瀏覽代碼

HUE-8530 [organization] Builtin filtering of users within an org

Romain 5 年之前
父節點
當前提交
e7248bdb43

+ 13 - 0
apps/useradmin/src/useradmin/models2.py

@@ -18,6 +18,7 @@
 import logging
 import uuid
 
+from crequest.middleware import CrequestMiddleware
 from django.contrib.auth.models import models, AbstractUser, BaseUserManager
 from django.utils.translation import ugettext_lazy as _t
 
@@ -104,6 +105,18 @@ class UserManager(BaseUserManager):
 
   use_in_migrations = True
 
+  def get_queryset(self):
+    """Make sure to restrict to only organization's user"""
+    queryset = super(UserManager, self).get_queryset()
+    request = CrequestMiddleware.get_request()
+
+    if request:
+      queryset = queryset.filter(
+        organization=request.user.organization
+      )
+
+    return queryset
+
   def _create_user(self, email, password, **extra_fields):
     """Create and save a User with the given email and password."""
     if not email:

+ 75 - 0
apps/useradmin/src/useradmin/models2_tests.py

@@ -0,0 +1,75 @@
+#!/usr/bin/env python
+## -*- coding: utf-8 -*-
+# Licensed to Cloudera, Inc. under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  Cloudera, Inc. licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import sys
+import unittest
+
+from nose.plugins.skip import SkipTest
+from nose.tools import assert_equal, assert_true, assert_false
+
+from desktop.auth.backend import rewrite_user, create_user
+from desktop.conf import ENABLE_ORGANIZATIONS
+from desktop.lib.django_test_util import make_logged_in_client
+
+from useradmin.models import User, Group, Organization
+
+
+if sys.version_info[0] > 2:
+  from unittest.mock import patch, Mock
+else:
+  from mock import patch, Mock
+
+
+class TestOrganizationSingleUser(unittest.TestCase):
+
+  @classmethod
+  def setUpClass(cls):
+    if not ENABLE_ORGANIZATIONS.get():  # Skip for now as depends on DB changes
+      raise SkipTest
+
+    cls.user1 = create_user('user1@gethue.com', 'test', is_superuser=False)
+    cls.user2 = create_user('user2@gethue.com', 'test', is_superuser=False)
+    cls.user3 = create_user('user3@gethue.com', 'test', is_superuser=False)
+    cls.user4 = create_user('user4@gethue.com', 'test', is_superuser=False)
+
+    cls.client1 = make_logged_in_client(username=cls.user1.username)
+    cls.client2 = make_logged_in_client(username=cls.user2.username)
+
+  @classmethod
+  def tearDownClass(cls):
+    cls.user1.delete()
+    cls.user2.delete()
+    cls.user3.delete()
+    cls.user4.delete()
+
+
+  def test_users_groups(self):
+    assert_equal(4, User.objects.count())
+    assert_equal(4, Organization.objects.count())
+
+    assert_equal(4, Group.objects.count())
+
+
+  def test_get_users(self):
+
+    response = self.client2.get('/useradmin/api/get_users/')
+    data = json.loads(response.content)
+
+    assert_equal(0, data['status'])
+    assert_true('users' in data)
+    assert_equal([ ], [user['username'] for user in data['users']])

+ 7 - 7
desktop/core/src/desktop/middleware.py

@@ -314,13 +314,13 @@ class LoginAndPermissionMiddleware(object):
 
       app_accessed = request._desktop_app
       app_libs_whitelist = ("desktop", "home", "home2", "about", "hue", "editor", "notebook", "indexer", "404", "500", "403")
-
-      # Accessing an app can access an underlying other app.
-      # e.g. impala or spark uses code from beeswax and so accessing impala shows up as beeswax here.
-      # Here we trust the URL to be the real app we need to check the perms.
-      ui_app_accessed = get_app_name(request)
-      if app_accessed != ui_app_accessed and ui_app_accessed not in ('logs', 'accounts', 'login'):
-        app_accessed = ui_app_accessed
+      if not ENABLE_CONNECTORS.get():
+        # Accessing an app can access an underlying other app.
+        # e.g. impala or spark uses code from beeswax and so accessing impala shows up as beeswax here.
+        # Here we trust the URL to be the real app we need to check the perms.
+        ui_app_accessed = get_app_name(request)
+        if app_accessed != ui_app_accessed and ui_app_accessed not in ('logs', 'accounts', 'login'):
+          app_accessed = ui_app_accessed
 
       if app_accessed and \
           app_accessed not in app_libs_whitelist and \

+ 2 - 0
desktop/core/src/desktop/settings.py

@@ -171,6 +171,7 @@ MIDDLEWARE_CLASSES = [
     #@TODO@ Prakash to check FailedLoginMiddleware working or not?
     #'axes.middleware.FailedLoginMiddleware',
     'desktop.middleware.MimeTypeJSFileFixStreamingMiddleware',
+    'crequest.middleware.CrequestMiddleware',
 ]
 
 # if os.environ.get(ENV_DESKTOP_DEBUG):
@@ -209,6 +210,7 @@ INSTALLED_APPS = [
     'axes',
     'webpack_loader',
     'django_prometheus',
+    'crequest',
     #'django_celery_results',
 ]