From d86257c2a0da78e17bf313671c5d56c991a7d84a Mon Sep 17 00:00:00 2001 From: Mohit Yadav <105265192+mohityadav766@users.noreply.github.com> Date: Fri, 11 Apr 2025 09:37:20 +0530 Subject: [PATCH] Missing Permission on Adding Users to team (#20768) --- .../openmetadata/service/jdbi3/TeamRepository.java | 4 ++-- .../resources/domains/DataProductResource.java | 8 ++++++++ .../service/resources/domains/DomainResource.java | 8 ++++++++ .../service/resources/teams/TeamResource.java | 13 +++++++++++++ 4 files changed, 31 insertions(+), 2 deletions(-) diff --git a/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java b/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java index 7db4d130637..7685f4a53b7 100644 --- a/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java +++ b/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java @@ -182,8 +182,8 @@ public class TeamRepository extends EntityRepository { validatePolicies(team.getPolicies()); } - public BulkOperationResult bulkAddAssets(String domainName, BulkAssets request) { - Team team = getByName(null, domainName, getFields("id")); + public BulkOperationResult bulkAddAssets(String teamName, BulkAssets request) { + Team team = getByName(null, teamName, getFields("id")); // Validate all to be users validateAllRefUsers(request.getAssets()); diff --git a/openmetadata-service/src/main/java/org/openmetadata/service/resources/domains/DataProductResource.java b/openmetadata-service/src/main/java/org/openmetadata/service/resources/domains/DataProductResource.java index bd19a11a0c2..52a1f2600e2 100644 --- a/openmetadata-service/src/main/java/org/openmetadata/service/resources/domains/DataProductResource.java +++ b/openmetadata-service/src/main/java/org/openmetadata/service/resources/domains/DataProductResource.java @@ -52,6 +52,7 @@ import org.openmetadata.schema.type.ChangeEvent; import org.openmetadata.schema.type.EntityHistory; import org.openmetadata.schema.type.EntityReference; import org.openmetadata.schema.type.Include; +import org.openmetadata.schema.type.MetadataOperation; import org.openmetadata.schema.type.api.BulkAssets; import org.openmetadata.schema.type.api.BulkOperationResult; import org.openmetadata.service.Entity; @@ -61,6 +62,7 @@ import org.openmetadata.service.limits.Limits; import org.openmetadata.service.resources.Collection; import org.openmetadata.service.resources.EntityResource; import org.openmetadata.service.security.Authorizer; +import org.openmetadata.service.security.policyevaluator.OperationContext; import org.openmetadata.service.util.ResultList; @Slf4j @@ -335,6 +337,9 @@ public class DataProductResource extends EntityResource { @PathParam("name") String name, @Valid BulkAssets request) { + OperationContext operationContext = + new OperationContext(entityType, MetadataOperation.EDIT_ALL); + authorizer.authorize(securityContext, operationContext, getResourceContextByName(name)); return Response.ok().entity(repository.bulkAddAssets(name, request)).build(); } @@ -339,6 +344,9 @@ public class DomainResource extends EntityResource { @PathParam("name") String name, @Valid BulkAssets request) { + OperationContext operationContext = + new OperationContext(entityType, MetadataOperation.EDIT_ALL); + authorizer.authorize(securityContext, operationContext, getResourceContextByName(name)); return Response.ok().entity(repository.bulkRemoveAssets(name, request)).build(); } diff --git a/openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/TeamResource.java b/openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/TeamResource.java index 333d4e28223..5806019eb31 100644 --- a/openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/TeamResource.java +++ b/openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/TeamResource.java @@ -69,6 +69,7 @@ import org.openmetadata.service.limits.Limits; import org.openmetadata.service.resources.Collection; import org.openmetadata.service.resources.EntityResource; import org.openmetadata.service.security.Authorizer; +import org.openmetadata.service.security.policyevaluator.OperationContext; import org.openmetadata.service.util.CSVExportResponse; import org.openmetadata.service.util.JsonUtils; import org.openmetadata.service.util.ResultList; @@ -423,6 +424,9 @@ public class TeamResource extends EntityResource { @PathParam("name") String name, @Valid BulkAssets request) { + OperationContext operationContext = + new OperationContext(entityType, MetadataOperation.EDIT_ALL); + authorizer.authorize(securityContext, operationContext, getResourceContextByName(name)); return Response.ok().entity(repository.bulkAddAssets(name, request)).build(); } @@ -449,6 +453,9 @@ public class TeamResource extends EntityResource { @PathParam("name") String name, @Valid BulkAssets request) { + OperationContext operationContext = + new OperationContext(entityType, MetadataOperation.EDIT_ALL); + authorizer.authorize(securityContext, operationContext, getResourceContextByName(name)); return Response.ok().entity(repository.bulkRemoveAssets(name, request)).build(); } @@ -709,6 +716,9 @@ public class TeamResource extends EntityResource { @Context SecurityContext securityContext, @PathParam("teamId") UUID teamId, List users) { + OperationContext operationContext = + new OperationContext(entityType, MetadataOperation.EDIT_ALL); + authorizer.authorize(securityContext, operationContext, getResourceContextById(teamId)); return repository .updateTeamUsers(securityContext.getUserPrincipal().getName(), teamId, users) .toResponse(); @@ -739,6 +749,9 @@ public class TeamResource extends EntityResource { @Parameter(description = "Id of the user being removed", schema = @Schema(type = "string")) @PathParam("userId") String userId) { + OperationContext operationContext = + new OperationContext(entityType, MetadataOperation.EDIT_ALL); + authorizer.authorize(securityContext, operationContext, getResourceContextById(teamId)); return repository .deleteTeamUser( securityContext.getUserPrincipal().getName(), teamId, UUID.fromString(userId))