Selaa lähdekoodia

[libsentry] Support list of privileges and column scope

Romain Rigaux 10 vuotta sitten
vanhempi
commit
9e457ef

+ 1 - 1
apps/security/src/security/static/security/js/hive.ko.js

@@ -756,7 +756,7 @@ var HiveViewModel = function (initial) {
   self.isLoadingPrivileges = ko.observable(true);
   self.isApplyingBulk = ko.observable(false);
 
-  self.availablePrivileges = ko.observableArray(['SERVER', 'DATABASE', 'TABLE']);
+  self.availablePrivileges = ko.observableArray(['SERVER', 'DATABASE', 'TABLE', 'COLUMN']);
   self.availableActions = ko.observableArray(['SELECT', 'INSERT', 'ALL']);
 
   self.privilegeFilter = ko.observable("");

+ 10 - 4
desktop/libs/libsentry/src/libsentry/api.py

@@ -92,8 +92,10 @@ class SentryApi(object):
       raise SentryException(response)
 
   @ha_error_handler
-  def alter_sentry_role_grant_privilege(self, roleName, tSentryPrivilege):
-    response = self.client.alter_sentry_role_grant_privilege(roleName, tSentryPrivilege)
+  def alter_sentry_role_grant_privilege(self, roleName, tSentryPrivilege, tSentryPrivileges=None):
+    if tSentryPrivileges is None:
+      tSentryPrivileges = []
+    response = self.client.alter_sentry_role_grant_privilege(roleName, tSentryPrivilege, tSentryPrivileges)
 
     if response.status.value == 0:
       return response
@@ -101,8 +103,10 @@ class SentryApi(object):
       raise SentryException(response)
 
   @ha_error_handler
-  def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege):
-    response = self.client.alter_sentry_role_revoke_privilege(roleName, tSentryPrivilege)
+  def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege, tSentryPrivileges=None):
+    if tSentryPrivileges is None:
+      tSentryPrivileges = []
+    response = self.client.alter_sentry_role_revoke_privilege(roleName, tSentryPrivilege, tSentryPrivileges)
 
     if response.status.value == 0:
       return response
@@ -206,6 +210,7 @@ class SentryApi(object):
         'action': 'ALL' if privilege.action == '*' else privilege.action.upper(),
         'timestamp': privilege.createTime,
         'grantOption': privilege.grantOption == 1,
+        'columnName': privilege.columnName,
     }
 
 
@@ -215,6 +220,7 @@ class SentryApi(object):
         'database': authorizable.db,
         'table': authorizable.table,
         'URI': authorizable.uri,
+        'column': authorizable.column,
     }
 
 

+ 6 - 4
desktop/libs/libsentry/src/libsentry/client.py

@@ -105,15 +105,17 @@ class SentryClient(object):
     return self.client.drop_sentry_role(request)
 
 
-  def alter_sentry_role_grant_privilege(self, roleName, tSentryPrivilege):
+  def alter_sentry_role_grant_privilege(self, roleName, tSentryPrivilege, tSentryPrivileges):
     privilege = TSentryPrivilege(**tSentryPrivilege)
-    request = TAlterSentryRoleGrantPrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=privilege)
+    privileges = [TSentryPrivilege(**tSentryPrivilege) for tSentryPrivilege in tSentryPrivileges]
+    request = TAlterSentryRoleGrantPrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=privilege, privileges=privileges)
     return self.client.alter_sentry_role_grant_privilege(request)
 
 
-  def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege):
+  def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege, tSentryPrivileges):
     privilege = TSentryPrivilege(**tSentryPrivilege)
-    request = TAlterSentryRoleRevokePrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=privilege)
+    privileges = [TSentryPrivilege(**tSentryPrivilege) for tSentryPrivilege in tSentryPrivileges]
+    request = TAlterSentryRoleRevokePrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=privilege, privileges=privileges)
     return self.client.alter_sentry_role_revoke_privilege(request)