Pārlūkot izejas kodu

[security] Use the list_sentry_privileges_by_authorizable API

Romain Rigaux 11 gadi atpakaļ
vecāks
revīzija
a87bd31e8f

+ 9 - 11
apps/security/src/security/api/hive.py

@@ -203,24 +203,22 @@ def drop_sentry_role(request):
   return HttpResponse(json.dumps(result), mimetype="application/json")
 
 
-# Mocked until Sentry API returns the info!
 def list_sentry_privileges_by_authorizable(request):
   result = {'status': -1, 'message': 'Error'}
 
   try:
-    groupName = request.POST['groupName'] if request.POST['groupName'] else None
-    roleSet = json.loads(request.POST['roleSet'])
-    authorizableHierarchy = json.loads(request.POST['authorizableHierarchy'])
+    groups = [request.POST['groupName']] if request.POST['groupName'] else None
+    authorizableSet = [json.loads(request.POST['authorizableHierarchy'])]
 
-    privileges = []
-    roles = get_api(request.user).list_sentry_roles_by_group(groupName=groupName)
+    _privileges = []
 
-    for role in roles:
-      for privilege in get_api(request.user).list_sentry_privileges_by_role(role['name'], authorizableHierarchy=authorizableHierarchy):
-        privilege['roleName'] = role['name']
-        privileges.append(privilege)
+    for authorizable, roles in get_api(request.user).list_sentry_privileges_by_authorizable(authorizableSet=authorizableSet, groups=groups):
+      for role, privileges in roles.iteritems():
+        for privilege in privileges:
+          privilege['roleName'] = role
+        _privileges.append(privilege)
 
-    result['privileges'] = sorted(privileges, key=lambda privilege: privilege['roleName'])
+    result['privileges'] = sorted(_privileges, key=lambda privilege: privilege['roleName'])
 
     result['message'] = ''
     result['status'] = 0

+ 33 - 29
apps/security/static/js/hive.ko.js

@@ -70,7 +70,7 @@ var Privilege = function (vm, privilege) {
       self.status('modified');
     }
   });
-  
+
   // UI
   self.privilegeType = ko.observable("db");
   self.showAdvanced = ko.observable(false);
@@ -1003,37 +1003,41 @@ var HiveViewModel = function (initial) {
         authorizableHierarchy: ko.mapping.toJSON(_create_authorizable_from_ko(_path))
       },
       success: function (data) {
-        var _privileges = [];
-        $.each(data.privileges, function (index, item) {
-          if (item.table != ""){
-            self.assist.updatePathProperty(self.assist.growingTree(), item.database + "." + item.table, "withPrivileges", true);
-          }
-          if (typeof skipList == "undefined" || (skipList != null && typeof skipList == "Boolean" && !skipList)){
-            var _role = null;
-            self.assist.roles().forEach(function (role) {
-              if (role.name() == item.roleName) {
-                _role = role;
-              }
-            });
-            if (_role == null) {
-              var _idx = self.assist.roles.push(new Role(self, { name: item.roleName }));
-              _role = self.assist.roles()[_idx - 1];
+    	if (data.status == 0) {
+          var _privileges = [];
+          $.each(data.privileges, function (index, item) {
+            if (item.table != ""){
+              self.assist.updatePathProperty(self.assist.growingTree(), item.database + "." + item.table, "withPrivileges", true);
             }
+            if (typeof skipList == "undefined" || (skipList != null && typeof skipList == "Boolean" && !skipList)){
+              var _role = null;
+              self.assist.roles().forEach(function (role) {
+                if (role.name() == item.roleName) {
+                  _role = role;
+                }
+              });
+              if (_role == null) {
+                var _idx = self.assist.roles.push(new Role(self, { name: item.roleName }));
+                _role = self.assist.roles()[_idx - 1];
+              }
 
-            var privilege = _create_ko_privilege(item);
-            var privilegeCopy = _create_ko_privilege(item);
-            privilegeCopy.id(privilege.id());
-            _role.privileges.push(privilege);
-            _role.originalPrivileges.push(privilegeCopy);            
-            
-            _privileges.push(privilege);
+              var privilege = _create_ko_privilege(item);
+              var privilegeCopy = _create_ko_privilege(item);
+              privilegeCopy.id(privilege.id());
+              _role.privileges.push(privilege);
+              _role.originalPrivileges.push(privilegeCopy);
+
+              _privileges.push(privilege);
+            }
+          });
+          if (typeof skipList == "undefined" || (skipList != null && typeof skipList == "Boolean" && !skipList)) {
+            self.assist.privileges(_privileges);
           }
-        });
-        if (typeof skipList == "undefined" || (skipList != null && typeof skipList == "Boolean" && !skipList)) {
-          self.assist.privileges(_privileges);
-        }
-        self.isLoadingPrivileges(false);
-        self.assist.loadData(self.assist.growingTree());
+          self.isLoadingPrivileges(false);
+          self.assist.loadData(self.assist.growingTree());
+    	} else {
+    	  $(document).trigger("error", data.message);
+    	}
       }
     }).fail(function (xhr, textStatus, errorThrown) {
       $(document).trigger("error", xhr.responseText);

+ 36 - 5
desktop/libs/libsentry/src/libsentry/api.py

@@ -25,9 +25,12 @@ LOG = logging.getLogger(__name__)
 
 
 class SentryException(Exception):
-  def __init__(self, e, message=''):
+  def __init__(self, e):
     super(SentryException, self).__init__(e)
-    self.message = message
+    self.message = e.status.message
+
+  def __str__(self):
+    return self.message
 
 
 def get_api(user):
@@ -113,7 +116,7 @@ class SentryApi(object):
     response = self.client.list_sentry_privileges_by_role(roleName, authorizableHierarchy)
 
     if response.status.value == 0:
-      return [self._massage_priviledges(privilege) for privilege in response.privileges]
+      return [self._massage_priviledge(privilege) for privilege in response.privileges]
     else:
       raise SentryException(response)
 
@@ -127,6 +130,25 @@ class SentryApi(object):
       raise SentryException(response)
 
 
+  def list_sentry_privileges_by_authorizable(self, authorizableSet, groups=None, roleSet=None):
+    response = self.client.list_sentry_privileges_by_authorizable(authorizableSet, groups, roleSet)
+
+    print response
+
+    _privileges = []
+
+    for authorizable, roles in response.privilegesMapByAuth.iteritems():
+      _roles = {}
+      for role, privileges in roles.privilegeMap.iteritems():
+        _roles[role] = [self._massage_priviledge(privilege) for privilege in privileges]
+      _privileges.append((self._massage_authorizable(authorizable), _roles))
+
+    if response.status.value == 0:
+      return _privileges
+    else:
+      raise SentryException(response)
+
+
   def drop_sentry_privileges(self, authorizableHierarchy):
     response = self.client.drop_sentry_privilege(authorizableHierarchy)
 
@@ -145,7 +167,7 @@ class SentryApi(object):
       raise SentryException(response)
 
 
-  def _massage_priviledges(self, privilege):
+  def _massage_priviledge(self, privilege):
     return {
         'scope': privilege.privilegeScope,
         'server': privilege.serverName,
@@ -155,4 +177,13 @@ class SentryApi(object):
         'action': privilege.action.upper(),
         'timestamp': privilege.createTime,
         'grantOption': privilege.grantOption == 1,
-    }
+    }
+
+
+  def _massage_authorizable(self, authorizable):
+    return {
+        'server': authorizable.server,
+        'database': authorizable.db,
+        'table': authorizable.table,
+        'URI': authorizable.uri,
+    }

+ 13 - 1
desktop/libs/libsentry/src/libsentry/client.py

@@ -23,7 +23,8 @@ from sentry_policy_service import SentryPolicyService
 from sentry_policy_service.ttypes import TListSentryRolesRequest, TListSentryPrivilegesRequest, TSentryAuthorizable, TCreateSentryRoleRequest, \
     TDropSentryRoleRequest, TAlterSentryRoleGrantPrivilegeRequest, TSentryPrivilege, TAlterSentryRoleGrantPrivilegeResponse, \
     TAlterSentryRoleRevokePrivilegeRequest, TAlterSentryRoleAddGroupsRequest, TSentryGroup, TAlterSentryRoleDeleteGroupsRequest, \
-    TListSentryPrivilegesForProviderRequest, TSentryActiveRoleSet, TSentryAuthorizable, TDropPrivilegesRequest, TRenamePrivilegesRequest
+    TListSentryPrivilegesForProviderRequest, TSentryActiveRoleSet, TSentryAuthorizable, TDropPrivilegesRequest, TRenamePrivilegesRequest, \
+    TListSentryPrivilegesByAuthRequest
 
 from libsentry.sentry_site import get_sentry_server_authentication,\
   get_sentry_server_principal
@@ -166,3 +167,14 @@ class SentryClient(object):
       authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy)
     request = TListSentryPrivilegesForProviderRequest(groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
     return self.client.list_sentry_privileges_for_provider(request)
+
+
+  def list_sentry_privileges_by_authorizable(self, authorizableSet, groups=None, roleSet=None):
+    authorizableSet = [TSentryAuthorizable(**authorizable) for authorizable in authorizableSet]
+    if roleSet is not None:
+      roleSet = TSentryActiveRoleSet(**roleSet)    
+
+    # Missing requestorUserName=self.username
+    request = TListSentryPrivilegesByAuthRequest(authorizableSet=authorizableSet, groups=groups, roleSet=roleSet)
+    return self.client.list_sentry_privileges_by_authorizable(request)
+