浏览代码

[security] Remove Sentry privilege properties

Enable expand and delete buttons accordingly
Romain Rigaux 11 年之前
父节点
当前提交
f4df846

+ 13 - 7
apps/security/src/security/api/hive.py

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 import json
+import time
 
 from django.http import HttpResponse
 from django.utils.translation import ugettext as _
@@ -59,7 +60,8 @@ def _to_sentry_privilege(privilege):
       'dbName': privilege['dbName'],
       'tableName': privilege['tableName'],
       'URI': privilege['URI'],
-      'action': privilege['action']
+      'action': privilege['action'],
+      'createTime': privilege['timestamp']
   }  
 
 
@@ -71,12 +73,16 @@ def _hive_add_privileges(user, role, privileges):
     for privilege in privileges:
       if privilege['status'] not in ('deleted',):
         api.alter_sentry_role_grant_privilege(role['name'], _to_sentry_privilege(privilege))
-        # Mocked until Sentry API returns the info!
+        # Mocked until Sentry API returns the info. Not used currently as we refresh the whole role.
         _privileges.append({
-            "timestamp": 1406160830864, "database": privilege.get('dbName', ''), "action": privilege.get('action', ''),
-            "scope": privilege.get('privilegeScope', ''), "table": privilege.get('tableName', ''),
-            "URI": privilege.get('URI', ''), "grantor": user.username,
-            "server": privilege.get('serverName', '')
+            'timestamp': int(time.time()),
+            'grantor': user.username,
+            'database': privilege.get('dbName'),
+            'action': privilege.get('action'),
+            'scope': privilege.get('privilegeScope'),
+            'table': privilege.get('tableName'),
+            'URI': privilege.get('URI'),            
+            'server': privilege.get('serverName')
         })
 
     return _privileges
@@ -119,7 +125,7 @@ def save_privileges(request):
     
     deleted_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'deleted']
     for privilege in deleted_privileges:
-      print _drop_sentry_privilege(request.user, role, privilege)
+      _drop_sentry_privilege(request.user, role, privilege)
     
     # todo
 #    modified_privileges = [privilege for privilege in role['privilegesChanged'] if privilege['status'] == 'modified']

+ 10 - 11
apps/security/src/security/templates/hive.mako

@@ -40,7 +40,6 @@ ${ layout.menubar(section='hive') }
     <input name="uri" data-bind="attr: { name: 'privilege-' + $index() }" type="radio"/>
     <input type="text" data-bind="value: $data.URI" placeholder="URI">
 
-    ## <input type="text" class="input-small" data-bind="value: $data.action" placeholder="action">
     <select data-bind="options: $root.availableActions, select2: { update: $data.action, type: 'action'}" style="width: 100px"></select>
 
     &nbsp;&nbsp;<a class="pointer" data-bind="click: function(){ showAdvanced(true);}, visible: ! showAdvanced()"><i class="fa fa-cog"></i> ${ _('Show advanced options') }</a>
@@ -57,14 +56,14 @@ ${ layout.menubar(section='hive') }
       <i class="fa fa-times" data-bind="click: remove"></i>
     </a>
 
-    <em class="muted" data-bind="text: moment(properties.timestamp()).fromNow()"></em><br/>
-    ${_('Database')}: <a data-bind="attr: { href: '/metastore/' + properties.database() }" target="_blank"><span data-bind="text: properties.database"></span></a><br/>
-    <span data-bind="text: properties.action"></span>
-    <span data-bind="text: properties.scope"></span>
-    <span data-bind="text: properties.table"></span>
-    <span data-bind="text: properties.URI"></span>
-    <span data-bind="text: properties.grantor"></span>
-    <span data-bind="text: properties.server"></span>
+    <em class="muted" data-bind="text: moment(timestamp()).fromNow()"></em><br/>
+    ${_('Database')}: <a data-bind="attr: { href: '/metastore/' + dbName() }" target="_blank"><span data-bind="text: dbName"></span></a><br/>
+    <span data-bind="text: action"></span>
+    <span data-bind="text: privilegeScope"></span>
+    <span data-bind="text: tableName"></span>
+    <span data-bind="text: URI"></span>
+    <span data-bind="text: grantor"></span>
+    <span data-bind="text: serverName"></span>
   <!-- /ko -->
 
 </div>
@@ -172,8 +171,8 @@ ${ layout.menubar(section='hive') }
               </%def>
 
               <%def name="actions()">
-                <button class="btn toolbarBtn" data-bind="click: $root.expandSelectedRoles"><i class="fa fa-expand"></i> ${ _('Expand') }</button>
-                <button class="btn toolbarBtn" data-bind="click: $root.deleteSelectedRoles"><i class="fa fa-times"></i> ${ _('Delete') }</button>
+                <button class="btn toolbarBtn" data-bind="click: $root.expandSelectedRoles, enable: $root.selectedRoles().length > 0"><i class="fa fa-expand"></i> ${ _('Expand') }</button>
+                <button class="btn toolbarBtn" data-bind="click: $root.deleteSelectedRoles, enable: $root.selectedRoles().length > 0"><i class="fa fa-times"></i> ${ _('Delete') }</button>
               </%def>
 
               <%def name="creation()">

+ 21 - 27
apps/security/static/js/hive.ko.js

@@ -20,7 +20,6 @@ var Privilege = function (vm, privilege) {
 
   self.status = ko.observable(typeof privilege.status != "undefined" && privilege.status != null ? privilege.status : "");
   self.editing = ko.observable(typeof privilege.editing != "undefined" && privilege.editing != null ? privilege.editing : false);
-  //self.privilegeScope = ko.observable(typeof privilege.privilegeScope != "undefined" && privilege.privilegeScope != null ? privilege.privilegeScope : "");
   self.serverName = ko.observable(typeof privilege.serverName != "undefined" && privilege.serverName != null ? privilege.serverName : "");
   self.serverName.subscribe(function () {
     if (self.status() == '') {
@@ -51,6 +50,8 @@ var Privilege = function (vm, privilege) {
       self.status('modified');
     }
   });
+  self.timestamp = ko.observable(typeof privilege.timestamp != "undefined" && privilege.timestamp != null ? privilege.timestamp : 0);
+  self.grantor = ko.observable(typeof privilege.grantor != "undefined" && privilege.grantor != null ? privilege.grantor : "");
 
   // UI
   self.showAdvanced = ko.observable(false);
@@ -138,12 +139,12 @@ var Role = function (vm, role) {
     }, function (data) {
       if (data.status == 0) {
         $(document).trigger("info", data.message);
-        var role = new Role(vm, data.role);
-        role.showPrivileges(true);
-        vm.roles.unshift(role);
+        vm.showCreateRole(false);
         self.reset();
         $(document).trigger("created.role");
-        vm.showCreateRole(false);
+        var role = new Role(vm, data.role);
+        vm.roles.unshift(role);
+        vm.list_sentry_privileges_by_role(role); // Show privileges        
       } else {
         $(document).trigger("error", data.message);
       }
@@ -488,24 +489,20 @@ var Assist = function (vm) {
         success: function (data) {
           var _hasCallback = typeof loadCallback != "undefined";
 
-          //self.getTreeAdditionalDataForPath(self.path()).loaded = true;
           self.getTreeAdditionalDataForPath(_originalPath).loaded = true;
 
           if (data.databases) {
             self.addDatabases(_originalPath, data.databases, _hasCallback);
-          }
-          else if (data.tables && data.tables.length > 0) {
+          } else if (data.tables && data.tables.length > 0) {
             self.addTables(_originalPath, data.tables, _hasCallback);
-          }
-          else if (data.columns && data.columns.length > 0) {
+          } else if (data.columns && data.columns.length > 0) {
             self.addColumns(_originalPath, data.columns, _hasCallback);
           }
 
 
-          if (_hasCallback){
+          if (_hasCallback) {
             loadCallback(data);
-          }
-          else {
+          } else {
             vm.list_sentry_privileges_by_authorizable();
           }
         },
@@ -590,11 +587,10 @@ var HiveViewModel = function (initial) {
   };
 
   self.expandSelectedRoles = function () {
-    if (self.selectedRoles().length == 0){
-      self.selectAllRoles();
-    }
     ko.utils.arrayForEach(self.selectedRoles(), function (role) {
-      self.list_sentry_privileges_by_role(role)
+      if (! role.showPrivileges()) { 
+        self.list_sentry_privileges_by_role(role);
+      }
     });
   };
 
@@ -603,13 +599,11 @@ var HiveViewModel = function (initial) {
     self.assist.path(path);
     self.list_sentry_roles_by_group();
 
-    if (path != ""){
+    if (path != "") {
       self.assist.loadParents();
-    }
-    else {
+    } else {
       self.assist.fetchHivePath();
     }
-
   };
 
   self.removeRole = function (roleName) {
@@ -651,9 +645,9 @@ var HiveViewModel = function (initial) {
           role.privileges.removeAll();
           role.originalPrivileges.removeAll();
           $.each(data.sentry_privileges, function (index, item) {
-              var privilege = _create_ko_privilege(item);
-              role.privileges.push(privilege);
-              role.originalPrivileges.push(privilege);
+            var privilege = _create_ko_privilege(item);
+            role.privileges.push(privilege);
+            role.originalPrivileges.push(privilege);
           });
           role.showPrivileges(true);
         }
@@ -670,14 +664,14 @@ var HiveViewModel = function (initial) {
       'dbName': privilege.database,
       'tableName': privilege.table,
       'URI': privilege.URI,
-      'action': privilege.action
+      'action': privilege.action,
+      'timestamp': privilege.timestamp,
     });
-    _privilege.properties = ko.mapping.fromJS(privilege);
     return _privilege;
   }
 
   self.list_sentry_privileges_by_authorizable = function () {
-    if (self.assist.path() != ""){
+    if (self.assist.path() != "") {
       $.ajax({
         type: "POST",
         url: "/security/api/hive/list_sentry_privileges_by_authorizable",

+ 1 - 0
desktop/libs/libsentry/src/libsentry/client.py

@@ -83,6 +83,7 @@ class SentryClient(object):
   def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege):
     privilege = TSentryPrivilege(**tSentryPrivilege)
     request = TAlterSentryRoleRevokePrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=privilege)
+    print request
     return self.client.alter_sentry_role_revoke_privilege(request)