Browse Source

[sentry] Display privileges from Solr component

Separate Hive and Solr privilege template content.
Romain Rigaux 9 năm trước cách đây
mục cha
commit
c61a0bf

+ 3 - 3
apps/security/src/security/api/sentry.py

@@ -36,11 +36,11 @@ LOG = logging.getLogger(__name__)
 
 def fetch_authorizables(request):
   if request.GET['component'] == 'solr':
-    resp = _fetch_collections(request)
+    resp = JsonResponse(_fetch_collections(request))
   elif request.GET['component'] == 'hive':
     resp = _fetch_hive_path(request)
 
-  return JsonResponse(resp)
+  return resp
 
 
 def _fetch_hive_path(request):
@@ -126,7 +126,7 @@ def list_sentry_privileges_by_role(request):
 
     sentry_privileges = get_api(request.user, component).list_sentry_privileges_by_role(serviceName, roleName)
 
-    result['sentry_privileges'] = sorted(sentry_privileges, key=lambda privilege: '%s.%s.%s.%s' % (privilege['server'], privilege['database'], privilege['table'], privilege['URI']))
+    result['sentry_privileges'] = sorted(sentry_privileges, key=lambda privilege: '.'.join([auth['name'] for auth in privilege['authorizables']]))
     result['message'] = ''
     result['status'] = 0
   except Exception, e:

+ 10 - 8
apps/security/src/security/static/security/js/sentry.ko.js

@@ -868,7 +868,12 @@ var HiveViewModel = function (initial) {
   self.isApplyingBulk = ko.observable(false);
 
   self.availablePrivileges = ko.observableArray(['SERVER', 'DATABASE', 'TABLE', 'COLUMN']);
-  self.availableActions = ko.observableArray(['SELECT', 'INSERT', 'ALL']);
+  self.availableActions = ko.observableArray();
+  if (initial.component == 'solr') {
+    self.availableActions(['QUERY', 'UPDATE', 'ALL']);
+  } else {
+    self.availableActions(['SELECT', 'INSERT', 'ALL']);
+  }
 
   self.privilegeFilter = ko.observable("");
 
@@ -1104,15 +1109,12 @@ var HiveViewModel = function (initial) {
 
   function _create_ko_privilege(privilege) {
     var _privilege = new Privilege(self, {
-      'privilegeScope': privilege.scope,
-      'serverName': privilege.server,
-      'dbName': privilege.database,
-      'tableName': privilege.table,
-      'columnName': privilege.column,
-      'URI': privilege.URI,
+      'component': privilege.component,
+      'serverName': privilege.serviceName,
+      'authorizables': privilege.authorizables,
       'action': privilege.action,
       'timestamp': privilege.timestamp,
-      'roleName': privilege.roleName,
+      'grantorPrincipal': privilege.grantorPrincipal,
       'grantOption': privilege.grantOption,
       'id': UUID()
     });

+ 53 - 36
apps/security/src/security/templates/sentry.mako

@@ -53,23 +53,29 @@ ${ layout.menubar(section=component) }
       <a class="pointer" style="margin-right: 4px" data-bind="click: remove"><i class="fa fa-times"></i></a>
     </div>
 
-    <div class="inline-block" style="vertical-align: middle">
-      <a class="pointer" style="padding-top: 4px" data-bind="click: function(){ privilegeType('db'); action($root.availableActions()[0]) }">
-        <i class="fa fa-fw fa-1halfx muted" data-bind="css: {'fa-circle-o': privilegeType() != 'db' , 'fa-check-circle-o': privilegeType() == 'db'}"></i>
-      </a>
-    </div>
-    <input type="text" data-bind="hivechooser: $data.path, enable: privilegeType() == 'db'" placeholder="dbName.tableName <CTRL+SPACE>">
+    <!-- ko if: $root.component() == 'hive' -->
+      <div class="inline-block" style="vertical-align: middle">
+        <a class="pointer" style="padding-top: 4px" data-bind="click: function(){ privilegeType('db'); action($root.availableActions()[0]) }">
+          <i class="fa fa-fw fa-1halfx muted" data-bind="css: {'fa-circle-o': privilegeType() != 'db', 'fa-check-circle-o': privilegeType() == 'db'}"></i>
+        </a>
+      </div>
+      <input type="text" data-bind="hivechooser: $data.path, enable: privilegeType() == 'db'" placeholder="dbName.tableName <CTRL+SPACE>">
 
-    <div class="inline-block" style="vertical-align: middle">
-      <a class="pointer" style="padding-top: 4px" data-bind="click: function(){ privilegeType('uri'); action('ALL'); }">
-        <i class="fa fa-fw fa-1halfx muted" data-bind="css: {'fa-circle-o': privilegeType() != 'uri' , 'fa-check-circle-o': privilegeType() == 'uri'}"></i>
-      </a>
-    </div>
-    <!-- ko if: editing() -->
-    <input type="text" data-bind="filechooser: 'URI TODO', enable: privilegeType() == 'uri'" placeholder="URI">
-    <!-- /ko -->
+      <div class="inline-block" style="vertical-align: middle">
+        <a class="pointer" style="padding-top: 4px" data-bind="click: function(){ privilegeType('uri'); action('ALL'); }">
+          <i class="fa fa-fw fa-1halfx muted" data-bind="css: {'fa-circle-o': privilegeType() != 'uri', 'fa-check-circle-o': privilegeType() == 'uri'}"></i>
+        </a>
+      </div>
 
-    <select data-bind="options: $root.availableActions, value: $data.action, enable: (privilegeType() == 'db')" style="width: 100px; margin-bottom: 0"></select>
+      <input type="text" data-bind="filechooser: 'URI TODO', enable: privilegeType() == 'uri'" placeholder="URI">
+
+      <select data-bind="options: $root.availableActions, value: $data.action, enable: (privilegeType() == 'db')" style="width: 100px; margin-bottom: 0"></select>
+    <!-- /ko -->
+    <!-- ko if: $root.component() == 'solr' -->
+      <span data-bind="text: ko.mapping.toJSON($data)"></span>
+      <input type="text" data-bind="hivechooser: $data.path, enable: privilegeType() == 'db'" placeholder="dbName.tableName <CTRL+SPACE>">
+      <select data-bind="options: $root.availableActions, value: $data.action, enable: (privilegeType() == 'db')" style="width: 100px; margin-bottom: 0"></select>
+    <!-- /ko -->
 
     <div class="new-line-if-small">
       <label class="checkbox"><input type="checkbox" data-bind="checked: grantOption"> ${ _('With grant') }</label>
@@ -93,34 +99,45 @@ ${ layout.menubar(section=component) }
     <!-- /ko -->
 
     <span class="muted" data-bind="text: privilegeScope, attr: {title: moment(timestamp()).fromNow()}"></span>
+
     <!-- ko if: grantOption -->
       <i class="fa fa-unlock muted" title="${ _('With grant option') }"></i>
     <!-- /ko -->
-    <span data-bind="visible: metastorePath() != '' && privilegeType() == 'db'">
-      <a data-bind="attr: { href: metastorePath() }" class="muted" target="_blank" style="margin-left: 4px" title="${ _('Open in Metastore') }"><i class="fa fa-external-link"></i></a>
-    </span>
-    <br/>
-
-    server=<span data-bind="text: serverName"></span>
 
-    <!-- ko if: privilegeType() == 'db' -->
-      <span data-bind="visible: dbName">
-        <i class="fa fa-long-arrow-right"></i> db=<a class="pointer" data-bind="click: function(){ $root.linkToBrowse(dbName()) }" title="${ _('Browse db privileges') }"><span data-bind="text: dbName"></span></a>
-      </span>
-      <span data-bind="visible: tableName">
-        <i class="fa fa-long-arrow-right"></i> table=<a class="pointer" data-bind="click: function(){ $root.linkToBrowse(dbName() + '.' + tableName()) }" title="${ _('Browse table privileges') }"><span data-bind="text: tableName"></span></a>
-      </span>
-      <span data-bind="visible: columnName">
-        <i class="fa fa-long-arrow-right"></i> column=<a class="pointer" data-bind="click: function(){ $root.linkToBrowse(dbName() + '.' + tableName() + '.' + columnName()) }" title="${ _('Browse column privileges') }"><span data-bind="text: columnName"></span></a>
+    <!-- ko if: $root.component() == 'hive' -->
+      <span data-bind="visible: metastorePath() != '' && privilegeType() == 'db'">
+        <a data-bind="attr: { href: metastorePath() }" class="muted" target="_blank" style="margin-left: 4px" title="${ _('Open in Metastore') }"><i class="fa fa-external-link"></i></a>
       </span>
+      <br/>
+
+      server=<span data-bind="text: serverName"></span>
+
+      <!-- ko if: privilegeType() == 'db' -->
+        <span data-bind="visible: dbName">
+          <i class="fa fa-long-arrow-right"></i> db=<a class="pointer" data-bind="click: function(){ $root.linkToBrowse(dbName()) }" title="${ _('Browse db privileges') }"><span data-bind="text: dbName"></span></a>
+        </span>
+        <span data-bind="visible: tableName">
+          <i class="fa fa-long-arrow-right"></i> table=<a class="pointer" data-bind="click: function(){ $root.linkToBrowse(dbName() + '.' + tableName()) }" title="${ _('Browse table privileges') }"><span data-bind="text: tableName"></span></a>
+        </span>
+        <span data-bind="visible: columnName">
+          <i class="fa fa-long-arrow-right"></i> column=<a class="pointer" data-bind="click: function(){ $root.linkToBrowse(dbName() + '.' + tableName() + '.' + columnName()) }" title="${ _('Browse column privileges') }"><span data-bind="text: columnName"></span></a>
+        </span>
+      <!-- /ko -->
+
+      <!-- ko if: privilegeType() == 'uri' -->
+        <i class="fa fa-long-arrow-right"></i> <i class="fa fa-file-o"></i> <i class="fa fa-long-arrow-right"></i> <a data-bind="attr: { href: '/filebrowser/view=/' + URI().split('/')[3] }" target="_blank"><span data-bind="text: URI"></span></a>
+      <!-- /ko -->
+
+      <i class="fa fa-long-arrow-right"></i> action=<span data-bind="text: action"></span>
     <!-- /ko -->
-
-    <!-- ko if: privilegeType() == 'uri' -->
-      <i class="fa fa-long-arrow-right"></i> <i class="fa fa-file-o"></i> <i class="fa fa-long-arrow-right"></i> <a data-bind="attr: { href: '/filebrowser/view=/' + URI().split('/')[3] }" target="_blank"><span data-bind="text: URI"></span></a>
+    <!-- ko if: $root.component() == 'solr' -->
+      <span data-bind="text: ko.mapping.toJSON($data)"></span>
+      <br/>
+      <!-- ko foreach: authorizables -->
+        <span data-bind="text: type"></span>=<span data-bind="text: name_"></span><i class="fa fa-long-arrow-right"></i>
+      </span>
+      <!-- /ko -->
     <!-- /ko -->
-
-    <i class="fa fa-long-arrow-right"></i> action=<span data-bind="text: action"></span>
-
   <!-- /ko -->
 </div>
 </script>

+ 6 - 14
desktop/libs/libsentry/src/libsentry/api2.py

@@ -199,26 +199,18 @@ class SentryApi(object):
 
   def _massage_priviledge(self, privilege):
     return {
-        'scope': privilege.privilegeScope,
-        'server': privilege.serverName,
-        'database': privilege.dbName,
-        'table': privilege.tableName,
-        'URI': privilege.URI,
+        'component': privilege.component,
+        'serviceName': privilege.serviceName,
+        'authorizables': self._massage_authorizable(privilege.authorizables),
         'action': 'ALL' if privilege.action == '*' else privilege.action.upper(),
         'timestamp': privilege.createTime,
+        'grantorPrincipal': privilege.grantorPrincipal,
         'grantOption': privilege.grantOption == 1,
-        'column': privilege.columnName,
     }
 
 
-  def _massage_authorizable(self, authorizable):
-    return {
-        'server': authorizable.server,
-        'database': authorizable.db,
-        'table': authorizable.table,
-        'URI': authorizable.uri,
-        'column': authorizable.column,
-    }
+  def _massage_authorizable(self, authorizables):
+    return [{'type': auth.type, 'name': auth.name} for auth in authorizables]
 
 
 class SentryException(Exception):