Skip to content

Commit 9426872

Browse files
BohuTANGBohuTANG
committed
Move privileges check from execute to access/privilege_access.rs
1 parent 837b9e7 commit 9426872

14 files changed

+124
-176
lines changed

‎src/query/service/src/interpreters/access/privilege_access.rs

Lines changed: 124 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -35,64 +35,144 @@ impl PrivilegeAccess {
3535

3636
#[async_trait::async_trait]
3737
impl AccessChecker for PrivilegeAccess {
38-
async fn check(&self, plan: &PlanNode) -> Result<()> {
39-
match plan {
40-
PlanNode::Empty(_) => {}
41-
PlanNode::Stage(_) => {}
42-
PlanNode::Broadcast(_) => {}
43-
PlanNode::Remote(_) => {}
44-
PlanNode::Projection(_) => {}
45-
PlanNode::Expression(_) => {}
46-
PlanNode::AggregatorPartial(_) => {}
47-
PlanNode::AggregatorFinal(_) => {}
48-
PlanNode::Filter(_) => {}
49-
PlanNode::Having(_) => {}
50-
PlanNode::WindowFunc(_) => {}
51-
PlanNode::Sort(_) => {}
52-
PlanNode::Limit(_) => {}
53-
PlanNode::LimitBy(_) => {}
54-
PlanNode::ReadSource(_) => {}
55-
PlanNode::SubQueryExpression(_) => {}
56-
PlanNode::Sink(_) => {}
57-
PlanNode::Explain(_) => {}
58-
PlanNode::Select(_) => {}
59-
PlanNode::Insert(_) => {}
60-
PlanNode::Delete(_) => {}
61-
}
38+
async fn check(&self, _plan: &PlanNode) -> Result<()> {
39+
// The old planner *NO* need to check anymore.
6240
Ok(())
6341
}
6442

6543
async fn check_new(&self, plan: &Plan) -> Result<()> {
44+
let session = self.ctx.get_current_session();
45+
6646
match plan {
6747
Plan::Query { .. } => {}
6848
Plan::Explain { .. } => {}
6949
Plan::Copy(_) => {}
7050
Plan::Call(_) => {}
51+
52+
// Database.
7153
Plan::ShowCreateDatabase(_) => {}
72-
Plan::CreateDatabase(_) => {}
73-
Plan::DropDatabase(_) => {}
74-
Plan::UndropDatabase(_) => {}
75-
Plan::RenameDatabase(_) => {}
54+
Plan::CreateDatabase(_) => {
55+
session
56+
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Create)
57+
.await?;
58+
}
59+
Plan::DropDatabase(_) => {
60+
session
61+
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Drop)
62+
.await?;
63+
}
64+
Plan::UndropDatabase(_) => {
65+
session
66+
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Drop)
67+
.await?;
68+
}
69+
Plan::RenameDatabase(_) => {
70+
session
71+
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Alter)
72+
.await?;
73+
}
7674
Plan::UseDatabase(_) => {}
75+
76+
// Table.
7777
Plan::ShowCreateTable(_) => {}
7878
Plan::DescribeTable(_) => {}
79-
Plan::CreateTable(_) => {}
80-
Plan::DropTable(_) => {}
81-
Plan::UndropTable(_) => {}
79+
Plan::CreateTable(plan) => {
80+
session
81+
.validate_privilege(
82+
&GrantObject::Database(plan.catalog.clone(), plan.database.clone()),
83+
UserPrivilegeType::Create,
84+
)
85+
.await?;
86+
}
87+
Plan::DropTable(plan) => {
88+
session
89+
.validate_privilege(
90+
&GrantObject::Database(plan.catalog.clone(), plan.database.clone()),
91+
UserPrivilegeType::Drop,
92+
)
93+
.await?;
94+
}
95+
Plan::UndropTable(plan) => {
96+
session
97+
.validate_privilege(
98+
&GrantObject::Database(plan.catalog.clone(), plan.database.clone()),
99+
UserPrivilegeType::Drop,
100+
)
101+
.await?;
102+
}
82103
Plan::RenameTable(_) => {}
83-
Plan::AlterTableClusterKey(_) => {}
84-
Plan::DropTableClusterKey(_) => {}
85-
Plan::ReclusterTable(_) => {}
86-
Plan::TruncateTable(_) => {}
104+
Plan::AlterTableClusterKey(plan) => {
105+
session
106+
.validate_privilege(
107+
&GrantObject::Table(
108+
plan.catalog.clone(),
109+
plan.database.clone(),
110+
plan.table.clone(),
111+
),
112+
UserPrivilegeType::Alter,
113+
)
114+
.await?;
115+
}
116+
Plan::DropTableClusterKey(plan) => {
117+
session
118+
.validate_privilege(
119+
&GrantObject::Table(
120+
plan.catalog.clone(),
121+
plan.database.clone(),
122+
plan.table.clone(),
123+
),
124+
UserPrivilegeType::Drop,
125+
)
126+
.await?;
127+
}
128+
Plan::ReclusterTable(plan) => {
129+
session
130+
.validate_privilege(
131+
&GrantObject::Table(
132+
plan.catalog.clone(),
133+
plan.database.clone(),
134+
plan.table.clone(),
135+
),
136+
UserPrivilegeType::Alter,
137+
)
138+
.await?;
139+
}
140+
Plan::TruncateTable(plan) => {
141+
session
142+
.validate_privilege(
143+
&GrantObject::Table(
144+
plan.catalog.clone(),
145+
plan.database.clone(),
146+
plan.table.clone(),
147+
),
148+
UserPrivilegeType::Delete,
149+
)
150+
.await?;
151+
}
87152
Plan::OptimizeTable(_) => {}
88153
Plan::ExistsTable(_) => {}
154+
155+
// Others.
89156
Plan::Insert(_) => {}
90157
Plan::Delete(_) => {}
91-
Plan::CreateView(_) => {}
92-
Plan::AlterView(_) => {}
158+
Plan::CreateView(plan) => {
159+
session
160+
.validate_privilege(
161+
&GrantObject::Database(plan.catalog.clone(), plan.database.clone()),
162+
UserPrivilegeType::Alter,
163+
)
164+
.await?;
165+
}
166+
Plan::AlterView(plan) => {
167+
session
168+
.validate_privilege(
169+
&GrantObject::Database(plan.catalog.clone(), plan.database.clone()),
170+
UserPrivilegeType::Alter,
171+
)
172+
.await?;
173+
}
93174
Plan::DropView(plan) => {
94-
self.ctx
95-
.get_current_session()
175+
session
96176
.validate_privilege(
97177
&GrantObject::Database(plan.catalog.clone(), plan.database.clone()),
98178
UserPrivilegeType::Drop,
@@ -118,7 +198,11 @@ impl AccessChecker for PrivilegeAccess {
118198
Plan::RemoveStage(_) => {}
119199
Plan::Presign(_) => {}
120200
Plan::SetVariable(_) => {}
121-
Plan::Kill(_) => {}
201+
Plan::Kill(_) => {
202+
session
203+
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Super)
204+
.await?;
205+
}
122206
Plan::CreateShare(_) => {}
123207
Plan::DropShare(_) => {}
124208
Plan::GrantShareObject(_) => {}

‎src/query/service/src/interpreters/interpreter_cluster_key_alter.rs

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ use std::sync::Arc;
1616

1717
use common_exception::Result;
1818
use common_legacy_planners::AlterTableClusterKeyPlan;
19-
use common_meta_types::GrantObject;
20-
use common_meta_types::UserPrivilegeType;
2119

2220
use super::Interpreter;
2321
use crate::pipelines::PipelineBuildResult;
@@ -43,18 +41,6 @@ impl Interpreter for AlterTableClusterKeyInterpreter {
4341

4442
async fn execute2(&self) -> Result<PipelineBuildResult> {
4543
let plan = &self.plan;
46-
self.ctx
47-
.get_current_session()
48-
.validate_privilege(
49-
&GrantObject::Table(
50-
plan.catalog.clone(),
51-
plan.database.clone(),
52-
plan.table.clone(),
53-
),
54-
UserPrivilegeType::Alter,
55-
)
56-
.await?;
57-
5844
let tenant = self.ctx.get_tenant();
5945
let catalog = self.ctx.get_catalog(&plan.catalog)?;
6046

‎src/query/service/src/interpreters/interpreter_cluster_key_drop.rs

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ use std::sync::Arc;
1616

1717
use common_exception::Result;
1818
use common_legacy_planners::DropTableClusterKeyPlan;
19-
use common_meta_types::GrantObject;
20-
use common_meta_types::UserPrivilegeType;
2119

2220
use super::Interpreter;
2321
use crate::pipelines::PipelineBuildResult;
@@ -43,18 +41,6 @@ impl Interpreter for DropTableClusterKeyInterpreter {
4341

4442
async fn execute2(&self) -> Result<PipelineBuildResult> {
4543
let plan = &self.plan;
46-
self.ctx
47-
.get_current_session()
48-
.validate_privilege(
49-
&GrantObject::Table(
50-
plan.catalog.clone(),
51-
plan.database.clone(),
52-
plan.table.clone(),
53-
),
54-
UserPrivilegeType::Alter,
55-
)
56-
.await?;
57-
5844
let tenant = self.ctx.get_tenant();
5945
let catalog = self.ctx.get_catalog(&plan.catalog)?;
6046

‎src/query/service/src/interpreters/interpreter_database_create.rs

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@ use std::sync::Arc;
1717
use common_exception::ErrorCode;
1818
use common_exception::Result;
1919
use common_legacy_planners::CreateDatabasePlan;
20-
use common_meta_types::GrantObject;
21-
use common_meta_types::UserPrivilegeType;
2220
use common_users::UserApiProvider;
2321

2422
use crate::interpreters::Interpreter;
@@ -46,11 +44,6 @@ impl Interpreter for CreateDatabaseInterpreter {
4644

4745
#[tracing::instrument(level = "debug", skip(self), fields(ctx.id = self.ctx.get_id().as_str()))]
4846
async fn execute2(&self) -> Result<PipelineBuildResult> {
49-
self.ctx
50-
.get_current_session()
51-
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Create)
52-
.await?;
53-
5447
let tenant = self.plan.tenant.clone();
5548
let quota_api = UserApiProvider::instance().get_tenant_quota_api_client(&tenant)?;
5649
let quota = quota_api.get_quota(None).await?.data;

‎src/query/service/src/interpreters/interpreter_database_drop.rs

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ use std::sync::Arc;
1616

1717
use common_exception::Result;
1818
use common_legacy_planners::DropDatabasePlan;
19-
use common_meta_types::GrantObject;
20-
use common_meta_types::UserPrivilegeType;
2119

2220
use crate::interpreters::Interpreter;
2321
use crate::pipelines::PipelineBuildResult;
@@ -42,11 +40,6 @@ impl Interpreter for DropDatabaseInterpreter {
4240
}
4341

4442
async fn execute2(&self) -> Result<PipelineBuildResult> {
45-
self.ctx
46-
.get_current_session()
47-
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Drop)
48-
.await?;
49-
5043
let catalog = self.ctx.get_catalog(&self.plan.catalog)?;
5144
catalog.drop_database(self.plan.clone().into()).await?;
5245

‎src/query/service/src/interpreters/interpreter_database_undrop.rs

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ use std::sync::Arc;
1616

1717
use common_exception::Result;
1818
use common_legacy_planners::UndropDatabasePlan;
19-
use common_meta_types::GrantObject;
20-
use common_meta_types::UserPrivilegeType;
2119

2220
use crate::interpreters::Interpreter;
2321
use crate::pipelines::PipelineBuildResult;
@@ -43,16 +41,6 @@ impl Interpreter for UndropDatabaseInterpreter {
4341

4442
async fn execute2(&self) -> Result<PipelineBuildResult> {
4543
let catalog_name = self.plan.catalog.as_str();
46-
let db_name = self.plan.database.as_str();
47-
48-
self.ctx
49-
.get_current_session()
50-
.validate_privilege(
51-
&GrantObject::Database(catalog_name.into(), db_name.into()),
52-
UserPrivilegeType::Drop,
53-
)
54-
.await?;
55-
5644
let catalog = self.ctx.get_catalog(catalog_name)?;
5745
catalog.undrop_database(self.plan.clone().into()).await?;
5846
Ok(PipelineBuildResult::create())

‎src/query/service/src/interpreters/interpreter_kill.rs

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@ use std::sync::Arc;
1717
use common_exception::ErrorCode;
1818
use common_exception::Result;
1919
use common_legacy_planners::KillPlan;
20-
use common_meta_types::GrantObject;
21-
use common_meta_types::UserPrivilegeType;
2220

2321
use crate::interpreters::Interpreter;
2422
use crate::pipelines::PipelineBuildResult;
@@ -61,11 +59,6 @@ impl Interpreter for KillInterpreter {
6159
}
6260

6361
async fn execute2(&self) -> Result<PipelineBuildResult> {
64-
self.ctx
65-
.get_current_session()
66-
.validate_privilege(&GrantObject::Global, UserPrivilegeType::Super)
67-
.await?;
68-
6962
let id = &self.plan.id;
7063
// If press Ctrl + C, MySQL Client will create a new session and send query
7164
// `kill query mysql_connection_id` to server.

‎src/query/service/src/interpreters/interpreter_table_create_v2.rs

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@ use common_datavalues::DataField;
1818
use common_datavalues::DataSchemaRefExt;
1919
use common_exception::ErrorCode;
2020
use common_exception::Result;
21-
use common_meta_types::GrantObject;
22-
use common_meta_types::UserPrivilegeType;
2321
use common_users::UserApiProvider;
2422

2523
use crate::interpreters::InsertInterpreterV2;
@@ -51,14 +49,6 @@ impl Interpreter for CreateTableInterpreterV2 {
5149
}
5250

5351
async fn execute2(&self) -> Result<PipelineBuildResult> {
54-
self.ctx
55-
.get_current_session()
56-
.validate_privilege(
57-
&GrantObject::Database(self.plan.catalog.clone(), self.plan.database.clone()),
58-
UserPrivilegeType::Create,
59-
)
60-
.await?;
61-
6252
let tenant = self.plan.tenant.clone();
6353
let quota_api = UserApiProvider::instance().get_tenant_quota_api_client(&tenant)?;
6454
let quota = quota_api.get_quota(None).await?.data;

‎src/query/service/src/interpreters/interpreter_table_drop.rs

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@ use common_exception::ErrorCode;
1818
use common_exception::Result;
1919
use common_legacy_planners::DropTablePlan;
2020
use common_legacy_planners::TruncateTablePlan;
21-
use common_meta_types::GrantObject;
22-
use common_meta_types::UserPrivilegeType;
2321

2422
use crate::interpreters::Interpreter;
2523
use crate::pipelines::PipelineBuildResult;
@@ -54,14 +52,6 @@ impl Interpreter for DropTableInterpreter {
5452
.await
5553
.ok();
5654

57-
self.ctx
58-
.get_current_session()
59-
.validate_privilege(
60-
&GrantObject::Database(catalog_name.into(), db_name.into()),
61-
UserPrivilegeType::Drop,
62-
)
63-
.await?;
64-
6555
if let Some(table) = &tbl {
6656
if table.get_table_info().engine() == VIEW_ENGINE {
6757
return Err(ErrorCode::UnexpectedError(format!(

0 commit comments

Comments
 (0)