Pārlūkot izejas kodu

[security] Only Sentry admins should have a list of all the groups

If not admin, list only the groups the user belongs to.
Romain Rigaux 11 gadi atpakaļ
vecāks
revīzija
fde4edd

+ 11 - 7
apps/security/src/security/api/test_hive.py

@@ -29,6 +29,9 @@ from django.core.urlresolvers import reverse
 from libsentry import api
 
 
+def mocked_get_api(user):
+  return MockHiveApi(user)
+
 class MockHiveApi(object):
 
   def __init__(self, user):
@@ -38,34 +41,35 @@ class MockHiveApi(object):
     return [{'name': groupName}]
 
 
-class TestMockedApi():
+class TestMockedApi(object):
 
   def setUp(self):
     if not hasattr(api, 'OriginalSentryApi'):
       api.OriginalSentryApi = api.get_api
-      api.get_api = MockHiveApi
+    api.get_api = mocked_get_api
 
     self.client = make_logged_in_client(username='sentry_test', groupname='test', is_superuser=False)
     self.client_admin = make_logged_in_client(username='sentry_hue', groupname='hue', is_superuser=False)
+
     grant_access("sentry_test", "test", "security")
     grant_access("sentry_hue", "hue", "security")
     add_to_group("sentry_test")
     add_to_group("sentry_hue")
 
   def tearDown(self):
-    api.OozieApi = api.OriginalSentryApi
+    api.get_api = api.OriginalSentryApi
 
 
   def test_list_sentry_roles_by_group(self):
     response = self.client.post(reverse("security:list_sentry_roles_by_group"), {'groupName': ''})
-    assert_equal('*', json.loads(response.content)['roles'][0]['name'], response.content)
+    assert_equal('*', json.loads(response.content).get('roles', [{'name': ''}])[0]['name'], response.content)
 
     response = self.client.post(reverse("security:list_sentry_roles_by_group"), {'groupName': 'test'})
-    assert_equal('test', json.loads(response.content)['roles'][0]['name'], response.content)
+    assert_equal('test', json.loads(response.content).get('roles', [{'name': ''}])[0]['name'], response.content)
 
 
     response = self.client_admin.post(reverse("security:list_sentry_roles_by_group"), {'groupName': ''})
-    assert_equal(None, json.loads(response.content)['roles'][0]['name'], response.content)
+    assert_equal(None, json.loads(response.content).get('roles', [{'name': ''}])[0]['name'], response.content)
 
     response = self.client_admin.post(reverse("security:list_sentry_roles_by_group"), {'groupName': 'test'})
-    assert_equal('test', json.loads(response.content)['roles'][0]['name'], response.content)
+    assert_equal('test', json.loads(response.content).get('roles', [{'name': ''}])[0]['name'], response.content)

+ 3 - 5
apps/security/src/security/templates/hive.mako

@@ -251,8 +251,8 @@ ${ layout.menubar(section='hive') }
             <thead>
               <th width="1%"><div data-bind="click: $root.selectAllRoles, css: { hueCheckbox: true, 'fa': true, 'fa-check': allRolesSelected }"></div></th>
               <th width="2%"></th>
-              <th width="20%">${ _('Name') }</th>
-              <th width="74%">${ _('Groups') }</th>
+              <th width="20%" style="text-align:left">${ _('Name') }</th>
+              <th width="74%" style="text-align:left">${ _('Groups') }</th>
               <th width="3%"></th>
             </thead>
             <tbody data-bind="foreach: $root.filteredRoles">
@@ -469,8 +469,7 @@ ${ tree.import_templates(itemClick='$root.assist.setPath', iconClick='$root.assi
 <script src="/static/js/jquery.filechooser.js" type="text/javascript" charset="utf-8"></script>
 
 
-  <script type="text/javascript" charset="utf-8">
-
+<script type="text/javascript" charset="utf-8">
     var viewModel = new HiveViewModel(${ initial | n,unicode });
     ko.applyBindings(viewModel);
 
@@ -645,7 +644,6 @@ ${ tree.import_templates(itemClick='$root.assist.setPath', iconClick='$root.assi
 
       $(document).trigger("create.typeahead");
     });
-
 </script>
 
 ${ commonfooter(messages) | n,unicode }

+ 7 - 4
apps/security/src/security/views.py

@@ -19,20 +19,23 @@ import json
 
 from desktop.lib.django_util import render
 
-from libsentry.sentry_site import get_hive_sentry_provider
+from libsentry.sentry_site import get_hive_sentry_provider, get_sentry_server_admin_groups
 
 
 def hive(request):
 
   return render("hive.mako", request, {
-      'initial': json.dumps({'user': request.user.username, 'sentry_provider': get_hive_sentry_provider()}),
-      'has_impersonation_perm': _has_impersonation_perm(request.user)
+      'initial': json.dumps({
+          'user': request.user.username, 'sentry_provider': get_hive_sentry_provider(),
+          'is_sentry_admin': request.user.groups.filter(name__in=get_sentry_server_admin_groups()).exists()
+      }),
+      'has_impersonation_perm': _has_impersonation_perm(request.user),
   })
 
 
 def hdfs(request):
 
-  return render("hdfs.mako", request, {      
+  return render("hdfs.mako", request, {
       'initial': json.dumps({'user': request.user.username}),
       'has_impersonation_perm': _has_impersonation_perm(request.user)
   })

+ 3 - 1
apps/security/static/js/hive.ko.js

@@ -770,6 +770,7 @@ var HiveViewModel = function (initial) {
     return _roles.sort();
   }, self);
 
+  self.is_sentry_admin = initial.is_sentry_admin;
   self.availableHadoopGroups = ko.observableArray();
   self.assist = new Assist(self, initial);
 
@@ -1105,7 +1106,8 @@ var HiveViewModel = function (initial) {
   self.fetchUsers = function () {
     $.getJSON('/desktop/api/users/autocomplete', {
       'include_myself': true,
-      'extend_user': true
+      'extend_user': true,
+      'only_mygroups': ! self.is_sentry_admin,
     }, function (data) {
       self.availableHadoopUsers(data.users);
       self.availableHadoopGroups(data.groups);

+ 11 - 2
apps/useradmin/src/useradmin/views.py

@@ -77,9 +77,18 @@ def list_permissions(request):
 def list_for_autocomplete(request):
   if request.ajax:
     extended_user_object = request.GET.get('extend_user') == 'true'
+
+    users = User.objects.all()
+    if not request.GET.get('include_myself'):
+      users = users.exclude(pk=request.user.pk)
+
+    groups = Group.objects.all()
+    if request.GET.get('only_mygroups'):
+      groups = request.user.groups.all()
+
     response = {
-      'users': request.GET.get('include_myself') and massage_users_for_json(User.objects.all(), extended_user_object) or massage_users_for_json(User.objects.exclude(pk=request.user.pk), extended_user_object),
-      'groups': massage_groups_for_json(Group.objects.all())
+      'users': massage_users_for_json(users, extended_user_object),
+      'groups': massage_groups_for_json(groups)
     }
     return HttpResponse(json.dumps(response), mimetype="application/json")