瀏覽代碼

HUE-8874 [security] Privilege checker is not cachable anymore

Will make Navigator catalog works again with security.
Romain 6 年之前
父節點
當前提交
bf11b2d7eb

+ 8 - 7
desktop/libs/libsentry/src/libsentry/privilege_checker.py

@@ -79,14 +79,13 @@ class PrivilegeChecker(object):
   """
 
   def __init__(self, user, api_v1=None, api_v2=None):
-    self.user = user
-    self.api_v1 = api_v1 if api_v1 else get_api_v1(self.user)
-    self.api_v2 = api_v2 if api_v2 else get_api_v2(self.user, component='solr')
+    api_v1 = api_v1 if api_v1 else get_api_v1(user)
+    api_v2 = api_v2 if api_v2 else get_api_v2(user, component='solr')
 
-    privileges_v1 = self._get_privileges_for_user(self.api_v1)
+    privileges_v1 = self._get_privileges_for_user(api_v1)
     self.privilege_hierarchy_v1 = self._to_privilege_hierarchy_v1(privileges_v1)
 
-    privileges_v2 = self._get_privileges_for_user(self.api_v2, serviceName=get_hive_sentry_provider())
+    privileges_v2 = self._get_privileges_for_user(api_v2, serviceName=get_hive_sentry_provider())
     self.privilege_hierarchy_v2 = self._to_privilege_hierarchy_v2(privileges_v2)
 
 
@@ -165,7 +164,6 @@ class PrivilegeChecker(object):
     key named SENTRY_PRIVILEGE_KEY.
     NOTE: This assumes no objects share the same name as SENTRY_PRIVILEGE_KEY
     """
-    tree = lambda: defaultdict(tree)
     hierarchy = tree()
 
     for privilege in privileges:
@@ -191,7 +189,6 @@ class PrivilegeChecker(object):
     key named SENTRY_PRIVILEGE_KEY.
     NOTE: This assumes no objects share the same name as SENTRY_PRIVILEGE_KEY
     """
-    tree = lambda: defaultdict(tree)
     hierarchy = tree()
 
     for privilege in privileges:
@@ -251,3 +248,7 @@ class PrivilegeChecker(object):
     # A privilege hierarchy exists and at least one of the granted privileges is greater than or equal to requested action
     is_authorized = privileges_applied and max(privileges_applied.values()) >= requested_action_level
     return is_authorized
+
+
+def tree():
+  return defaultdict(tree)

+ 8 - 3
desktop/libs/libsentry/src/libsentry/test_privilege_checker.py

@@ -16,6 +16,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import pickle
+
 from django.contrib.auth.models import User
 from nose.tools import assert_equal, assert_false, assert_true
 
@@ -27,7 +29,6 @@ from libsentry.privilege_checker import PrivilegeChecker
 
 class MockSentryApiV1(object):
 
-
   def __init__(self, *args, **kwargs):
     pass
 
@@ -63,7 +64,6 @@ class MockSentryApiV1(object):
 
 class MockSentryApiV2(object):
 
-
   def __init__(self, *args, **kwargs):
     pass
 
@@ -91,7 +91,6 @@ class MockSentryApiV2(object):
 
 class TestPrivilegeChecker(object):
 
-
   def setUp(self):
     self.client = make_logged_in_client(username="test", groupname="test", recreate=True, is_superuser=False)
     self.user = User.objects.get(username="test")
@@ -102,6 +101,12 @@ class TestPrivilegeChecker(object):
     self.checker = PrivilegeChecker(user=self.user, api_v1=self.api_v1, api_v2=self.api_v2)
 
 
+  def test_pickling(self):
+    # Used when caching the serialized
+    serialized_checker = pickle.dumps(self.checker)
+    pickle.loads(serialized_checker)
+
+
   def test_to_sentry_authorizables(self):
     objectSet = ['foo', 'bar', 'baz', 'boom']
     expectedSet = [