yujunjun/datahub
2
0
Fork 0
mirror of https://github.com/datahub-project/datahub.git synced 2025-08-16 21:27:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add STARTS_WITH policy condition to allow for URN-wildcard-based policies (#11441)

Browse Source 
Co-authored-by: Hendrik Richert <hendrik.richert@swisscom.com>
This commit is contained in:
Hendrik Richert 2024-09-20 17:33:14 +02:00 committed by GitHub
parent 9eefedfdc0
commit b607a66c05
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 130 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
datahub-graphql-core/src/main/resources/entity.graphql
View File

@ -9157,6 +9157,10 @@ enum PolicyMatchCondition {
Whether the field matches the value
"""
EQUALS
"""
Whether the field value starts with the value
"""
STARTS_WITH
}
"""

19
datahub-web-react/src/app/permissions/policy/PolicyDetailsModal.tsx
View File

@ -3,9 +3,14 @@ import { Link } from 'react-router-dom';
import { Button, Divider, Modal, Tag, Typography } from 'antd';
import styled from 'styled-components';
import { useEntityRegistry } from '../../useEntityRegistry';
import { Maybe, Policy, PolicyState, PolicyType } from '../../../types.generated';
import { Maybe, Policy, PolicyMatchCondition, PolicyState, PolicyType } from '../../../types.generated';
import { useAppConfig } from '../../useAppConfig';
import { convertLegacyResourceFilter, getFieldValues, mapResourceTypeToDisplayName } from './policyUtils';
import {
convertLegacyResourceFilter,
getFieldValues,
getFieldCondition,
mapResourceTypeToDisplayName,
} from './policyUtils';
import AvatarsGroup from '../AvatarsGroup';
type PrivilegeOptionType = {
@ -70,6 +75,7 @@ export default function PolicyDetailsModal({ policy, open, onClose, privileges }
const resourceTypes = getFieldValues(resources?.filter, 'TYPE') || [];
const dataPlatformInstances = getFieldValues(resources?.filter, 'DATA_PLATFORM_INSTANCE') || [];
const resourceEntities = getFieldValues(resources?.filter, 'URN') || [];
const resourceFilterCondition = getFieldCondition(resources?.filter, 'URN') || PolicyMatchCondition.Equals;
const domains = getFieldValues(resources?.filter, 'DOMAIN') || [];
const {
@ -104,6 +110,10 @@ export default function PolicyDetailsModal({ policy, open, onClose, privileges }
);
};
const getWildcardUrnTag = (criterionValue) => {
return <Typography.Text>{criterionValue.value}*</Typography.Text>;
};
const resourceOwnersField = (actors) => {
if (!actors?.resourceOwners) {
return <PoliciesTag>No</PoliciesTag>;
@ -166,7 +176,10 @@ export default function PolicyDetailsModal({ policy, open, onClose, privileges }
return (
// eslint-disable-next-line react/no-array-index-key
<PoliciesTag key={`resource-${value.value}-${key}`}>
{getEntityTag(value)}
{resourceFilterCondition &&
resourceFilterCondition === PolicyMatchCondition.StartsWith
? getWildcardUrnTag(value)
: getEntityTag(value)}
</PoliciesTag>
);
})) || <PoliciesTag>All</PoliciesTag>}

4
datahub-web-react/src/app/permissions/policy/policyUtils.ts
View File

@ -118,6 +118,10 @@ export const getFieldValues = (filter: Maybe<PolicyMatchFilter> | undefined, res
return filter?.criteria?.find((criterion) => criterion.field === resourceFieldType)?.values || [];
};
export const getFieldCondition = (filter: Maybe<PolicyMatchFilter> | undefined, resourceFieldType: string) => {
return filter?.criteria?.find((criterion) => criterion.field === resourceFieldType)?.condition || null;
};
export const getFieldValuesOfTags = (filter: Maybe<PolicyMatchFilter> | undefined, resourceFieldType: string) => {
return filter?.criteria?.find((criterion) => criterion.field === resourceFieldType)?.values || [];
};

5
metadata-models/src/main/pegasus/com/linkedin/policy/PolicyMatchCondition.pdl
View File

@ -8,4 +8,9 @@ enum PolicyMatchCondition {
* Whether the field matches the value
*/
EQUALS
/**
* Whether the field value starts with the value
*/
STARTS_WITH
}

12
metadata-service/auth-impl/src/main/java/com/datahub/authorization/PolicyEngine.java
View File

@ -252,11 +252,15 @@ public class PolicyEngine {
private boolean checkCondition(
Set<String> fieldValues, String filterValue, PolicyMatchCondition condition) {
if (condition == PolicyMatchCondition.EQUALS) {
return fieldValues.contains(filterValue);
switch (condition) {
case EQUALS:
return fieldValues.contains(filterValue);
case STARTS_WITH:
return fieldValues.stream().anyMatch(v -> v.startsWith(filterValue));
default:
log.error("Unsupported condition {}", condition);
return false;
}
log.error("Unsupported condition {}", condition);
return false;
}
/**

90
metadata-service/auth-impl/src/test/java/com/datahub/authorization/PolicyEngineTest.java
View File

@ -23,9 +23,7 @@ import com.linkedin.entity.EnvelopedAspectMap;
import com.linkedin.entity.client.EntityClient;
import com.linkedin.identity.RoleMembership;
import com.linkedin.metadata.Constants;
import com.linkedin.policy.DataHubActorFilter;
import com.linkedin.policy.DataHubPolicyInfo;
import com.linkedin.policy.DataHubResourceFilter;
import com.linkedin.policy.*;
import io.datahubproject.metadata.context.OperationContext;
import io.datahubproject.test.metadata.context.TestOperationContexts;
import java.net.URISyntaxException;
@ -1043,6 +1041,92 @@ public class PolicyEngineTest {
verify(_entityClient, times(0)).batchGetV2(any(), any(), any(), any());
}
@Test
public void testEvaluatePolicyResourceFilterResourceUrnStartsWithMatch() throws Exception {
final DataHubPolicyInfo dataHubPolicyInfo = new DataHubPolicyInfo();
dataHubPolicyInfo.setType(METADATA_POLICY_TYPE);
dataHubPolicyInfo.setState(ACTIVE_POLICY_STATE);
dataHubPolicyInfo.setPrivileges(new StringArray("EDIT_ENTITY_TAGS"));
dataHubPolicyInfo.setDisplayName("My Test Display");
dataHubPolicyInfo.setDescription("My test display!");
dataHubPolicyInfo.setEditable(true);
final DataHubActorFilter actorFilter = new DataHubActorFilter();
actorFilter.setResourceOwners(true);
actorFilter.setAllUsers(true);
actorFilter.setAllGroups(true);
dataHubPolicyInfo.setActors(actorFilter);
final DataHubResourceFilter resourceFilter = new DataHubResourceFilter();
PolicyMatchCriterion policyMatchCriterion =
FilterUtils.newCriterion(
EntityFieldType.URN,
Collections.singletonList("urn:li:dataset:te"),
PolicyMatchCondition.STARTS_WITH);
resourceFilter.setFilter(
new PolicyMatchFilter()
.setCriteria(
new PolicyMatchCriterionArray(Collections.singleton(policyMatchCriterion))));
dataHubPolicyInfo.setResources(resourceFilter);
ResolvedEntitySpec resourceSpec = buildEntityResolvers("dataset", RESOURCE_URN);
PolicyEngine.PolicyEvaluationResult result =
_policyEngine.evaluatePolicy(
systemOperationContext,
dataHubPolicyInfo,
resolvedAuthorizedUserSpec,
"EDIT_ENTITY_TAGS",
Optional.of(resourceSpec));
assertTrue(result.isGranted());
// Verify no network calls
verify(_entityClient, times(0)).batchGetV2(any(), any(), any(), any());
}
@Test
public void testEvaluatePolicyResourceFilterResourceUrnStartsWithNoMatch() throws Exception {
final DataHubPolicyInfo dataHubPolicyInfo = new DataHubPolicyInfo();
dataHubPolicyInfo.setType(METADATA_POLICY_TYPE);
dataHubPolicyInfo.setState(ACTIVE_POLICY_STATE);
dataHubPolicyInfo.setPrivileges(new StringArray("EDIT_ENTITY_TAGS"));
dataHubPolicyInfo.setDisplayName("My Test Display");
dataHubPolicyInfo.setDescription("My test display!");
dataHubPolicyInfo.setEditable(true);
final DataHubActorFilter actorFilter = new DataHubActorFilter();
actorFilter.setResourceOwners(true);
actorFilter.setAllUsers(true);
actorFilter.setAllGroups(true);
dataHubPolicyInfo.setActors(actorFilter);
final DataHubResourceFilter resourceFilter = new DataHubResourceFilter();
PolicyMatchCriterion policyMatchCriterion =
FilterUtils.newCriterion(
EntityFieldType.URN,
Collections.singletonList("urn:li:dataset:other"),
PolicyMatchCondition.STARTS_WITH);
resourceFilter.setFilter(
new PolicyMatchFilter()
.setCriteria(
new PolicyMatchCriterionArray(Collections.singleton(policyMatchCriterion))));
dataHubPolicyInfo.setResources(resourceFilter);
ResolvedEntitySpec resourceSpec = buildEntityResolvers("dataset", RESOURCE_URN);
PolicyEngine.PolicyEvaluationResult result =
_policyEngine.evaluatePolicy(
systemOperationContext,
dataHubPolicyInfo,
resolvedAuthorizedUserSpec,
"EDIT_ENTITY_TAGS",
Optional.of(resourceSpec));
assertFalse(result.isGranted());
// Verify no network calls
verify(_entityClient, times(0)).batchGetV2(any(), any(), any(), any());
}
@Test
public void testEvaluatePolicyResourceFilterSpecificResourceMatchDomain() throws Exception {
final DataHubPolicyInfo dataHubPolicyInfo = new DataHubPolicyInfo();

5
metadata-service/restli-api/src/main/snapshot/com.linkedin.entity.entities.snapshot.json
View File

@ -5478,9 +5478,10 @@
"type" : "enum",
"name" : "PolicyMatchCondition",
"doc" : "The matching condition in a filter criterion",
"symbols" : [ "EQUALS" ],
"symbols" : [ "EQUALS", "STARTS_WITH" ],
"symbolDocs" : {
"EQUALS" : "Whether the field matches the value"
"EQUALS" : "Whether the field matches the value",
"STARTS_WITH" : "Whether the field value starts with the value"
}
},
"doc" : "The condition for the criterion",

5
metadata-service/restli-api/src/main/snapshot/com.linkedin.platform.platform.snapshot.json
View File

@ -5472,9 +5472,10 @@
"type" : "enum",
"name" : "PolicyMatchCondition",
"doc" : "The matching condition in a filter criterion",
"symbols" : [ "EQUALS" ],
"symbols" : [ "EQUALS", "STARTS_WITH" ],
"symbolDocs" : {
"EQUALS" : "Whether the field matches the value"
"EQUALS" : "Whether the field matches the value",
"STARTS_WITH" : "Whether the field value starts with the value"
}
},
"doc" : "The condition for the criterion",