Feature access control #2196
Feature access control #2196
Conversation
nkorange
requested review from
yanlinly,
JianweiWang,
TsingLiang and
xuechaos
There was a problem hiding this comment.
private static final String AUTH_CONFIG_PREFIX = "config/";
格式跟方案不一致； 如果资源中有的时候考虑一下匹配效率。尽量避免的设计。可以参考一下ACM的资源设计
https://help.aliyun.com/document_detail/85118.html?spm=a2c4g.11186623.6.566.72b13733Td5GYG
if (permissionAction.contains(permission.getAction()) &&
Pattern.matches(permissionResource, permission.getResource())) {
return true;
}
There was a problem hiding this comment.
@DeleteMapping(params = "delType=ids")
@Secured(action = ActionTypes.WRITE, parser = ConfigResourceParser.class)
public RestResult<Boolean> deleteConfigs(HttpServletRequest request, HttpServletResponse response,
@RequestParam(value = "ids") List<Long> ids) {
这个不能使用注解鉴权，因为需要根据id查到三元组变成resource才行。 不然解析的都是空
There was a problem hiding this comment.
@Secured(action = ActionTypes.READ, parser = ConfigResourceParser.class)
public void listener(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
一样的问题统一改一下吧，批量接口都没法通过入口解析出三元组，需要接口级别鉴权去做；没法在入口统一搞掉。除非定义各种不同的解析器，但这样会带来重复解析的成本
There was a problem hiding this comment.
// 这块何时不为空呢？ 感觉每次请求这块都是空。
String resource = secured.resource();
if (StringUtils.isBlank(resource)) {
ResourceParser parser = secured.parser().newInstance();
resource = parser.parseName(req);
}
if (StringUtils.isBlank(resource)) {
// deny if we don't find any resource:
throw new AccessException("resource name invalid!");
}
| public Page<PermissionInfo> getPermissions(String role, int pageNo, int pageSize) { | ||
| PaginationHelper<PermissionInfo> helper = new PaginationHelper<>(); | ||
|
|
||
| String sqlCountRows = "select count(*) from permissions where "; |
There was a problem hiding this comment.
I guess use string builder is better?
And I think inserting 'where' in the front of String variable where instead of append 'where' to the end of string sqlFetchRows is better.
Please do not create a Pull Request without creating an issue first.
What is the purpose of the change
Introduce access control
Brief changelog
Issue: #1105
Design document: https://nacos.io/zh-cn/blog/access%20control%20design.html
Verifying this change
Follow this checklist to help us incorporate your contribution quickly and easily:
[ISSUE #123] Fix UnknownException when host config not exist. Each commit in the pull request should have a meaningful subject line and body.mvn -B clean package apache-rat:check findbugs:findbugs -Dmaven.test.skip=trueto make sure basic checks pass. Runmvn clean install -DskipITsto make sure unit-test pass. Runmvn clean test-compile failsafe:integration-testto make sure integration-test pass.