opensource/rocketmq
3
0
Fork 0
mirror of https://github.com/apache/rocketmq.git synced 2026-09-24 16:04:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

[ISSUE #3949] Add PermissionChecker

Browse Source
This commit is contained in:
zhouxiang
2022-07-13 11:29:32 +08:00
parent 7c77f4c324
commit 74fedcbfad
3 changed files with 39 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acl/src/main/java/org/apache/rocketmq/acl/PermissionChecker.java
+22
View File
@@ -0,0 +1,22 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.rocketmq.acl;
public interface PermissionChecker {
void check(AccessResource checkedAccess, AccessResource ownedAccess);
}
acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java
+13 -9
View File
@@ -18,23 +18,27 @@
package org.apache.rocketmq.acl.plain;
import java.util.Map;
import org.apache.rocketmq.acl.AccessResource;
import org.apache.rocketmq.acl.PermissionChecker;
import org.apache.rocketmq.acl.common.AclException;
import org.apache.rocketmq.acl.common.Permission;
public class PlainPermissionChecker {
public static void check(PlainAccessResource needCheckedAccess, PlainAccessResource ownedAccess) {
if (Permission.needAdminPerm(needCheckedAccess.getRequestCode()) && !ownedAccess.isAdmin()) {
throw new AclException(String.format("Need admin permission for request code=%d, but accessKey=%s is not", needCheckedAccess.getRequestCode(), ownedAccess.getAccessKey()));
public class PlainPermissionChecker implements PermissionChecker {
public void check(AccessResource checkedAccess, AccessResource ownedAccess) {
PlainAccessResource checkedPlainAccess = (PlainAccessResource) checkedAccess;
PlainAccessResource ownedPlainAccess = (PlainAccessResource) ownedAccess;
if (Permission.needAdminPerm(checkedPlainAccess.getRequestCode()) && !ownedPlainAccess.isAdmin()) {
throw new AclException(String.format("Need admin permission for request code=%d, but accessKey=%s is not", checkedPlainAccess.getRequestCode(), ownedPlainAccess.getAccessKey()));
}
Map<String, Byte> needCheckedPermMap = needCheckedAccess.getResourcePermMap();
Map<String, Byte> ownedPermMap = ownedAccess.getResourcePermMap();
Map<String, Byte> needCheckedPermMap = checkedPlainAccess.getResourcePermMap();
Map<String, Byte> ownedPermMap = ownedPlainAccess.getResourcePermMap();
if (needCheckedPermMap == null) {
// If the needCheckedPermMap is null,then return
return;
}
if (ownedPermMap == null && ownedAccess.isAdmin()) {
if (ownedPermMap == null && ownedPlainAccess.isAdmin()) {
// If the ownedPermMap is null and it is an admin user, then return
return;
}
@@ -46,8 +50,8 @@ public class PlainPermissionChecker {
if (ownedPermMap == null || !ownedPermMap.containsKey(resource)) {
// Check the default perm
byte ownedPerm = isGroup ? ownedAccess.getDefaultGroupPerm() :
ownedAccess.getDefaultTopicPerm();
byte ownedPerm = isGroup ? ownedPlainAccess.getDefaultGroupPerm() :
ownedPlainAccess.getDefaultTopicPerm();
if (!Permission.checkPermission(neededPerm, ownedPerm)) {
throw new AclException(String.format("No default permission for %s", PlainAccessResource.printStr(resource, isGroup)));
}
acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java
+4 -1
View File
@@ -37,6 +37,7 @@ import java.util.Set;
import java.util.concurrent.atomic.AtomicLong;
import org.apache.commons.lang3.StringUtils;
import org.apache.rocketmq.acl.PermissionChecker;
import org.apache.rocketmq.acl.common.AclConstants;
import org.apache.rocketmq.acl.common.AclException;
import org.apache.rocketmq.acl.common.AclUtils;
@@ -81,6 +82,8 @@ public class PlainPermissionManager {
private List<String> fileList = new ArrayList<>();
private final PermissionChecker permissionChecker = new PlainPermissionChecker();
public PlainPermissionManager() {
load();
watch();
@@ -559,7 +562,7 @@ public class PlainPermissionManager {
}
void checkPerm(PlainAccessResource needCheckedAccess, PlainAccessResource ownedAccess) {
PlainPermissionChecker.check(needCheckedAccess, ownedAccess);
permissionChecker.check(needCheckedAccess, ownedAccess);
}
void clearPermissionInfo() {