Skip to content

Commit 2d24512

Browse files
chuntaojunchuntaojun
committed
feat:支持初始化管理员帐户
1 parent 853b7a9 commit 2d24512

File tree

16 files changed

+138
-62
lines changed

16 files changed

+138
-62
lines changed

‎admin/api.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,9 @@ type AdminOperateServer interface {
5555
// GetCMDBInfo get cmdb info
5656
GetCMDBInfo(ctx context.Context) ([]model.LocationView, error)
5757
// HasMainUser .
58-
HasMainUser(ctx context.Context) (*apisecurity.User, error)
58+
HasMainUser(ctx context.Context) *apiservice.Response
5959
// InitMainUser .
60-
InitMainUser(ctx context.Context, user apisecurity.User) error
60+
InitMainUser(ctx context.Context, user *apisecurity.User) *apiservice.Response
6161
// GetServerFunctions Get server functions
6262
GetServerFunctions(ctx context.Context) []authcommon.ServerFunctionGroup
6363
}

‎admin/interceptor/auth/server.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,11 @@ func (svr *Server) collectMaintainAuthContext(ctx context.Context, resourceOp au
6262
)
6363
}
6464

65-
func (s *Server) HasMainUser(ctx context.Context) (*apisecurity.User, error) {
65+
func (s *Server) HasMainUser(ctx context.Context) *apiservice.Response {
6666
return s.nextSvr.HasMainUser(ctx)
6767
}
6868

69-
func (s *Server) InitMainUser(ctx context.Context, user apisecurity.User) error {
69+
func (s *Server) InitMainUser(ctx context.Context, user *apisecurity.User) *apiservice.Response {
7070
return s.nextSvr.InitMainUser(ctx, user)
7171
}
7272

‎admin/job/clean_deleted_resource.go‎

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,47 @@ var cleanFuncMapping = map[string]func(timeout time.Duration, job *cleanDeletedR
4848
"config_file_release": cleanDeletedConfigFiles,
4949
}
5050

51+
var defaultCleanDeletedResourceConfig = CleandeletedResourceConf{
52+
Resources: []CleanDeletedResource{
53+
{
54+
Resource: "instance",
55+
Enable: true,
56+
},
57+
{
58+
Resource: "service",
59+
Enable: true,
60+
},
61+
{
62+
Resource: "clients",
63+
Enable: true,
64+
},
65+
{
66+
Resource: "circuitbreaker_rule",
67+
Enable: true,
68+
},
69+
{
70+
Resource: "ratelimit_rule",
71+
Enable: true,
72+
},
73+
{
74+
Resource: "router_rule",
75+
Enable: true,
76+
},
77+
{
78+
Resource: "faultdetect_rule",
79+
Enable: true,
80+
},
81+
{
82+
Resource: "lane_rule",
83+
Enable: true,
84+
},
85+
{
86+
Resource: "config_file_release",
87+
Enable: true,
88+
},
89+
},
90+
}
91+
5192
type CleanDeletedResource struct {
5293
// Resource 记录需要清理的资源类型
5394
Resource string `mapstructure:"resource"`
@@ -59,7 +100,7 @@ type CleanDeletedResource struct {
59100

60101
type CleandeletedResourceConf struct {
61102
// ResourceTimeout 记录资源的额外超时时间，用户可自定义
62-
Resources []CleanDeletedResource `json:"resourceTimeout"`
103+
Resources []CleanDeletedResource `json:"resources" mapstructure:"resources"`
63104
// Timeout 记录清理资源的超时时间，默认20分钟
64105
Timeout time.Duration `mapstructure:"timeout"`
65106
}
@@ -90,6 +131,16 @@ func (job *cleanDeletedResourceJob) init(raw map[string]interface{}) error {
90131
cfg.Timeout = 2 * time.Minute
91132
}
92133
job.cfg = cfg
134+
135+
if len(cfg.Resources) == 0 {
136+
job.cfg.Resources = defaultCleanDeletedResourceConfig.Resources
137+
for i := range job.cfg.Resources {
138+
if job.cfg.Resources[i].Timeout == nil {
139+
job.cfg.Resources[i].Timeout = &job.cfg.Timeout
140+
}
141+
}
142+
}
143+
93144
return nil
94145
}
95146

‎admin/maintain.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,30 +41,30 @@ import (
4141
)
4242

4343
// HasMainUser 判断是否存在主用户
44-
func (s *Server) HasMainUser(ctx context.Context) (*apisecurity.User, error) {
44+
func (s *Server) HasMainUser(ctx context.Context) *apiservice.Response {
4545
mainUser, err := s.storage.GetMainUser()
4646
if err != nil {
4747
log.Error("check hash main user", zap.Error(err), utils.RequestID(ctx))
48-
return nil, err
48+
return api.NewResponse(apimodel.Code_ExecuteException)
4949
}
5050
if mainUser == nil {
51-
return nil, nil
51+
return api.NewResponse(apimodel.Code_NotFoundResource)
5252
}
5353
ret := mainUser.ToSpec()
5454
ret.AuthToken = wrapperspb.String("")
55-
return ret, nil
55+
return api.NewUserResponse(apimodel.Code_ExecuteSuccess, ret)
5656
}
5757

5858
// InitMainUser 初始化主用户
59-
func (s *Server) InitMainUser(_ context.Context, user apisecurity.User) error {
59+
func (s *Server) InitMainUser(_ context.Context, user *apisecurity.User) *apiservice.Response {
60+
if user.GetSource().GetValue() == "" {
61+
user.Source = utils.NewStringValue("Polaris")
62+
}
6063
ctx := context.WithValue(context.Background(), authcommon.ContextKeyInitMainUser{}, true)
6164
rsp := s.userSvr.CreateUsers(ctx, []*apisecurity.User{
62-
&user,
65+
user,
6366
})
64-
if !api.IsSuccess(rsp) {
65-
return errors.New(rsp.GetInfo().GetValue())
66-
}
67-
return nil
67+
return rsp.Responses[0]
6868
}
6969

7070
func (s *Server) GetServerConnections(_ context.Context, req *admin.ConnReq) (*admin.ConnCountResp, error) {

‎apiserver/httpserver/admin_access.go‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"strconv"
2525

2626
"github.com/emicklei/go-restful/v3"
27+
"github.com/golang/protobuf/jsonpb"
2728
apimodel "github.com/polarismesh/specification/source/go/api/v1/model"
2829
"github.com/polarismesh/specification/source/go/api/v1/security"
2930
apiservice "github.com/polarismesh/specification/source/go/api/v1/service_manage"
@@ -314,12 +315,9 @@ func (h *HTTPServer) EnablePprof(req *restful.Request, rsp *restful.Response) {
314315

315316
func (h *HTTPServer) HasMainUser(req *restful.Request, rsp *restful.Response) {
316317
ctx := initContext(req)
317-
ret, err := h.maintainServer.HasMainUser(ctx)
318-
if err != nil {
319-
_ = rsp.WriteErrorString(http.StatusBadRequest, err.Error())
320-
return
321-
}
322-
_ = rsp.WriteAsJson(ret)
318+
ret := h.maintainServer.HasMainUser(ctx)
319+
marshaler := jsonpb.Marshaler{Indent: " ", EmitDefaults: true}
320+
_ = marshaler.Marshal(rsp, ret)
323321
}
324322

325323
func (h *HTTPServer) InitMainUser(req *restful.Request, rsp *restful.Response) {
@@ -335,11 +333,9 @@ func (h *HTTPServer) InitMainUser(req *restful.Request, rsp *restful.Response) {
335333
return
336334
}
337335

338-
if err := h.maintainServer.InitMainUser(ctx, *user); err != nil {
339-
_ = rsp.WriteErrorString(http.StatusBadRequest, err.Error())
340-
return
341-
}
342-
_ = rsp.WriteEntity("ok")
336+
ret := h.maintainServer.InitMainUser(ctx, user)
337+
marshaler := jsonpb.Marshaler{Indent: " ", EmitDefaults: true}
338+
_ = marshaler.Marshal(rsp, ret)
343339
}
344340

345341
// GetServerFunctions .

‎auth/policy/auth_checker.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,10 @@ func (d *DefaultAuthChecker) CheckConsolePermission(preCtx *authcommon.AcquireCo
140140
if d.IsOpenConsoleAuth() && !d.conf.ConsoleStrict {
141141
preCtx.SetAllowAnonymous(true)
142142
}
143+
// 如果是初始化主用户的请求，直接放行
144+
if authcommon.IsInitMainUser(preCtx.GetRequestContext()) {
145+
return true, nil
146+
}
143147
return d.CheckPermission(preCtx)
144148
}
145149

‎auth/policy/helper.go‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ func mainUserPrincipalPolicy(p authcommon.Principal) *authcommon.StrategyDetail
8383
Name: authcommon.BuildDefaultStrategyName(p.PrincipalType, p.Name),
8484
Action: apisecurity.AuthAction_ALLOW.String(),
8585
Default: true,
86-
Owner: p.Owner,
86+
Owner: p.PrincipalID,
8787
Revision: utils.NewUUID(),
8888
Source: "Polaris",
8989
Resources: resources,
@@ -114,14 +114,16 @@ func defaultReadWritePolicy(p authcommon.Principal) *authcommon.StrategyDetail {
114114
Name: "全局读写策略",
115115
Action: apisecurity.AuthAction_ALLOW.String(),
116116
Default: true,
117-
Owner: p.Owner,
117+
Owner: p.PrincipalID,
118118
Revision: utils.NewUUID(),
119119
Source: "Polaris",
120120
Resources: resources,
121-
Principals: []authcommon.Principal{p},
122121
CalleeMethods: calleeMethods,
123122
Valid: true,
124123
Comment: "global resources read and write",
124+
Metadata: map[string]string{
125+
authcommon.MetadKeySystemDefaultPolicy: "true",
126+
},
125127
}
126128
}
127129

@@ -149,14 +151,16 @@ func defaultReadOnlyPolicy(p authcommon.Principal) *authcommon.StrategyDetail {
149151
Name: "全局只读策略",
150152
Action: apisecurity.AuthAction_ALLOW.String(),
151153
Default: true,
152-
Owner: p.Owner,
154+
Owner: p.PrincipalID,
153155
Revision: utils.NewUUID(),
154156
Source: "Polaris",
155157
Resources: resources,
156-
Principals: []authcommon.Principal{p},
157158
CalleeMethods: calleeMethods,
158159
Valid: true,
159160
Comment: "global resources read only policy rule",
161+
Metadata: map[string]string{
162+
authcommon.MetadKeySystemDefaultPolicy: "true",
163+
},
160164
}
161165
}
162166

‎auth/policy/strategy.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,11 @@ func (svr *Server) GetStrategies(ctx context.Context, filters map[string]string)
194194
// 透传兼容模式信息数据
195195
ctx = context.WithValue(ctx, model.ContextKeyCompatible{}, svr.options.Compatible)
196196

197+
// 这里需要框定大体的数据查询范围
198+
if authcommon.ParseUserRole(ctx) != authcommon.AdminUserRole {
199+
filters["owner"] = utils.ParseOwnerID(ctx)
200+
}
201+
197202
total, strategies, err := svr.cacheMgr.AuthStrategy().Query(ctx, cachetypes.PolicySearchArgs{
198203
Filters: filters,
199204
Offset: offset,

‎auth/user/user.go‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -62,19 +62,10 @@ func (svr *Server) CreateUser(ctx context.Context, req *apisecurity.User) *apise
6262
ownerID := utils.ParseOwnerID(ctx)
6363
req.Owner = utils.NewStringValue(ownerID)
6464

65-
if checkErrResp := checkCreateUser(req); checkErrResp != nil {
65+
if checkErrResp := checkCreateUser(ctx, req); checkErrResp != nil {
6666
return checkErrResp
6767
}
6868

69-
// 如果创建的目标账户类型是非子账户，则 ownerId 需要设置为 “”
70-
if convertCreateUserRole(authcommon.ParseUserRole(ctx)) != authcommon.SubAccountUserRole {
71-
// 如果创建的不是子帐户，需要判断是否来自内部的 InitMainUser 请求
72-
if !authcommon.IsInitMainUser(ctx) {
73-
log.Error("[auth][user] can't create user which role is not sub-account", utils.RequestID(ctx))
74-
return api.NewUserResponse(apimodel.Code_OperationRoleForbidden, req)
75-
}
76-
}
77-
7869
if ownerID != "" {
7970
owner, err := svr.storage.GetUser(ownerID)
8071
if err != nil {
@@ -579,7 +570,7 @@ func userRecordEntry(ctx context.Context, req *apisecurity.User, md *authcommon.
579570
}
580571

581572
// checkCreateUser 检查创建用户的请求
582-
func checkCreateUser(req *apisecurity.User) *apiservice.Response {
573+
func checkCreateUser(ctx context.Context, req *apisecurity.User) *apiservice.Response {
583574
if req == nil {
584575
return api.NewUserResponse(apimodel.Code_EmptyRequest, req)
585576
}
@@ -592,8 +583,15 @@ func checkCreateUser(req *apisecurity.User) *apiservice.Response {
592583
return api.NewUserResponse(apimodel.Code_InvalidUserPassword, req)
593584
}
594585

595-
if err := CheckOwner(req.Owner); err != nil {
596-
return api.NewUserResponse(apimodel.Code_InvalidUserOwners, req)
586+
if !authcommon.IsInitMainUser(ctx) {
587+
if err := CheckOwner(req.Owner); err != nil {
588+
return api.NewUserResponse(apimodel.Code_InvalidUserOwners, req)
589+
}
590+
// 如果创建的目标账户类型是非子账户，则 ownerId 需要设置为 “”
591+
if convertCreateUserRole(authcommon.ParseUserRole(ctx)) != authcommon.SubAccountUserRole {
592+
log.Error("[auth][user] can't create user which role is not sub-account", utils.RequestID(ctx))
593+
return api.NewUserResponse(apimodel.Code_OperationRoleForbidden, req)
594+
}
597595
}
598596
return nil
599597
}

‎common/model/auth/const.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ import (
2121
apisecurity "github.com/polarismesh/specification/source/go/api/v1/security"
2222
)
2323

24+
const (
25+
MetadKeySystemDefaultPolicy = "internal-polaris-system-policy"
26+
)
27+
2428
type ServerFunctionName string
2529

2630
// SDK 接口

0 commit comments

Comments
 (0)