Skip to content

Commit 03f0d8f

Browse files
pixccpixcc
authored
Merge 405f926 into b0a5850 
2 parents b0a5850 + 405f926 commit 03f0d8f

File tree

18 files changed

+482
-24
lines changed

18 files changed

+482
-24
lines changed

‎ydb/core/tx/schemeshard/schemeshard__init.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4380,6 +4380,12 @@ struct TSchemeShard::TTxInit : public TTransactionBase<TSchemeShard> {
43804380
item.Scheme = scheme;
43814381
}
43824382

4383+
if (rowset.HaveValue<Schema::ImportItems::Permissions>()) {
4384+
Ydb::Scheme::ModifyPermissionsRequest permissions;
4385+
Y_ABORT_UNLESS(ParseFromStringNoSizeLimit(permissions, rowset.GetValue<Schema::ImportItems::Permissions>()));
4386+
item.Permissions = permissions;
4387+
}
4388+
43834389
item.State = static_cast<TImportInfo::EState>(rowset.GetValue<Schema::ImportItems::State>());
43844390
item.WaitTxId = rowset.GetValueOrDefault<Schema::ImportItems::WaitTxId>(InvalidTxId);
43854391
item.NextIndexIdx = rowset.GetValueOrDefault<Schema::ImportItems::NextIndexIdx>(0);

‎ydb/core/tx/schemeshard/schemeshard__operation_create_indexed_table.cpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,9 @@ TVector<ISubOperation::TPtr> CreateIndexedTable(TOperationId nextId, const TTxTr
212212
if (tx.HasAlterUserAttributes()) {
213213
scheme.MutableAlterUserAttributes()->CopyFrom(tx.GetAlterUserAttributes());
214214
}
215+
if (tx.HasModifyACL()) {
216+
scheme.MutableModifyACL()->CopyFrom(tx.GetModifyACL());
217+
}
215218

216219
result.push_back(CreateNewTable(NextPartId(nextId, result), scheme, sequences));
217220
}

‎ydb/core/tx/schemeshard/schemeshard_import.cpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,11 @@ void TSchemeShard::PersistImportItemScheme(NIceDb::TNiceDb& db, const TImportInf
174174
db.Table<Schema::ImportItems>().Key(importInfo->Id, itemIdx).Update(
175175
NIceDb::TUpdate<Schema::ImportItems::Scheme>(item.Scheme.SerializeAsString())
176176
);
177+
if (item.Permissions.Defined()) {
178+
db.Table<Schema::ImportItems>().Key(importInfo->Id, itemIdx).Update(
179+
NIceDb::TUpdate<Schema::ImportItems::Permissions>(item.Permissions->SerializeAsString())
180+
);
181+
}
177182
}
178183

179184
void TSchemeShard::PersistImportItemDstPathId(NIceDb::TNiceDb& db, const TImportInfo::TPtr importInfo, ui32 itemIdx) {

‎ydb/core/tx/schemeshard/schemeshard_import_flow_proposals.cpp‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
#include <ydb/core/base/path.h>
55
#include <ydb/core/ydb_convert/table_description.h>
6+
#include <ydb/core/ydb_convert/ydb_convert.h>
67

78
namespace NKikimr {
89
namespace NSchemeShard {
@@ -20,10 +21,6 @@ THolder<TEvSchemeShard::TEvModifySchemeTransaction> CreateTablePropose(
2021
auto propose = MakeHolder<TEvSchemeShard::TEvModifySchemeTransaction>(ui64(txId), ss->TabletID());
2122
auto& record = propose->Record;
2223

23-
if (importInfo->UserSID) {
24-
record.SetOwner(*importInfo->UserSID);
25-
}
26-
2724
auto& modifyScheme = *record.AddTransaction();
2825
modifyScheme.SetOperationType(NKikimrSchemeOp::ESchemeOpCreateIndexedTable);
2926
modifyScheme.SetInternal(true);
@@ -66,6 +63,15 @@ THolder<TEvSchemeShard::TEvModifySchemeTransaction> CreateTablePropose(
6663
}
6764
}
6865

66+
if (importInfo->UserSID) {
67+
record.SetOwner(*importInfo->UserSID);
68+
}
69+
FillOwner(record, item.Permissions);
70+
71+
if (!FillACL(modifyScheme, item.Permissions, error)) {
72+
return nullptr;
73+
}
74+
6975
return propose;
7076
}
7177

‎ydb/core/tx/schemeshard/schemeshard_import_scheme_getter.cpp‎

Lines changed: 109 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -23,23 +23,29 @@ using namespace Aws::Client;
2323
using namespace Aws::S3;
2424
using namespace Aws;
2525

26+
// Downloads scheme-related objects from S3
2627
class TSchemeGetter: public TActorBootstrapped<TSchemeGetter> {
2728
static TString SchemeKeyFromSettings(const Ydb::Import::ImportFromS3Settings& settings, ui32 itemIdx) {
2829
Y_ABORT_UNLESS(itemIdx < (ui32)settings.items_size());
2930
return TStringBuilder() << settings.items(itemIdx).source_prefix() << "/scheme.pb";
3031
}
3132

33+
static TString PermissionsKeyFromSettings(const Ydb::Import::ImportFromS3Settings& settings, ui32 itemIdx) {
34+
Y_ABORT_UNLESS(itemIdx < (ui32)settings.items_size());
35+
return TStringBuilder() << settings.items(itemIdx).source_prefix() << "/permissions.pb";
36+
}
37+
3238
void HeadObject(const TString& key) {
3339
auto request = Model::HeadObjectRequest()
3440
.WithKey(key);
3541

3642
Send(Client, new TEvExternalStorage::TEvHeadObjectRequest(request));
3743
}
3844

39-
void Handle(TEvExternalStorage::TEvHeadObjectResponse::TPtr& ev) {
45+
void HandleScheme(TEvExternalStorage::TEvHeadObjectResponse::TPtr& ev) {
4046
const auto& result = ev->Get()->Result;
4147

42-
LOG_D("Handle TEvExternalStorage::TEvHeadObjectResponse"
48+
LOG_D("HandleScheme TEvExternalStorage::TEvHeadObjectResponse"
4349
<< ": self# " << SelfId()
4450
<< ", result# " << result);
4551

@@ -51,6 +57,25 @@ class TSchemeGetter: public TActorBootstrapped<TSchemeGetter> {
5157
GetObject(SchemeKey, std::make_pair(0, contentLength - 1));
5258
}
5359

60+
void HandlePermissions(TEvExternalStorage::TEvHeadObjectResponse::TPtr& ev) {
61+
const auto& result = ev->Get()->Result;
62+
63+
LOG_D("HandlePermissions TEvExternalStorage::TEvHeadObjectResponse"
64+
<< ": self# " << SelfId()
65+
<< ", result# " << result);
66+
67+
if (result.GetError().GetErrorType() == S3Errors::RESOURCE_NOT_FOUND
68+
|| result.GetError().GetErrorType() == S3Errors::NO_SUCH_KEY) {
69+
Reply(); // permissions are optional
70+
return;
71+
} else if (!CheckResult(result, "HeadObject")) {
72+
return;
73+
}
74+
75+
const auto contentLength = result.GetResult().GetContentLength();
76+
GetObject(PermissionsKey, std::make_pair(0, contentLength - 1));
77+
}
78+
5479
void GetObject(const TString& key, const std::pair<ui64, ui64>& range) {
5580
auto request = Model::GetObjectRequest()
5681
.WithKey(key)
@@ -59,11 +84,11 @@ class TSchemeGetter: public TActorBootstrapped<TSchemeGetter> {
5984
Send(Client, new TEvExternalStorage::TEvGetObjectRequest(request));
6085
}
6186

62-
void Handle(TEvExternalStorage::TEvGetObjectResponse::TPtr& ev) {
87+
void HandleScheme(TEvExternalStorage::TEvGetObjectResponse::TPtr& ev) {
6388
const auto& msg = *ev->Get();
6489
const auto& result = msg.Result;
6590

66-
LOG_D("Handle TEvExternalStorage::TEvGetObjectResponse"
91+
LOG_D("HandleScheme TEvExternalStorage::TEvGetObjectResponse"
6792
<< ": self# " << SelfId()
6893
<< ", result# " << result);
6994

@@ -74,14 +99,46 @@ class TSchemeGetter: public TActorBootstrapped<TSchemeGetter> {
7499
Y_ABORT_UNLESS(ItemIdx < ImportInfo->Items.size());
75100
auto& item = ImportInfo->Items.at(ItemIdx);
76101

77-
LOG_T("Trying to parse"
102+
LOG_T("Trying to parse scheme"
78103
<< ": self# " << SelfId()
79104
<< ", body# " << SubstGlobalCopy(msg.Body, "\n", "\\n"));
80105

81106
if (!google::protobuf::TextFormat::ParseFromString(msg.Body, &item.Scheme)) {
82107
return Reply(false, "Cannot parse scheme");
83108
}
84109

110+
if (NeedDownloadPermissions) {
111+
StartDownloadingPermissions();
112+
} else {
113+
Reply();
114+
}
115+
}
116+
117+
void HandlePermissions(TEvExternalStorage::TEvGetObjectResponse::TPtr& ev) {
118+
const auto& msg = *ev->Get();
119+
const auto& result = msg.Result;
120+
121+
LOG_D("HandlePermissions TEvExternalStorage::TEvGetObjectResponse"
122+
<< ": self# " << SelfId()
123+
<< ", result# " << result);
124+
125+
if (!CheckResult(result, "GetObject")) {
126+
return;
127+
}
128+
129+
Y_ABORT_UNLESS(ItemIdx < ImportInfo->Items.size());
130+
auto& item = ImportInfo->Items.at(ItemIdx);
131+
132+
LOG_T("Trying to parse permissions"
133+
<< ": self# " << SelfId()
134+
<< ", body# " << SubstGlobalCopy(msg.Body, "\n", "\\n"));
135+
136+
Ydb::Scheme::ModifyPermissionsRequest permissions;
137+
if (!google::protobuf::TextFormat::ParseFromString(msg.Body, &permissions)) {
138+
return Reply(false, "Cannot parse permissions");
139+
}
140+
item.Permissions = std::move(permissions);
141+
85142
Reply();
86143
}
87144

@@ -123,33 +180,67 @@ class TSchemeGetter: public TActorBootstrapped<TSchemeGetter> {
123180
TActor::PassAway();
124181
}
125182

183+
void Download(const TString& key) {
184+
if (Client) {
185+
Send(Client, new TEvents::TEvPoisonPill());
186+
}
187+
Client = RegisterWithSameMailbox(CreateS3Wrapper(ExternalStorageConfig->ConstructStorageOperator()));
188+
189+
HeadObject(key);
190+
}
191+
192+
void DownloadScheme() {
193+
Download(SchemeKey);
194+
}
195+
196+
void DownloadPermissions() {
197+
Download(PermissionsKey);
198+
}
199+
200+
void ResetRetries() {
201+
Attempt = 0;
202+
}
203+
204+
void StartDownloadingPermissions() {
205+
ResetRetries();
206+
DownloadPermissions();
207+
Become(&TThis::StateDownloadPermissions);
208+
}
209+
126210
public:
127211
explicit TSchemeGetter(const TActorId& replyTo, TImportInfo::TPtr importInfo, ui32 itemIdx)
128212
: ExternalStorageConfig(new NWrappers::NExternalStorage::TS3ExternalStorageConfig(importInfo->Settings))
129213
, ReplyTo(replyTo)
130214
, ImportInfo(importInfo)
131215
, ItemIdx(itemIdx)
132216
, SchemeKey(SchemeKeyFromSettings(importInfo->Settings, itemIdx))
217+
, PermissionsKey(PermissionsKeyFromSettings(importInfo->Settings, itemIdx))
133218
, Retries(importInfo->Settings.number_of_retries())
219+
, NeedDownloadPermissions(!importInfo->Settings.no_acl())
134220
{
135221
}
136222

137223
void Bootstrap() {
138-
if (Client) {
139-
Send(Client, new TEvents::TEvPoisonPill());
140-
}
141-
Client = RegisterWithSameMailbox(CreateS3Wrapper(ExternalStorageConfig->ConstructStorageOperator()));
224+
DownloadScheme();
225+
Become(&TThis::StateDownloadScheme);
226+
}
227+
228+
STATEFN(StateDownloadScheme) {
229+
switch (ev->GetTypeRewrite()) {
230+
hFunc(TEvExternalStorage::TEvHeadObjectResponse, HandleScheme);
231+
hFunc(TEvExternalStorage::TEvGetObjectResponse, HandleScheme);
142232

143-
HeadObject(SchemeKey);
144-
Become(&TThis::StateWork);
233+
sFunc(TEvents::TEvWakeup, DownloadScheme);
234+
sFunc(TEvents::TEvPoisonPill, PassAway);
235+
}
145236
}
146237

147-
STATEFN(StateWork) {
238+
STATEFN(StateDownloadPermissions) {
148239
switch (ev->GetTypeRewrite()) {
149-
hFunc(TEvExternalStorage::TEvHeadObjectResponse, Handle);
150-
hFunc(TEvExternalStorage::TEvGetObjectResponse, Handle);
240+
hFunc(TEvExternalStorage::TEvHeadObjectResponse, HandlePermissions);
241+
hFunc(TEvExternalStorage::TEvGetObjectResponse, HandlePermissions);
151242

152-
sFunc(TEvents::TEvWakeup, Bootstrap);
243+
sFunc(TEvents::TEvWakeup, DownloadPermissions);
153244
sFunc(TEvents::TEvPoisonPill, PassAway);
154245
}
155246
}
@@ -161,13 +252,16 @@ class TSchemeGetter: public TActorBootstrapped<TSchemeGetter> {
161252
const ui32 ItemIdx;
162253

163254
const TString SchemeKey;
255+
const TString PermissionsKey;
164256

165257
const ui32 Retries;
166258
ui32 Attempt = 0;
167259

168260
TDuration Delay = TDuration::Minutes(1);
169261
static constexpr TDuration MaxDelay = TDuration::Minutes(10);
170262

263+
const bool NeedDownloadPermissions = true;
264+
171265
TActorId Client;
172266

173267
}; // TSchemeGetter

‎ydb/core/tx/schemeshard/schemeshard_info_types.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2769,6 +2769,7 @@ struct TImportInfo: public TSimpleRefCount<TImportInfo> {
27692769
TString DstPathName;
27702770
TPathId DstPathId;
27712771
Ydb::Table::CreateTableRequest Scheme;
2772+
TMaybeFail<Ydb::Scheme::ModifyPermissionsRequest> Permissions;
27722773

27732774
EState State = EState::GetScheme;
27742775
ESubState SubState = ESubState::AllocateTxId;

‎ydb/core/tx/schemeshard/schemeshard_schema.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1520,6 +1520,7 @@ struct Schema : NIceDb::Schema {
15201520
struct DstPathOwnerId : Column<4, NScheme::NTypeIds::Uint64> { using Type = TOwnerId; };
15211521
struct DstPathLocalId : Column<5, NScheme::NTypeIds::Uint64> { using Type = TLocalPathId; };
15221522
struct Scheme : Column<6, NScheme::NTypeIds::String> {};
1523+
struct Permissions : Column<11, NScheme::NTypeIds::String> {};
15231524

15241525
struct State : Column<7, NScheme::NTypeIds::Byte> {};
15251526
struct WaitTxId : Column<8, NScheme::NTypeIds::Uint64> { using Type = TTxId; };
@@ -1534,6 +1535,7 @@ struct Schema : NIceDb::Schema {
15341535
DstPathOwnerId,
15351536
DstPathLocalId,
15361537
Scheme,
1538+
Permissions,
15371539
State,
15381540
WaitTxId,
15391541
NextIndexIdx,

‎ydb/core/tx/schemeshard/ut_helpers/ls_checks.cpp‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1207,9 +1207,9 @@ TCheckFunc HasOwner(const TString& owner) {
12071207
};
12081208
}
12091209

1210-
void CheckEffectiveRight(const NKikimrScheme::TEvDescribeSchemeResult& record, const TString& right, bool mustHave) {
1210+
void CheckRight(const NKikimrScheme::TEvDescribeSchemeResult& record, const TString& right, bool mustHave, bool isEffective) {
12111211
const auto& self = record.GetPathDescription().GetSelf();
1212-
TSecurityObject src(self.GetOwner(), self.GetEffectiveACL(), false);
1212+
TSecurityObject src(self.GetOwner(), isEffective ? self.GetEffectiveACL() : self.GetACL(), false);
12131213

12141214
NACLib::TSecurityObject required;
12151215
required.FromString(right);
@@ -1233,6 +1233,22 @@ void CheckEffectiveRight(const NKikimrScheme::TEvDescribeSchemeResult& record, c
12331233
}
12341234
}
12351235

1236+
TCheckFunc HasRight(const TString& right) {
1237+
return [=] (const NKikimrScheme::TEvDescribeSchemeResult& record) {
1238+
CheckRight(record, right, true, true);
1239+
};
1240+
}
1241+
1242+
TCheckFunc HasNotRight(const TString& right) {
1243+
return [=] (const NKikimrScheme::TEvDescribeSchemeResult& record) {
1244+
CheckRight(record, right, false, true);
1245+
};
1246+
}
1247+
1248+
void CheckEffectiveRight(const NKikimrScheme::TEvDescribeSchemeResult& record, const TString& right, bool mustHave) {
1249+
CheckRight(record, right, mustHave, true);
1250+
}
1251+
12361252
TCheckFunc HasEffectiveRight(const TString& right) {
12371253
return [=] (const NKikimrScheme::TEvDescribeSchemeResult& record) {
12381254
CheckEffectiveRight(record, right, true);

‎ydb/core/tx/schemeshard/ut_helpers/ls_checks.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,8 @@ namespace NLs {
168168
TCheckFunc BackupHistoryCount(ui64 count);
169169

170170
TCheckFunc HasOwner(const TString& owner);
171+
TCheckFunc HasRight(const TString& right);
172+
TCheckFunc HasNotRight(const TString& right);
171173
TCheckFunc HasEffectiveRight(const TString& right);
172174
TCheckFunc HasNotEffectiveRight(const TString& right);
173175

0 commit comments

Comments
 (0)