlighting
-from metadata.navigator_client import NavigatorApi
+from metadata.navigator_client import NavigatorApi, NavigatorApiException
 
 
 LOG = logging.getLogger(__name__)