Skip to content

Commit 5806f57

Browse files
kungakunga
authored
SystemView Auth Permissions (#13403)
1 parent b2f590f commit 5806f57

File tree

8 files changed

+408
-6
lines changed

8 files changed

+408
-6
lines changed

‎ydb/core/sys_view/auth/owners.cpp

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,18 @@ class TOwnersScan : public TAuthScanBase<TOwnersScan> {
3434
// TODO: add rows according to request's sender user rights
3535

3636
auto entryPath = CanonizePath(entry.Path);
37-
auto entryOwner = entry.Self->Info.GetOwner();
3837

3938
for (auto& column : Columns) {
4039
switch (column.Tag) {
4140
case Schema::AuthOwners::Path::ColumnId:
4241
cells.push_back(TCell(entryPath.data(), entryPath.size()));
4342
break;
4443
case Schema::AuthOwners::Sid::ColumnId:
45-
cells.push_back(TCell(entryOwner.data(), entryOwner.size()));
44+
if (entry.SecurityObject->HasOwnerSID()) {
45+
cells.push_back(TCell(entry.SecurityObject->GetOwnerSID().data(), entry.SecurityObject->GetOwnerSID().size()));
46+
} else {
47+
cells.emplace_back();
48+
}
4649
break;
4750
default:
4851
cells.emplace_back();

‎ydb/core/sys_view/auth/permissions.cpp

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#include "auth_scan_base.h"
2+
#include "permissions.h"
3+
4+
#include <ydb/core/sys_view/common/events.h>
5+
#include <ydb/core/sys_view/common/schema.h>
6+
#include <ydb/core/sys_view/common/scan_actor_base_impl.h>
7+
#include <ydb/core/base/tablet_pipecache.h>
8+
#include <ydb/core/ydb_convert/ydb_convert.h>
9+
#include <ydb/library/login/protos/login.pb.h>
10+
11+
#include <ydb/library/actors/core/hfunc.h>
12+
13+
namespace NKikimr::NSysView::NAuth {
14+
15+
using namespace NSchemeShard;
16+
using namespace NActors;
17+
18+
class TPermissionsScan : public TAuthScanBase<TPermissionsScan> {
19+
public:
20+
using TScanBase = TScanActorBase<TPermissionsScan>;
21+
using TAuthBase = TAuthScanBase<TPermissionsScan>;
22+
23+
TPermissionsScan(bool effective, const NActors::TActorId& ownerId, ui32 scanId, const TTableId& tableId,
24+
const TTableRange& tableRange, const TArrayRef<NMiniKQL::TKqpComputeContextBase::TColumn>& columns)
25+
: TAuthBase(ownerId, scanId, tableId, tableRange, columns)
26+
, Effective(effective)
27+
{
28+
}
29+
30+
protected:
31+
void FillBatch(NKqp::TEvKqpCompute::TEvScanData& batch, const TNavigate::TEntry& entry) override {
32+
Y_ABORT_UNLESS(entry.Status == TNavigate::EStatus::Ok);
33+
34+
TVector<TCell> cells(::Reserve(Columns.size()));
35+
36+
// TODO: add rows according to request's sender user rights
37+
38+
auto entryPath = CanonizePath(entry.Path);
39+
40+
for (const NACLibProto::TACE& ace : entry.SecurityObject->GetACL().GetACE()) {
41+
if (ace.GetAccessType() != (ui32)NACLib::EAccessType::Allow) {
42+
continue;
43+
}
44+
if (!Effective && ace.GetInherited()) {
45+
continue;
46+
}
47+
48+
auto permissions = ConvertACLMaskToYdbPermissionNames(ace.GetAccessRight());
49+
for (const auto& permission : permissions) {
50+
for (auto& column : Columns) {
51+
switch (column.Tag) {
52+
case Schema::AuthPermissions::Path::ColumnId:
53+
cells.push_back(TCell(entryPath.data(), entryPath.size()));
54+
break;
55+
case Schema::AuthPermissions::Sid::ColumnId:
56+
if (ace.HasSID()) {
57+
cells.push_back(TCell(ace.GetSID().data(), ace.GetSID().size()));
58+
} else {
59+
cells.emplace_back();
60+
}
61+
break;
62+
case Schema::AuthPermissions::Permission::ColumnId:
63+
cells.push_back(TCell(permission.data(), permission.size()));
64+
break;
65+
default:
66+
cells.emplace_back();
67+
}
68+
}
69+
70+
TArrayRef<const TCell> ref(cells);
71+
batch.Rows.emplace_back(TOwnedCellVec::Make(ref));
72+
cells.clear();
73+
}
74+
}
75+
76+
batch.Finished = false;
77+
}
78+
79+
private:
80+
const bool Effective;
81+
};
82+
83+
THolder<NActors::IActor> CreatePermissionsScan(bool effective, const NActors::TActorId& ownerId, ui32 scanId, const TTableId& tableId,
84+
const TTableRange& tableRange, const TArrayRef<NMiniKQL::TKqpComputeContextBase::TColumn>& columns)
85+
{
86+
return MakeHolder<TPermissionsScan>(effective, ownerId, scanId, tableId, tableRange, columns);
87+
}
88+
89+
}

‎ydb/core/sys_view/auth/permissions.h

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#pragma once
2+
3+
#include <ydb/core/kqp/runtime/kqp_compute.h>
4+
5+
#include <ydb/library/actors/core/actor.h>
6+
#include <ydb/library/actors/core/actorid.h>
7+
8+
namespace NKikimr::NSysView::NAuth {
9+
10+
THolder<NActors::IActor> CreatePermissionsScan(bool effective, const NActors::TActorId& ownerId, ui32 scanId, const TTableId& tableId,
11+
const TTableRange& tableRange, const TArrayRef<NMiniKQL::TKqpComputeContextBase::TColumn>& columns);
12+
13+
}

‎ydb/core/sys_view/auth/ya.make

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ SRCS(
77
groups.h
88
owners.cpp
99
owners.h
10+
permissions.cpp
11+
permissions.h
1012
users.cpp
1113
users.h
1214
)

‎ydb/core/sys_view/common/schema.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,8 @@ class TSystemViewResolver : public ISystemViewResolver {
293293
RegisterSystemView<Schema::AuthGroups>(NAuth::GroupsName);
294294
RegisterSystemView<Schema::AuthGroupMembers>(GroupMembersName);
295295
RegisterSystemView<Schema::AuthOwners>(OwnersName);
296+
RegisterSystemView<Schema::AuthPermissions>(PermissionsName);
297+
RegisterSystemView<Schema::AuthPermissions>(EffectivePermissionsName);
296298
}
297299
}
298300

‎ydb/core/sys_view/common/schema.h

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ namespace NAuth {
5454
constexpr TStringBuf GroupsName = "auth_groups";
5555
constexpr TStringBuf GroupMembersName = "auth_group_members";
5656
constexpr TStringBuf OwnersName = "auth_owners";
57+
constexpr TStringBuf PermissionsName = "auth_permissions";
58+
constexpr TStringBuf EffectivePermissionsName = "auth_effective_permissions";
5759
}
5860

5961

@@ -658,6 +660,19 @@ struct Schema : NIceDb::Schema {
658660
>;
659661
};
660662

663+
struct AuthPermissions : Table<19> {
664+
struct Path: Column<1, NScheme::NTypeIds::Utf8> {};
665+
struct Sid: Column<2, NScheme::NTypeIds::Utf8> {};
666+
struct Permission: Column<3, NScheme::NTypeIds::Utf8> {};
667+
668+
using TKey = TableKey<Path, Sid, Permission>;
669+
using TColumns = TableColumns<
670+
Path,
671+
Sid,
672+
Permission
673+
>;
674+
};
675+
661676
struct PgColumn {
662677
NIceDb::TColumnId _ColumnId;
663678
NScheme::TTypeInfo _ColumnTypeInfo;

‎ydb/core/sys_view/scan.cpp

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22

33
#include <ydb/core/kqp/compute_actor/kqp_compute_events.h>
44

5+
#include <ydb/core/sys_view/auth/group_members.h>
6+
#include <ydb/core/sys_view/auth/groups.h>
57
#include <ydb/core/sys_view/auth/owners.h>
8+
#include <ydb/core/sys_view/auth/permissions.h>
69
#include <ydb/core/sys_view/auth/users.h>
7-
#include <ydb/core/sys_view/auth/groups.h>
8-
#include <ydb/core/sys_view/auth/group_members.h>
910
#include <ydb/core/sys_view/common/schema.h>
1011
#include <ydb/core/sys_view/partition_stats/partition_stats.h>
1112
#include <ydb/core/sys_view/nodes/nodes.h>
@@ -256,6 +257,10 @@ THolder<NActors::IActor> CreateSystemViewScan(
256257
if (tableId.SysViewInfo == OwnersName) {
257258
return NAuth::CreateOwnersScan(ownerId, scanId, tableId, tableRange, columns);
258259
}
260+
if (tableId.SysViewInfo == PermissionsName || tableId.SysViewInfo == EffectivePermissionsName) {
261+
return NAuth::CreatePermissionsScan(tableId.SysViewInfo == EffectivePermissionsName,
262+
ownerId, scanId, tableId, tableRange, columns);
263+
}
259264
}
260265

261266
return {};

0 commit comments

Comments
 (0)