Skip to content

Commit 322052f

Browse files
molotkov-andmolotkov-and
authored
Merge 5675413 into e1ce008 
2 parents e1ce008 + 5675413 commit 322052f

File tree

9 files changed

+62
-10
lines changed

9 files changed

+62
-10
lines changed

‎ydb/core/tx/schemeshard/schemeshard__init.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3883,6 +3883,7 @@ struct TSchemeShard::TTxInit : public TTransactionBase<TSchemeShard> {
38833883
sid.SetName(rowset.GetValue<Schema::LoginSids::SidName>());
38843884
sid.SetType(rowset.GetValue<Schema::LoginSids::SidType>());
38853885
sid.SetHash(rowset.GetValue<Schema::LoginSids::SidHash>());
3886+
sid.SetCreatedAt(rowset.GetValueOrDefault<Schema::LoginSids::CreatedAt>());
38863887
sidIndex[sid.name()] = securityState.SidsSize() - 1;
38873888
if (!rowset.Next()) {
38883889
return false;

‎ydb/core/tx/schemeshard/schemeshard__init_root.cpp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
#include <ydb/core/tablet/tablet_exception.h>
55
#include <ydb/core/tablet_flat/flat_cxx_database.h>
66
#include <ydb/library/aclib/aclib.h>
7+
#include <ydb/library/security/util.h>
78

89
namespace NKikimr {
910
namespace NSchemeShard {
@@ -55,7 +56,9 @@ struct TSchemeShard::TTxInitRoot : public TSchemeShard::TRwTxBase {
5556
<< ", error: " << response.Error);
5657
} else {
5758
auto& sid = Self->LoginProvider.Sids[defaultUser.GetName()];
58-
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType, Schema::LoginSids::SidHash>(sid.Type, sid.Hash);
59+
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType,
60+
Schema::LoginSids::SidHash,
61+
Schema::LoginSids::CreatedAt>(sid.Type, sid.Hash, ToInstant(sid.CreatedAt).MilliSeconds());
5962
if (owner.empty()) {
6063
owner = defaultUser.GetName();
6164
}
@@ -77,7 +80,8 @@ struct TSchemeShard::TTxInitRoot : public TSchemeShard::TRwTxBase {
7780
<< ", error: " << response.Error);
7881
} else {
7982
auto& sid = Self->LoginProvider.Sids[defaultGroup.GetName()];
80-
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType>(sid.Type);
83+
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType,
84+
Schema::LoginSids::CreatedAt>(sid.Type, ToInstant(sid.CreatedAt).MilliSeconds());
8185
for (const auto& member : defaultGroup.GetMembers()) {
8286
auto response = Self->LoginProvider.AddGroupMembership({
8387
.Group = defaultGroup.GetName(),

‎ydb/core/tx/schemeshard/schemeshard__operation_alter_login.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#include "schemeshard__operation_part.h"
22
#include "schemeshard__operation_common.h"
33
#include "schemeshard_impl.h"
4+
#include <ydb/library/security/util.h>
45
#include <ydb/core/protos/auth.pb.h>
56

67
namespace {
@@ -32,7 +33,9 @@ class TAlterLogin: public TSubOperationBase {
3233
result->SetStatus(NKikimrScheme::StatusPreconditionFailed, response.Error);
3334
} else {
3435
auto& sid = context.SS->LoginProvider.Sids[createUser.GetUser()];
35-
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType, Schema::LoginSids::SidHash>(sid.Type, sid.Hash);
36+
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType,
37+
Schema::LoginSids::SidHash,
38+
Schema::LoginSids::CreatedAt>(sid.Type, sid.Hash, ToInstant(sid.CreatedAt).MilliSeconds());
3639
if (securityConfig.HasAllUsersGroup()) {
3740
auto response = context.SS->LoginProvider.AddGroupMembership({
3841
.Group = securityConfig.GetAllUsersGroup(),
@@ -76,7 +79,8 @@ class TAlterLogin: public TSubOperationBase {
7679
result->SetStatus(NKikimrScheme::StatusPreconditionFailed, response.Error);
7780
} else {
7881
auto& sid = context.SS->LoginProvider.Sids[group];
79-
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType>(sid.Type);
82+
db.Table<Schema::LoginSids>().Key(sid.Name).Update<Schema::LoginSids::SidType,
83+
Schema::LoginSids::CreatedAt>(sid.Type, ToInstant(sid.CreatedAt).MilliSeconds());
8084
result->SetStatus(NKikimrScheme::StatusSuccess);
8185
}
8286
break;
@@ -200,7 +204,7 @@ class TAlterLogin: public TSubOperationBase {
200204
TPathElement::TPtr path = context.SS->PathsById.at(pathId);
201205
if (path->Owner == user) {
202206
auto pathStr = TPath::Init(pathId, context.SS).PathString();
203-
return {.Error = TStringBuilder() <<
207+
return {.Error = TStringBuilder() <<
204208
"User " << user << " owns " << pathStr << " and can't be removed"};
205209
}
206210
}
@@ -239,7 +243,7 @@ class TAlterLogin: public TSubOperationBase {
239243
for (const TString& group : removeUserResponse.TouchedGroups) {
240244
db.Table<Schema::LoginSidMembers>().Key(group, user).Delete();
241245
}
242-
246+
243247
return {}; // success
244248
}
245249
};

‎ydb/core/tx/schemeshard/schemeshard_schema.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1634,6 +1634,7 @@ struct Schema : NIceDb::Schema {
16341634
struct LastSuccessfulAttempt : Column<4, NScheme::NTypeIds::Timestamp> {};
16351635
struct LastFailedAttempt : Column<5, NScheme::NTypeIds::Timestamp> {};
16361636
struct FailedAttemptCount : Column<6, NScheme::NTypeIds::Uint32> {using Type = ui32; static constexpr Type Default = 0;};
1637+
struct CreatedAt : Column<7, NScheme::NTypeIds::Timestamp> {};
16371638

16381639
using TKey = TableKey<SidName>;
16391640
using TColumns = TableColumns<
@@ -1642,7 +1643,8 @@ struct Schema : NIceDb::Schema {
16421643
SidHash,
16431644
LastSuccessfulAttempt,
16441645
LastFailedAttempt,
1645-
FailedAttemptCount
1646+
FailedAttemptCount,
1647+
CreatedAt
16461648
>;
16471649
};
16481650

‎ydb/core/tx/schemeshard/ut_login/ut_login.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ Y_UNIT_TEST_SUITE(TSchemeShardLoginTest) {
311311
auto describe = DescribePath(runtime, TTestTxConfig::SchemeShard, "/MyRoot");
312312
CheckSecurityState(describe, {.PublicKeysSize = 1, .SidsSize = 0});
313313
}
314-
314+
315315
Y_UNIT_TEST(AddAccess_NonExisting) {
316316
TTestBasicRuntime runtime;
317317
TTestEnv env(runtime);
@@ -331,7 +331,7 @@ Y_UNIT_TEST_SUITE(TSchemeShardLoginTest) {
331331
AsyncModifyACL(runtime, ++txId, "/MyRoot", "Dir1", NACLib::TDiffACL{}.SerializeAsString(), "user1");
332332
TestModificationResults(runtime, txId, {{NKikimrScheme::StatusPreconditionFailed, "Owner SID user1 not found"}});
333333
}
334-
334+
335335
CreateAlterLoginCreateUser(runtime, ++txId, "/MyRoot", "user1", "password1");
336336

337337
TestDescribeResult(DescribePath(runtime, "/MyRoot/Dir1"),

‎ydb/library/login/login.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ TLoginProvider::TBasicResponse TLoginProvider::CreateUser(const TCreateUserReque
7979
TSidRecord& user = itUserCreate.first->second;
8080
user.Name = request.User;
8181
user.Hash = Impl->GenerateHash(request.Password);
82+
user.CreatedAt = std::chrono::system_clock::now();
8283

8384
return response;
8485
}
@@ -158,6 +159,7 @@ TLoginProvider::TBasicResponse TLoginProvider::CreateGroup(const TCreateGroupReq
158159

159160
TSidRecord& group = itGroupCreate.first->second;
160161
group.Name = request.Group;
162+
group.CreatedAt = std::chrono::system_clock::now();
161163

162164
return response;
163165
}
@@ -670,6 +672,7 @@ void TLoginProvider::UpdateSecurityState(const NLoginProto::TSecurityState& stat
670672
sid.Members.emplace(pbSubSid);
671673
ChildToParentIndex[pbSubSid].emplace(sid.Name);
672674
}
675+
sid.CreatedAt = std::chrono::system_clock::time_point(std::chrono::milliseconds(pbSid.GetCreatedAt()));
673676
}
674677
}
675678
}

‎ydb/library/login/login.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ class TLoginProvider {
145145
TString Name;
146146
TString Hash;
147147
std::unordered_set<TString> Members;
148+
std::chrono::system_clock::time_point CreatedAt; // CreatedAt does not need in describe result. We will not add to security state
148149
};
149150

150151
// our current audience (database name)

‎ydb/library/login/login_ut.cpp

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,4 +356,41 @@ Y_UNIT_TEST_SUITE(Login) {
356356
UNIT_ASSERT_VALUES_EQUAL(TLoginProvider::SanitizeJwtToken("token_without_dot"), "");
357357
UNIT_ASSERT_VALUES_EQUAL(TLoginProvider::SanitizeJwtToken("token_without_signature."), "");
358358
}
359+
360+
Y_UNIT_TEST(CheckTimeOfUserCreating) {
361+
TLoginProvider provider;
362+
provider.Audience = "test_audience1";
363+
provider.RotateKeys();
364+
365+
{
366+
std::chrono::time_point<std::chrono::system_clock> start = std::chrono::system_clock::now();
367+
TLoginProvider::TCreateUserRequest request {
368+
.User = "user1",
369+
.Password = "password1"
370+
};
371+
auto response = provider.CreateUser(request);
372+
std::chrono::time_point<std::chrono::system_clock> finish = std::chrono::system_clock::now();
373+
UNIT_ASSERT(!response.Error);
374+
const auto& sid = provider.Sids["user1"];
375+
UNIT_ASSERT(sid.CreatedAt >= start && sid.CreatedAt <= finish);
376+
}
377+
{
378+
std::chrono::time_point<std::chrono::system_clock> start = std::chrono::system_clock::now();
379+
TLoginProvider::TCreateUserRequest request {
380+
.User = "user2",
381+
.Password = "password2"
382+
};
383+
auto response = provider.CreateUser(request);
384+
std::chrono::time_point<std::chrono::system_clock> finish = std::chrono::system_clock::now();
385+
UNIT_ASSERT(!response.Error);
386+
const auto& sid = provider.Sids["user2"];
387+
UNIT_ASSERT(sid.CreatedAt >= start && sid.CreatedAt <= finish);
388+
}
389+
390+
{
391+
const auto& sid1 = provider.Sids["user1"];
392+
const auto& sid2 = provider.Sids["user2"];
393+
UNIT_ASSERT(sid1.CreatedAt < sid2.CreatedAt);
394+
}
395+
}
359396
}

‎ydb/library/login/protos/login.proto

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@ message TSid {
2222
ESidType.SidType Type = 2;
2323
string Hash = 3;
2424
repeated string Members = 4;
25+
uint64 CreatedAt = 5;
2526
}
2627

2728
message TSecurityState {
2829
repeated TPublicKey PublicKeys = 1;
2930
repeated TSid Sids = 2;
3031
string Audience = 3;
3132
}
32-

0 commit comments

Comments
 (0)