Przeglądaj źródła

HUE-8790 [core] Reset write perm when only read sharing a link

Misc clean-up too.
Romain 5 lat temu
rodzic
commit
eba90715cd

+ 5 - 5
apps/beeswax/src/beeswax/api.py

@@ -35,6 +35,9 @@ from desktop.lib.i18n import force_unicode
 from desktop.lib.parameterization import substitute_variables
 from metastore import parser
 from notebook.models import escape_rows, MockedDjangoRequest, make_notebook
+from metastore.conf import FORCE_HS2_METADATA
+from metastore.views import _get_db, _get_servername
+from useradmin.models import User
 
 import beeswax.models
 from beeswax.data_export import upload
@@ -43,13 +46,10 @@ from beeswax.conf import USE_GET_LOG_API
 from beeswax.forms import QueryForm
 from beeswax.models import Session, QueryHistory
 from beeswax.server import dbms
-from beeswax.server.dbms import expand_exception, get_query_server_config, QueryServerException, QueryServerTimeoutException,\
+from beeswax.server.dbms import expand_exception, get_query_server_config, QueryServerException, QueryServerTimeoutException, \
     SubQueryTable
-from beeswax.views import authorized_get_design, authorized_get_query_history, make_parameterization_form,\
+from beeswax.views import authorized_get_design, authorized_get_query_history, make_parameterization_form, \
     safe_get_design, save_design, massage_columns_for_json, _get_query_handle_and_state, parse_out_jobs
-from metastore.conf import FORCE_HS2_METADATA
-from metastore.views import _get_db, _get_servername
-from useradmin.models import User
 
 
 LOG = logging.getLogger(__name__)

+ 2 - 1
desktop/core/src/desktop/api2.py

@@ -27,7 +27,6 @@ import zipfile
 
 from datetime import datetime
 
-from django.contrib.auth.models import Group, User
 from django.core import management
 from django.db import transaction
 from django.http import HttpResponse
@@ -41,6 +40,8 @@ from metadata.conf import has_catalog
 from metadata.catalog_api import search_entities as metadata_search_entities, _highlight, search_entities_interactive as metadata_search_entities_interactive
 from notebook.connectors.altus import SdxApi, AnalyticDbApi, DataEngApi, DataWarehouse2Api
 from notebook.connectors.base import Notebook, get_interpreter
+from notebook.models import Analytics
+from useradmin.models import User, Group
 
 from desktop import appmanager
 from desktop.auth.backend import is_admin

+ 25 - 12
desktop/core/src/desktop/api2_tests.py

@@ -28,7 +28,6 @@ from beeswax.conf import HIVE_SERVER_HOST
 
 from desktop.conf import ENABLE_GIST_PREVIEW
 from desktop.lib.django_test_util import make_logged_in_client
-from desktop.lib.test_utils import grant_access
 from desktop.models import Document2
 
 
@@ -36,10 +35,8 @@ class TestApi2(object):
 
   def setUp(self):
     self.client = make_logged_in_client(username="api2_user", groupname="default", recreate=True, is_superuser=False)
-
     self.user = User.objects.get(username="api2_user")
 
-    grant_access(self.user.username, self.user.username, "desktop")
 
   def test_search_entities_interactive_xss(self):
     query = Document2.objects.create(
@@ -69,7 +66,7 @@ class TestApi2(object):
   def test_get_hue_config(self):
     client = make_logged_in_client(username="api2_superuser", groupname="default", recreate=True, is_superuser=True)
     user = User.objects.get(username="api2_superuser")
-    grant_access(user.username, user.username, "desktop")
+
     response = client.get('/desktop/api2/get_hue_config', data={})
 
     # It should have multiple config sections in json
@@ -78,7 +75,7 @@ class TestApi2(object):
 
     # It should only allow superusers
     client_not_me = make_logged_in_client(username='not_me', is_superuser=False, groupname='test')
-    grant_access("not_me", "test", "desktop")
+
     response = client_not_me.get('/desktop/api2/get_hue_config', data={})
     assert_true(b"You must be a superuser" in response.content, response.content)
 
@@ -94,7 +91,6 @@ class TestApi2(object):
   def test_get_hue_config_private(self):
     client = make_logged_in_client(username="api2_superuser", groupname="default", recreate=True, is_superuser=True)
     user = User.objects.get(username="api2_superuser")
-    grant_access(user.username, user.username, "desktop")
 
     # Not showing private if not asked for
     response = client.get('/desktop/api2/get_hue_config', data={})
@@ -126,9 +122,6 @@ class TestDocumentApiSharingPermissions(object):
     self.user = User.objects.get(username="perm_user")
     self.user_not_me = User.objects.get(username="not_perm_user")
 
-    grant_access(self.user.username, self.user.username, "desktop")
-    grant_access(self.user_not_me.username, self.user_not_me.username, "desktop")
-
 
   def _add_doc(self, name):
     return Document2.objects.create(
@@ -556,6 +549,29 @@ class TestDocumentApiSharingPermissions(object):
     response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
     assert_equal(0, json.loads(response.content)['status'], response.content)
 
+    # Demote to read link
+    response = self.share_link_doc(doc, perm='read')
+
+    assert_equal(0, json.loads(response.content)['status'], response.content)
+
+    assert_true(doc.can_read(self.user))
+    assert_true(doc.can_write(self.user))
+
+    assert_true(doc.can_read(self.user_not_me))
+    assert_false(doc.can_write(self.user_not_me))  # Back to false
+
+    response = self.client.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
+    assert_true(json.loads(response.content)['documents'])
+
+    response = self.client_not_me.get('/desktop/api2/docs/?text=test_link_sharing_permissions')
+    assert_false(json.loads(response.content)['documents'])  #  Link sharing does not list docs in Home, only provides direct access
+
+    response = self.client.get('/desktop/api2/doc/?uuid=%s' % doc_id)
+    assert_equal(0, json.loads(response.content)['status'], response.content)
+
+    response = self.client_not_me.get('/desktop/api2/doc/?uuid=%s' % doc_id)
+    assert_equal(0, json.loads(response.content)['status'], response.content)
+
     # Un-share
     response = self.share_link_doc(doc, perm='off')
 
@@ -588,9 +604,6 @@ class TestDocumentGist(object):
     self.user = User.objects.get(username="gist_user")
     self.user_not_me = User.objects.get(username="other_gist_user")
 
-    grant_access(self.user.username, self.user.username, "desktop")
-    grant_access(self.user_not_me.username, self.user_not_me.username, "desktop")
-
 
   def _create_gist(self, statement, doc_type, name='', description='', client=None):
     if client is None:

+ 1 - 0
desktop/core/src/desktop/models.py

@@ -1407,6 +1407,7 @@ class Document2(models.Model):
   def share_link(self, user, perm='read'):
     if perm == 'read':
       self.share(user, name=Document2Permission.LINK_READ_PERM, is_link_on=True)
+      self.share(user, name=Document2Permission.LINK_WRITE_PERM, is_link_on=False)
     elif perm == 'write':
       self.share(user, name=Document2Permission.LINK_WRITE_PERM, is_link_on=True)
     else: