From 552a43346695fb4d32245c00f7762d828e545402 Mon Sep 17 00:00:00 2001 From: Vyom Mani Tiwari Date: Thu, 22 Oct 2026 13:44:18 +0530 Subject: [PATCH 1/3] RANGER-5851: Admin: persist constraintDefs of service definitions --- .../plugin/errors/ValidationErrorCode.java | 7 + .../validation/RangerServiceDefValidator.java | 270 +++++++++++++++++- .../TestRangerServiceDefValidator.java | 160 +++++++++++ .../current/ranger_core_db_mysql.sql | 28 ++ .../patches/079-add-x_constraint_def.sql | 54 ++++ .../current/ranger_core_db_oracle.sql | 30 ++ .../patches/079-add-x_constraint_def.sql | 62 ++++ .../current/ranger_core_db_postgres.sql | 30 ++ .../patches/079-add-x_constraint_def.sql | 41 +++ .../current/ranger_core_db_sqlanywhere.sql | 33 +++ .../patches/079-add-x_constraint_def.sql | 48 ++++ .../current/ranger_core_db_sqlserver.sql | 47 +++ .../patches/079-add-x_constraint_def.sql | 71 +++++ .../org/apache/ranger/biz/ServiceDBStore.java | 92 +++++- .../ranger/db/RangerDaoManagerBase.java | 4 + .../apache/ranger/db/XXConstraintDefDao.java | 63 ++++ .../apache/ranger/entity/XXConstraintDef.java | 230 +++++++++++++++ .../service/RangerServiceDefServiceBase.java | 92 ++++++ .../ranger/service/XPortalUserService.java | 2 + .../resources/META-INF/jpa_named_queries.xml | 9 + .../main/resources/META-INF/persistence.xml | 1 + .../apache/ranger/biz/TestServiceDBStore.java | 227 ++++++++++++++- .../service/TestRangerServiceDefService.java | 71 +++++ .../TestRangerServiceDefServiceBase.java | 117 ++++++++ .../service/TestXPortalUserService.java | 3 + 25 files changed, 1785 insertions(+), 7 deletions(-) create mode 100644 security-admin/db/mysql/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/oracle/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/postgres/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/src/main/java/org/apache/ranger/db/XXConstraintDefDao.java create mode 100644 security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java b/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java index 83cae22d894..976dc794460 100644 --- a/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java +++ b/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java @@ -67,6 +67,13 @@ public enum ValidationErrorCode { SERVICE_DEF_VALIDATION_ERR_INVALID_SERVICE_RESOURCE_LEVELS(2021, "Resource-def levels are not in increasing order in an hierarchy"), SERVICE_DEF_VALIDATION_ERR_NOT_LOWERCASE_NAME(2022, "{0}:[{1}] Invalid resource name. Resource name should consist of only lowercase, hyphen or underscore characters"), SERVICE_DEF_VALIDATION_ERR_INVALID_MANADORY_VALUE_FOR_SERVICE_RESOURCE(2023, "{0} cannot be mandatory because {1}(parent) is not mandatory"), + SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_UNKNOWN_RESOURCE(2026, "resource[{0}] of constraint def[{1}] is not defined on the service def"), + SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_MISSING_ANCESTOR(2027, "constraint def[{0}] lists resource[{1}] without ancestor[{2}]"), + SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_UNKNOWN_ACCESS_TYPE(2028, "access type[{0}] of constraint def[{1}] is not defined on the service def"), + SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_MISSING_TYPE(2029, "type of constraint def[{0}] parameter[{1}] was null/empty"), + SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_INVALID_TYPE(2030, "type[{0}] of constraint def[{1}] parameter[{2}] is not among valid types: {3}"), + SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_UNKNOWN_ENUM(2031, "subtype[{0}] of constraint def[{1}] parameter[{2}] was not among defined enums[{3}]"), + SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_SUBTYPE_NOT_EMPTY(2032, "subtype[{0}] of constraint def[{1}] parameter[{2}] must be empty when type is [{3}]"), // POLICY VALIDATION POLICY_VALIDATION_ERR_UNSUPPORTED_ACTION(3001, "Internal error: method signature isValid(Long) is only supported for DELETE"), diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java index 1f0c99d29f3..0a40b7e9d1b 100644 --- a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java +++ b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java @@ -27,6 +27,8 @@ import org.apache.ranger.plugin.model.RangerPolicy; import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintParamDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerDataMaskTypeDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumElementDef; @@ -50,7 +52,8 @@ public class RangerServiceDefValidator extends RangerValidator { private static final Logger LOG = LoggerFactory.getLogger(RangerServiceDefValidator.class); - private static final Set VALID_CONFIG_TYPES = ImmutableSet.of("bool", "enum", "int", "string", "password", "path"); + private static final Set VALID_CONFIG_TYPES = ImmutableSet.of("bool", "enum", "int", "string", "password", "path"); + private static final Set VALID_CONSTRAINT_PARAM_TYPES = ImmutableSet.of("string", "int", "bool", "enum", "user", "group", "role"); public RangerServiceDefValidator(ServiceStore store) { super(store); @@ -220,6 +223,7 @@ boolean isValid(final RangerServiceDef serviceDef, final Action action, final Li } valid = isValidPolicyConditions(serviceDef.getId(), serviceDef.getPolicyConditions(), failures, action) && valid; + valid = isValidConstraintDefs(serviceDef, failures) && valid; valid = isValidDataMaskTypes(serviceDef.getId(), serviceDef.getDataMaskDef().getMaskTypes(), failures, action) && valid; } @@ -532,6 +536,270 @@ boolean isValidPolicyConditions(Long serviceDefId, List failures) { + LOG.debug("==> RangerServiceDefValidator.isValidConstraintDefs({}, {})", serviceDef, failures); + + boolean valid = true; + + if (serviceDef == null || CollectionUtils.isEmpty(serviceDef.getConstraintDefs())) { + LOG.debug("constraint def collection was null/empty. Ok."); + } else { + Map resourceDefs = resourceDefMap(serviceDef.getResources()); + Set accessTypes = accessTypeNames(serviceDef.getAccessTypes()); + Map enumDefs = getEnumDefMap(serviceDef.getEnums()); + Set ids = new HashSet<>(); + Set names = new HashSet<>(); + + for (RangerConstraintDef constraintDef : serviceDef.getConstraintDefs()) { + if (constraintDef == null) { + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def") + .isMissing() + .becauseOf("constraint def was null") + .build()); + + valid = false; + + continue; + } + + String constraintName = constraintDef.getName(); + + valid = isUnique(constraintDef.getItemId(), ids, "constraint def itemId", "constraint defs", failures) && valid; + valid = isUnique(constraintName, names, "constraint def name", "constraint defs", failures) && valid; + valid = isValidConstraintResources(constraintDef, resourceDefs, failures) && valid; + valid = isValidConstraintAccessTypes(constraintDef, accessTypes, failures) && valid; + valid = isValidConstraintParams(constraintDef, enumDefs, failures) && valid; + } + } + + LOG.debug("<== RangerServiceDefValidator.isValidConstraintDefs({}, {}): {}", serviceDef, failures, valid); + + return valid; + } + + private boolean isValidConstraintResources(RangerConstraintDef constraintDef, Map resourceDefs, List failures) { + boolean valid = true; + List resources = constraintDef.getResources(); + String constraintName = constraintDef.getName(); + + if (CollectionUtils.isEmpty(resources)) { + return true; + } + + Set listed = new HashSet<>(); + + for (String resourceName : resources) { + if (StringUtils.isNotBlank(resourceName)) { + listed.add(resourceName); + } + } + + for (String resourceName : resources) { + if (StringUtils.isBlank(resourceName) || !resourceDefs.containsKey(resourceName)) { + ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_UNKNOWN_RESOURCE; + + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def resource") + .subField(StringUtils.isBlank(resourceName) ? constraintName : resourceName) + .isSemanticallyIncorrect() + .errorCode(error.getErrorCode()) + .becauseOf(error.getMessage(resourceName, constraintName)) + .build()); + + valid = false; + + continue; + } + + if (!hasConstraintAncestors(resourceName, listed, resourceDefs, constraintName, failures)) { + valid = false; + } + } + + return valid; + } + + private boolean hasConstraintAncestors(String resourceName, Set listed, Map resourceDefs, String constraintName, List failures) { + Set seen = new HashSet<>(); + RangerResourceDef resourceDef = resourceDefs.get(resourceName); + String parent = resourceDef == null ? null : resourceDef.getParent(); + + seen.add(resourceName); + + while (StringUtils.isNotBlank(parent)) { + if (!seen.add(parent)) { + break; + } + + if (!listed.contains(parent)) { + ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_MISSING_ANCESTOR; + + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def ancestor") + .subField(resourceName) + .isSemanticallyIncorrect() + .errorCode(error.getErrorCode()) + .becauseOf(error.getMessage(constraintName, resourceName, parent)) + .build()); + + return false; + } + + RangerResourceDef parentDef = resourceDefs.get(parent); + + parent = parentDef == null ? null : parentDef.getParent(); + } + + return true; + } + + private boolean isValidConstraintAccessTypes(RangerConstraintDef constraintDef, Set accessTypes, List failures) { + boolean valid = true; + List constraintAccessTypes = constraintDef.getAccessTypes(); + + if (CollectionUtils.isEmpty(constraintAccessTypes)) { + return true; + } + + String constraintName = constraintDef.getName(); + + for (String accessType : constraintAccessTypes) { + if (StringUtils.isBlank(accessType) || !accessTypes.contains(accessType)) { + ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_UNKNOWN_ACCESS_TYPE; + + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def access type") + .subField(StringUtils.isBlank(accessType) ? constraintName : accessType) + .isSemanticallyIncorrect() + .errorCode(error.getErrorCode()) + .becauseOf(error.getMessage(accessType, constraintName)) + .build()); + + valid = false; + } + } + + return valid; + } + + private boolean isValidConstraintParams(RangerConstraintDef constraintDef, Map enumDefs, List failures) { + boolean valid = true; + List parameters = constraintDef.getParameters(); + String constraintName = constraintDef.getName(); + + if (CollectionUtils.isEmpty(parameters)) { + return true; + } + + Set paramNames = new HashSet<>(); + + for (RangerConstraintParamDef parameter : parameters) { + if (parameter == null) { + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def parameter") + .subField(constraintName) + .isMissing() + .becauseOf("constraint def parameter was null") + .build()); + + valid = false; + + continue; + } + + String paramName = parameter.getName(); + + valid = isUnique(paramName, constraintName, paramNames, "constraint def parameter name", "constraint def parameters", failures) && valid; + + String type = parameter.getType(); + + if (StringUtils.isBlank(type)) { + ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_MISSING_TYPE; + + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def parameter type") + .subField(paramName) + .isMissing() + .errorCode(error.getErrorCode()) + .becauseOf(error.getMessage(constraintName, paramName)) + .build()); + + valid = false; + } else if (!VALID_CONSTRAINT_PARAM_TYPES.contains(type)) { + ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_INVALID_TYPE; + + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def parameter type") + .subField(paramName) + .isSemanticallyIncorrect() + .errorCode(error.getErrorCode()) + .becauseOf(error.getMessage(type, constraintName, paramName, VALID_CONSTRAINT_PARAM_TYPES)) + .build()); + + valid = false; + } else if ("enum".equals(type)) { + String subType = parameter.getSubType(); + + if (StringUtils.isBlank(subType) || !enumDefs.containsKey(subType)) { + ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_UNKNOWN_ENUM; + + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def parameter subtype") + .subField(paramName) + .isSemanticallyIncorrect() + .errorCode(error.getErrorCode()) + .becauseOf(error.getMessage(subType, constraintName, paramName, enumDefs.keySet())) + .build()); + + valid = false; + } + } else if (StringUtils.isNotBlank(parameter.getSubType())) { + ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_SUBTYPE_NOT_EMPTY; + + failures.add(new ValidationFailureDetailsBuilder() + .field("constraint def parameter subtype") + .subField(paramName) + .isSemanticallyIncorrect() + .errorCode(error.getErrorCode()) + .becauseOf(error.getMessage(parameter.getSubType(), constraintName, paramName, type)) + .build()); + + valid = false; + } + } + + return valid; + } + + private Map resourceDefMap(List resources) { + Map resourceDefs = new HashMap<>(); + + if (resources != null) { + for (RangerResourceDef resourceDef : resources) { + if (resourceDef != null && StringUtils.isNotBlank(resourceDef.getName())) { + resourceDefs.put(resourceDef.getName(), resourceDef); + } + } + } + + return resourceDefs; + } + + private Set accessTypeNames(List accessTypeDefs) { + Set accessTypes = new HashSet<>(); + + if (accessTypeDefs != null) { + for (RangerAccessTypeDef accessTypeDef : accessTypeDefs) { + if (accessTypeDef != null && StringUtils.isNotBlank(accessTypeDef.getName())) { + accessTypes.add(accessTypeDef.getName()); + } + } + } + + return accessTypes; + } + boolean isValidConfigs(List configs, List enumDefs, List failures) { LOG.debug("==> RangerServiceDefValidator.isValidConfigs({}, {}, {})", configs, enumDefs, failures); diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java b/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java index a178f3174d2..10098b85305 100644 --- a/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java +++ b/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java @@ -19,8 +19,11 @@ package org.apache.ranger.plugin.model.validation; +import org.apache.ranger.plugin.errors.ValidationErrorCode; import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintParamDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumElementDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerPolicyConditionDef; @@ -32,11 +35,14 @@ import org.junit.jupiter.api.Test; import java.util.ArrayList; +import java.util.Arrays; +import java.util.Collections; import java.util.Date; import java.util.List; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.junit.jupiter.api.Assertions.fail; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; @@ -662,4 +668,158 @@ public final void test_isValidConfigs_enumTypeBranches() { assertFalse(validator.isValidConfigs(configs, enumDefs, failures)); utils.checkFailureForSemanticError(failures, "config def subtype", "enumCfg"); } + + @Test + public final void test_isValidConstraintDefs() { + assertTrue(validator.isValidConstraintDefs(new RangerServiceDef(), failures)); + assertTrue(failures.isEmpty()); + + RangerServiceDef def = constraintServiceDef(); + RangerConstraintDef valid = constraintDef(1L, "requireApproval", Arrays.asList("database", "udf"), Arrays.asList("execute")); + List validParams = new ArrayList<>(); + validParams.add(param("approver", "user", null, true)); + validParams.add(param("approverGroup", "group", null, false)); + validParams.add(param("approverRole", "role", null, false)); + validParams.add(param("mode", "enum", "authType", false)); + valid.setParameters(validParams); + def.setConstraintDefs(Collections.singletonList(valid)); + assertTrue(validator.isValidConstraintDefs(def, failures)); + assertTrue(failures.isEmpty()); + + RangerConstraintDef emptyResources = constraintDef(1L, "requireApproval", new ArrayList<>(), Arrays.asList("execute")); + emptyResources.setParameters(Collections.singletonList(param("approver", "user", null, true))); + def.setConstraintDefs(Collections.singletonList(emptyResources)); + assertTrue(validator.isValidConstraintDefs(def, failures)); + assertTrue(failures.isEmpty()); + + assertFalse(validator.isValidConfigType("user", "approver", failures)); + utils.checkFailureForSemanticError(failures, "config def type", "approver"); + failures.clear(); + assertFalse(validator.isValidConfigType("group", "approverGroup", failures)); + utils.checkFailureForSemanticError(failures, "config def type", "approverGroup"); + failures.clear(); + assertFalse(validator.isValidConfigType("role", "approverRole", failures)); + utils.checkFailureForSemanticError(failures, "config def type", "approverRole"); + } + + @Test + public final void test_isValid_rejectsInvalidConstraintDef() { + RangerServiceDef def = constraintServiceDef(); + def.setName("agent"); + def.setDisplayName("Agent"); + def.setConstraintDefs(Collections.singletonList(constraintDef(1L, "requireApproval", Arrays.asList("missing"), Arrays.asList("select")))); + + assertFalse(validator.isValid(def, Action.CREATE, failures)); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_UNKNOWN_RESOURCE.getErrorCode()); + } + + @Test + public final void test_isValidConstraintDefs_failures() { + RangerServiceDef def = constraintServiceDef(); + List constraintDefs = new ArrayList<>(); + constraintDefs.add(null); + + RangerConstraintDef missingAncestor = constraintDef(1L, "maxRows", Arrays.asList("udf"), Arrays.asList("select")); + missingAncestor.setParameters(Collections.singletonList(param("rowCount", "int", null, true))); + constraintDefs.add(missingAncestor); + + RangerConstraintDef invalid = constraintDef(1L, " ", Arrays.asList("missing", ""), Arrays.asList("drop", " ")); + List params = new ArrayList<>(); + params.add(param("rowCount", "password", null, true)); + params.add(param("rowCount", "int", null, false)); + params.add(null); + params.add(param("mode", "enum", "no-such-enum", false)); + params.add(param("kind", "enum", " ", false)); + params.add(param("approver", "user", "authType", true)); + params.add(param("limit", null, null, false)); + invalid.setParameters(params); + constraintDefs.add(invalid); + + RangerConstraintDef duplicateName = constraintDef(2L, "maxRows", Arrays.asList("database", "table"), Arrays.asList("select")); + duplicateName.setParameters(Collections.singletonList(param("rowCount", "int", null, true))); + constraintDefs.add(duplicateName); + + def.setConstraintDefs(constraintDefs); + assertFalse(validator.isValidConstraintDefs(def, failures)); + utils.checkFailureForMissingValue(failures, "constraint def"); + utils.checkFailureForMissingValue(failures, "constraint def name"); + utils.checkFailureForSemanticError(failures, "constraint def itemId", "1"); + utils.checkFailureForSemanticError(failures, "constraint def name", "maxRows"); + utils.checkFailureForSemanticError(failures, "constraint def ancestor", "udf"); + utils.checkFailureForSemanticError(failures, "constraint def resource", "missing"); + utils.checkFailureForSemanticError(failures, "constraint def access type", "drop"); + utils.checkFailureForSemanticError(failures, "constraint def parameter type", "rowCount"); + utils.checkFailureForSemanticError(failures, "constraint def parameter name", "rowCount"); + utils.checkFailureForMissingValue(failures, "constraint def parameter"); + utils.checkFailureForSemanticError(failures, "constraint def parameter subtype", "mode"); + utils.checkFailureForSemanticError(failures, "constraint def parameter subtype", "kind"); + utils.checkFailureForSemanticError(failures, "constraint def parameter subtype", "approver"); + utils.checkFailureForMissingValue(failures, "constraint def parameter type", "limit"); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_UNKNOWN_RESOURCE.getErrorCode()); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_MISSING_ANCESTOR.getErrorCode()); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_UNKNOWN_ACCESS_TYPE.getErrorCode()); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_MISSING_TYPE.getErrorCode()); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_INVALID_TYPE.getErrorCode()); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_UNKNOWN_ENUM.getErrorCode()); + assertHasErrorCode(ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_CONSTRAINT_PARAM_SUBTYPE_NOT_EMPTY.getErrorCode()); + } + + private void assertHasErrorCode(int errorCode) { + for (ValidationFailureDetails failure : failures) { + if (failure.errorCode == errorCode) { + return; + } + } + + fail("expected error code " + errorCode + " in " + failures); + } + + private RangerServiceDef constraintServiceDef() { + RangerServiceDef def = new RangerServiceDef(); + def.setResources(utils.createResourceDefs(new Object[][] { + {"database", Boolean.FALSE, Boolean.FALSE, Boolean.TRUE, null, null, 10}, + {"table", Boolean.FALSE, Boolean.FALSE, Boolean.FALSE, null, "database", 20}, + {"udf", Boolean.FALSE, Boolean.FALSE, Boolean.FALSE, null, "database", 20}, + {"column", Boolean.FALSE, Boolean.FALSE, Boolean.FALSE, null, "table", 30} + })); + + RangerAccessTypeDef select = new RangerAccessTypeDef(); + select.setName("select"); + RangerAccessTypeDef execute = new RangerAccessTypeDef(); + execute.setName("execute"); + List accessTypes = new ArrayList<>(); + accessTypes.add(select); + accessTypes.add(execute); + def.setAccessTypes(accessTypes); + + RangerEnumDef enumDef = new RangerEnumDef(); + enumDef.setName("authType"); + List enums = new ArrayList<>(); + enums.add(enumDef); + def.setEnums(enums); + + return def; + } + + private RangerConstraintDef constraintDef(Long itemId, String name, List resources, List accessTypes) { + RangerConstraintDef constraintDef = new RangerConstraintDef(); + + constraintDef.setItemId(itemId); + constraintDef.setName(name); + constraintDef.setResources(resources); + constraintDef.setAccessTypes(accessTypes); + + return constraintDef; + } + + private RangerConstraintParamDef param(String name, String type, String subType, boolean mandatory) { + RangerConstraintParamDef paramDef = new RangerConstraintParamDef(); + + paramDef.setName(name); + paramDef.setType(type); + paramDef.setSubType(subType); + paramDef.setMandatory(mandatory); + + return paramDef; + } } diff --git a/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql b/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql index 8ecc59f4aa4..60d25a77726 100644 --- a/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql +++ b/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql @@ -59,6 +59,7 @@ DROP TABLE IF EXISTS `x_service_config_map`; DROP TABLE IF EXISTS `x_enum_element_def`; DROP TABLE IF EXISTS `x_enum_def`; DROP TABLE IF EXISTS `x_context_enricher_def`; +DROP TABLE IF EXISTS `x_constraint_def`; DROP TABLE IF EXISTS `x_policy_condition_def`; DROP TABLE IF EXISTS `x_access_type_def_grants`; DROP TABLE IF EXISTS `x_access_type_def`; @@ -827,6 +828,31 @@ CONSTRAINT `x_policy_condition_def_FK_added_by_id` FOREIGN KEY (`added_by_id`) R CONSTRAINT `x_policy_condition_def_FK_upd_by_id` FOREIGN KEY (`upd_by_id`) REFERENCES `x_portal_user` (`id`) )ROW_FORMAT=DYNAMIC; +CREATE TABLE `x_constraint_def` ( +`id` bigint(20) NOT NULL AUTO_INCREMENT , +`guid` varchar(1024) DEFAULT NULL, +`create_time` datetime DEFAULT NULL, +`update_time` datetime DEFAULT NULL, +`added_by_id` bigint(20) DEFAULT NULL, +`upd_by_id` bigint(20) DEFAULT NULL, +`def_id` bigint(20) NOT NULL, +`item_id` bigint(20) NOT NULL, +`name` varchar(1024) DEFAULT NULL, +`label` varchar(1024) DEFAULT NULL, +`description` varchar(1024) DEFAULT NULL, +`rb_key_label` varchar(1024) DEFAULT NULL, +`rb_key_description` varchar(1024) DEFAULT NULL, +`resources` mediumtext DEFAULT NULL, +`access_types` mediumtext DEFAULT NULL, +`parameters` mediumtext DEFAULT NULL, +`options` mediumtext DEFAULT NULL, +`sort_order` int DEFAULT 0, +primary key (`id`) , +CONSTRAINT `x_constraint_def_FK_defid` FOREIGN KEY (`def_id`) REFERENCES `x_service_def` (`id`), +CONSTRAINT `x_constraint_def_FK_added_by_id` FOREIGN KEY (`added_by_id`) REFERENCES `x_portal_user` (`id`), +CONSTRAINT `x_constraint_def_FK_upd_by_id` FOREIGN KEY (`upd_by_id`) REFERENCES `x_portal_user` (`id`) +)ROW_FORMAT=DYNAMIC; + CREATE TABLE `x_context_enricher_def` ( `id` bigint(20) NOT NULL AUTO_INCREMENT , `guid` varchar(1024) DEFAULT NULL, @@ -1504,6 +1530,7 @@ CREATE INDEX x_resource_def_IDX_def_id ON x_resource_def(def_id); CREATE INDEX x_access_type_def_IDX_def_id ON x_access_type_def(def_id); CREATE INDEX x_access_type_def_IDX_grants_atd_id ON x_access_type_def_grants(atd_id); CREATE INDEX x_context_enricher_def_IDX_def_id ON x_context_enricher_def(def_id); +CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); CREATE INDEX x_enum_def_IDX_def_id ON x_enum_def(def_id); CREATE INDEX x_enum_element_def_IDX_enum_def_id ON x_enum_element_def(enum_def_id); CREATE INDEX x_service_config_map_IDX_service ON x_service_config_map(service); @@ -1975,6 +2002,7 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('076',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('077',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('078',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('079',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('DB_PATCHES',UTC_TIMESTAMP(),'Ranger 1.0.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10001',UTC_TIMESTAMP(),'Ranger 1.0.0',UTC_TIMESTAMP(),'localhost','Y'); diff --git a/security-admin/db/mysql/patches/079-add-x_constraint_def.sql b/security-admin/db/mysql/patches/079-add-x_constraint_def.sql new file mode 100644 index 00000000000..392f68ad387 --- /dev/null +++ b/security-admin/db/mysql/patches/079-add-x_constraint_def.sql @@ -0,0 +1,54 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +CREATE TABLE IF NOT EXISTS `x_constraint_def` ( +`id` bigint(20) NOT NULL AUTO_INCREMENT, +`guid` varchar(1024) DEFAULT NULL, +`create_time` datetime DEFAULT NULL, +`update_time` datetime DEFAULT NULL, +`added_by_id` bigint(20) DEFAULT NULL, +`upd_by_id` bigint(20) DEFAULT NULL, +`def_id` bigint(20) NOT NULL, +`item_id` bigint(20) NOT NULL, +`name` varchar(1024) DEFAULT NULL, +`label` varchar(1024) DEFAULT NULL, +`description` varchar(1024) DEFAULT NULL, +`rb_key_label` varchar(1024) DEFAULT NULL, +`rb_key_description` varchar(1024) DEFAULT NULL, +`resources` mediumtext DEFAULT NULL, +`access_types` mediumtext DEFAULT NULL, +`parameters` mediumtext DEFAULT NULL, +`options` mediumtext DEFAULT NULL, +`sort_order` int DEFAULT 0, +primary key (`id`), +CONSTRAINT `x_constraint_def_FK_defid` FOREIGN KEY (`def_id`) REFERENCES `x_service_def` (`id`), +CONSTRAINT `x_constraint_def_FK_added_by_id` FOREIGN KEY (`added_by_id`) REFERENCES `x_portal_user` (`id`), +CONSTRAINT `x_constraint_def_FK_upd_by_id` FOREIGN KEY (`upd_by_id`) REFERENCES `x_portal_user` (`id`) +)ROW_FORMAT=DYNAMIC; + +drop procedure if exists create_index_x_constraint_def; + +delimiter ;; +create procedure create_index_x_constraint_def() begin +if exists (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=DATABASE() AND table_name='x_constraint_def') then + if not exists (SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE table_schema=DATABASE() AND table_name='x_constraint_def' AND index_name='x_constraint_def_IDX_def_id') then + CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); + end if; +end if; +end;; + +delimiter ; +call create_index_x_constraint_def(); +drop procedure if exists create_index_x_constraint_def; diff --git a/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql b/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql index ddca10bb5d5..6e5e09c162e 100644 --- a/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql +++ b/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql @@ -58,6 +58,7 @@ call spdropsequence('X_ENUM_ELEMENT_DEF_SEQ'); call spdropsequence('X_RESOURCE_DEF_SEQ'); call spdropsequence('X_ACCESS_TYPE_DEF_SEQ'); call spdropsequence('X_ACCESS_TYPE_DEF_GRANTS_SEQ'); +call spdropsequence('X_CONSTRAINT_DEF_SEQ'); call spdropsequence('X_POLICY_CONDITION_DEF_SEQ'); call spdropsequence('X_ENUM_DEF_SEQ'); call spdropsequence('X_SERVICE_CONFIG_MAP_SEQ'); @@ -139,6 +140,7 @@ CREATE SEQUENCE X_RESOURCE_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ACCESS_TYPE_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ACCESS_TYPE_DEF_GRANTS_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_POLICY_CONDITION_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; +CREATE SEQUENCE X_CONSTRAINT_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ENUM_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ENUM_ELEMENT_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_SERVICE_CONFIG_MAP_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; @@ -270,6 +272,7 @@ call spdroptable('x_service_config_map'); call spdroptable('x_enum_element_def'); call spdroptable('x_enum_def'); call spdroptable('x_context_enricher_def'); +call spdroptable('x_constraint_def'); call spdroptable('x_policy_condition_def'); call spdroptable('x_access_type_def_grants'); call spdroptable('x_access_type_def'); @@ -949,6 +952,31 @@ CONSTRAINT x_policy_cond_def_FK_added_by FOREIGN KEY (added_by_id) REFERENCES x_ CONSTRAINT x_policy_cond_def_FK_upd_by FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id) ); +CREATE TABLE x_constraint_def ( +id NUMBER(20) NOT NULL, +guid VARCHAR(1024) DEFAULT NULL NULL, +create_time DATE DEFAULT NULL NULL, +update_time DATE DEFAULT NULL NULL, +added_by_id NUMBER(20) DEFAULT NULL NULL, +upd_by_id NUMBER(20) DEFAULT NULL NULL, +def_id NUMBER(20) NOT NULL, +item_id NUMBER(20) NOT NULL, +name VARCHAR(1024) DEFAULT NULL NULL, +label VARCHAR(1024) DEFAULT NULL NULL, +description VARCHAR(1024) DEFAULT NULL NULL, +rb_key_label VARCHAR(1024) DEFAULT NULL NULL, +rb_key_description VARCHAR(1024) DEFAULT NULL NULL, +resources CLOB DEFAULT NULL NULL, +access_types CLOB DEFAULT NULL NULL, +parameters CLOB DEFAULT NULL NULL, +options CLOB DEFAULT NULL NULL, +sort_order NUMBER(10) DEFAULT '0' NULL, +primary key (id), +CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY (def_id) REFERENCES x_service_def (id), +CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY (added_by_id) REFERENCES x_portal_user (id), +CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id) +); + CREATE TABLE x_context_enricher_def( id NUMBER(20) NOT NULL, guid varchar(1024) DEFAULT NULL NULL, @@ -1722,6 +1750,7 @@ CREATE INDEX x_resource_def_IDX_def_id ON x_resource_def(def_id); CREATE INDEX x_access_type_def_IDX_def_id ON x_access_type_def(def_id); CREATE INDEX x_atd_grants_IDX_atdid ON x_access_type_def_grants(atd_id); CREATE INDEX x_cont_enr_def_IDX_defid ON x_context_enricher_def(def_id); +CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); CREATE INDEX x_enum_def_IDX_def_id ON x_enum_def(def_id); CREATE INDEX x_enum_element_def_IDX_defid ON x_enum_element_def(enum_def_id); CREATE INDEX x_service_conf_map_IDX_service ON x_service_config_map(service); @@ -2164,6 +2193,7 @@ INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,act INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval, '076',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval, '077',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval, '078',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); +INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval, '079',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval, 'DB_PATCHES',sys_extract_utc(systimestamp),'Ranger 1.0.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_user_module_perm (id,user_id,module_id,create_time,update_time,added_by_id,upd_by_id,is_allowed) VALUES (X_USER_MODULE_PERM_SEQ.nextval,getXportalUIdByLoginId('admin'),getModulesIdByName('Reports'),sys_extract_utc(systimestamp),sys_extract_utc(systimestamp),getXportalUIdByLoginId('admin'),getXportalUIdByLoginId('admin'),1); diff --git a/security-admin/db/oracle/patches/079-add-x_constraint_def.sql b/security-admin/db/oracle/patches/079-add-x_constraint_def.sql new file mode 100644 index 00000000000..9e98951419a --- /dev/null +++ b/security-admin/db/oracle/patches/079-add-x_constraint_def.sql @@ -0,0 +1,62 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +DECLARE + v_table_count NUMBER := 0; + v_seq_count NUMBER := 0; + v_idx_count NUMBER := 0; +BEGIN + SELECT count(*) INTO v_table_count FROM user_tables WHERE table_name = 'X_CONSTRAINT_DEF'; + IF (v_table_count = 0) THEN + EXECUTE IMMEDIATE ' + CREATE TABLE x_constraint_def ( + id NUMBER(20) NOT NULL, + guid VARCHAR(1024) DEFAULT NULL NULL, + create_time DATE DEFAULT NULL NULL, + update_time DATE DEFAULT NULL NULL, + added_by_id NUMBER(20) DEFAULT NULL NULL, + upd_by_id NUMBER(20) DEFAULT NULL NULL, + def_id NUMBER(20) NOT NULL, + item_id NUMBER(20) NOT NULL, + name VARCHAR(1024) DEFAULT NULL NULL, + label VARCHAR(1024) DEFAULT NULL NULL, + description VARCHAR(1024) DEFAULT NULL NULL, + rb_key_label VARCHAR(1024) DEFAULT NULL NULL, + rb_key_description VARCHAR(1024) DEFAULT NULL NULL, + resources CLOB DEFAULT NULL NULL, + access_types CLOB DEFAULT NULL NULL, + parameters CLOB DEFAULT NULL NULL, + options CLOB DEFAULT NULL NULL, + sort_order NUMBER(10) DEFAULT ''0'' NULL, + primary key (id), + CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY (def_id) REFERENCES x_service_def (id), + CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY (added_by_id) REFERENCES x_portal_user (id), + CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id) + )'; + END IF; + + SELECT count(*) INTO v_seq_count FROM user_sequences WHERE sequence_name = 'X_CONSTRAINT_DEF_SEQ'; + IF (v_seq_count = 0) THEN + EXECUTE IMMEDIATE 'CREATE SEQUENCE X_CONSTRAINT_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE'; + END IF; + + SELECT count(*) INTO v_idx_count FROM user_indexes WHERE index_name = 'X_CONSTRAINT_DEF_IDX_DEF_ID'; + IF (v_idx_count = 0) THEN + EXECUTE IMMEDIATE 'CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id)'; + END IF; +END; +/ + +commit; diff --git a/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql b/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql index 654d19aa732..de89dc19366 100644 --- a/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql +++ b/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql @@ -58,6 +58,7 @@ DROP TABLE IF EXISTS x_service_config_map CASCADE; DROP TABLE IF EXISTS x_enum_element_def CASCADE; DROP TABLE IF EXISTS x_enum_def CASCADE; DROP TABLE IF EXISTS x_context_enricher_def CASCADE; +DROP TABLE IF EXISTS x_constraint_def CASCADE; DROP TABLE IF EXISTS x_policy_condition_def CASCADE; DROP TABLE IF EXISTS x_access_type_def_grants CASCADE; DROP TABLE IF EXISTS x_access_type_def CASCADE; @@ -143,6 +144,7 @@ DROP SEQUENCE IF EXISTS x_service_config_map_seq; DROP SEQUENCE IF EXISTS x_enum_element_def_seq; DROP SEQUENCE IF EXISTS x_enum_def_seq; DROP SEQUENCE IF EXISTS x_context_enricher_def_seq; +DROP SEQUENCE IF EXISTS x_constraint_def_seq; DROP SEQUENCE IF EXISTS x_policy_condition_def_seq; DROP SEQUENCE IF EXISTS x_access_type_def_grants_seq; DROP SEQUENCE IF EXISTS x_access_type_def_seq; @@ -793,6 +795,32 @@ CONSTRAINT x_policy_cond_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES x_p CONSTRAINT x_policy_cond_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES x_portal_user(id) ); +CREATE SEQUENCE x_constraint_def_seq; +CREATE TABLE x_constraint_def( +id BIGINT DEFAULT nextval('x_constraint_def_seq'::regclass), +guid VARCHAR(1024) DEFAULT NULL NULL, +create_time TIMESTAMP DEFAULT NULL NULL, +update_time TIMESTAMP DEFAULT NULL NULL, +added_by_id BIGINT DEFAULT NULL NULL, +upd_by_id BIGINT DEFAULT NULL NULL, +def_id BIGINT NOT NULL, +item_id BIGINT NOT NULL, +name VARCHAR(1024) DEFAULT NULL NULL, +label VARCHAR(1024) DEFAULT NULL NULL, +description VARCHAR(1024) DEFAULT NULL NULL, +rb_key_label VARCHAR(1024) DEFAULT NULL NULL, +rb_key_description VARCHAR(1024) DEFAULT NULL NULL, +resources TEXT DEFAULT NULL NULL, +access_types TEXT DEFAULT NULL NULL, +parameters TEXT DEFAULT NULL NULL, +options TEXT DEFAULT NULL NULL, +sort_order INT DEFAULT '0' NULL, +primary key(id), +CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id) REFERENCES x_service_def(id), +CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES x_portal_user(id), +CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES x_portal_user(id) +); + CREATE SEQUENCE x_context_enricher_def_seq; CREATE TABLE x_context_enricher_def( id BIGINT DEFAULT nextval('x_context_enricher_def_seq'::regclass), @@ -1942,6 +1970,7 @@ CREATE INDEX x_resource_def_IDX_def_id ON x_resource_def(def_id); CREATE INDEX x_access_type_def_IDX_def_id ON x_access_type_def(def_id); CREATE INDEX x_access_type_def_IDX_grants_atd_id ON x_access_type_def_grants(atd_id); CREATE INDEX x_context_enricher_def_IDX_def_id ON x_context_enricher_def(def_id); +CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); CREATE INDEX x_enum_def_IDX_def_id ON x_enum_def(def_id); CREATE INDEX x_enum_element_def_IDX_enum_def_id ON x_enum_element_def(enum_def_id); CREATE INDEX x_service_config_map_IDX_service ON x_service_config_map(service); @@ -2078,6 +2107,7 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('076',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('077',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('078',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('079',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('DB_PATCHES',current_timestamp,'Ranger 1.0.0',current_timestamp,'localhost','Y'); INSERT INTO x_user_module_perm (user_id,module_id,create_time,update_time,added_by_id,upd_by_id,is_allowed) VALUES diff --git a/security-admin/db/postgres/patches/079-add-x_constraint_def.sql b/security-admin/db/postgres/patches/079-add-x_constraint_def.sql new file mode 100644 index 00000000000..f2fcc87210e --- /dev/null +++ b/security-admin/db/postgres/patches/079-add-x_constraint_def.sql @@ -0,0 +1,41 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +CREATE SEQUENCE IF NOT EXISTS x_constraint_def_seq; +CREATE TABLE IF NOT EXISTS x_constraint_def( +id BIGINT DEFAULT nextval('x_constraint_def_seq'::regclass), +guid VARCHAR(1024) DEFAULT NULL NULL, +create_time TIMESTAMP DEFAULT NULL NULL, +update_time TIMESTAMP DEFAULT NULL NULL, +added_by_id BIGINT DEFAULT NULL NULL, +upd_by_id BIGINT DEFAULT NULL NULL, +def_id BIGINT NOT NULL, +item_id BIGINT NOT NULL, +name VARCHAR(1024) DEFAULT NULL NULL, +label VARCHAR(1024) DEFAULT NULL NULL, +description VARCHAR(1024) DEFAULT NULL NULL, +rb_key_label VARCHAR(1024) DEFAULT NULL NULL, +rb_key_description VARCHAR(1024) DEFAULT NULL NULL, +resources TEXT DEFAULT NULL NULL, +access_types TEXT DEFAULT NULL NULL, +parameters TEXT DEFAULT NULL NULL, +options TEXT DEFAULT NULL NULL, +sort_order INT DEFAULT '0' NULL, +primary key(id), +CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id) REFERENCES x_service_def(id), +CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES x_portal_user(id), +CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES x_portal_user(id) +); +CREATE INDEX IF NOT EXISTS x_constraint_def_IDX_def_id ON x_constraint_def(def_id); diff --git a/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql b/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql index 678fe343b91..4468d794df2 100644 --- a/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql +++ b/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql @@ -126,6 +126,8 @@ call dbo.removeForeignKeysAndTable('x_enum_def') GO call dbo.removeForeignKeysAndTable('x_context_enricher_def') GO +call dbo.removeForeignKeysAndTable('x_constraint_def') +GO call dbo.removeForeignKeysAndTable('x_policy_condition_def') GO call dbo.removeForeignKeysAndTable('x_access_type_def_grants') @@ -701,6 +703,28 @@ create table dbo.x_policy_condition_def ( CONSTRAINT x_policy_condition_def_grants_PK_id PRIMARY KEY CLUSTERED(id) ) GO +create table dbo.x_constraint_def ( + id bigint IDENTITY NOT NULL, + guid varchar(1024) DEFAULT NULL NULL, + create_time datetime DEFAULT NULL NULL, + update_time datetime DEFAULT NULL NULL, + added_by_id bigint DEFAULT NULL NULL, + upd_by_id bigint DEFAULT NULL NULL, + def_id bigint NOT NULL, + item_id bigint NOT NULL, + name varchar(1024) DEFAULT NULL NULL, + label varchar(1024) DEFAULT NULL NULL, + description varchar(1024) DEFAULT NULL NULL, + rb_key_label varchar(1024) DEFAULT NULL NULL, + rb_key_description varchar(1024) DEFAULT NULL NULL, + resources text DEFAULT NULL NULL, + access_types text DEFAULT NULL NULL, + parameters text DEFAULT NULL NULL, + options text DEFAULT NULL NULL, + sort_order int DEFAULT 0 NULL, + CONSTRAINT x_constraint_def_PK_id PRIMARY KEY CLUSTERED(id) +) +GO create table dbo.x_context_enricher_def( id bigint IDENTITY NOT NULL, guid varchar(1024) DEFAULT NULL NULL, @@ -1481,6 +1505,12 @@ ALTER TABLE dbo.x_policy_condition_def ADD CONSTRAINT x_policy_condition_def_FK_ GO ALTER TABLE dbo.x_policy_condition_def ADD CONSTRAINT x_policy_condition_def_FK_upd_by FOREIGN KEY(upd_by_id)REFERENCES dbo.x_portal_user (id) GO +ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id)REFERENCES dbo.x_service_def (id) +GO +ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id)REFERENCES dbo.x_portal_user (id) +GO +ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id)REFERENCES dbo.x_portal_user (id) +GO ALTER TABLE dbo.x_context_enricher_def ADD CONSTRAINT x_context_enricher_def_FK_defid FOREIGN KEY(def_id)REFERENCES dbo.x_service_def (id) GO ALTER TABLE dbo.x_context_enricher_def ADD CONSTRAINT x_context_enricher_def_FK_added_by_id FOREIGN KEY(added_by_id)REFERENCES dbo.x_portal_user (id) @@ -1951,6 +1981,8 @@ CREATE NONCLUSTERED INDEX x_access_type_def_IDX_grants_atd_id ON dbo.x_access_ty GO CREATE NONCLUSTERED INDEX x_context_enricher_def_IDX_def_id ON dbo.x_context_enricher_def(def_id ASC) GO +CREATE NONCLUSTERED INDEX x_constraint_def_IDX_def_id ON dbo.x_constraint_def(def_id ASC) +GO CREATE NONCLUSTERED INDEX x_enum_def_IDX_def_id ON dbo.x_enum_def(def_id ASC) GO CREATE NONCLUSTERED INDEX x_enum_element_def_IDX_enum_def_id ON dbo.x_enum_element_def(enum_def_id ASC) @@ -2256,6 +2288,7 @@ GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('077',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('078',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('079',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('DB_PATCHES',CURRENT_TIMESTAMP,'Ranger 1.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO diff --git a/security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql b/security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql new file mode 100644 index 00000000000..12cff3fb528 --- /dev/null +++ b/security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql @@ -0,0 +1,48 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +BEGIN + IF NOT EXISTS(SELECT * FROM SYS.SYSTABLE WHERE table_name = 'x_constraint_def') THEN + CREATE TABLE dbo.x_constraint_def ( + id bigint IDENTITY NOT NULL, + guid varchar(1024) DEFAULT NULL NULL, + create_time datetime DEFAULT NULL NULL, + update_time datetime DEFAULT NULL NULL, + added_by_id bigint DEFAULT NULL NULL, + upd_by_id bigint DEFAULT NULL NULL, + def_id bigint NOT NULL, + item_id bigint NOT NULL, + name varchar(1024) DEFAULT NULL NULL, + label varchar(1024) DEFAULT NULL NULL, + description varchar(1024) DEFAULT NULL NULL, + rb_key_label varchar(1024) DEFAULT NULL NULL, + rb_key_description varchar(1024) DEFAULT NULL NULL, + resources text DEFAULT NULL NULL, + access_types text DEFAULT NULL NULL, + parameters text DEFAULT NULL NULL, + options text DEFAULT NULL NULL, + sort_order int DEFAULT 0 NULL, + CONSTRAINT x_constraint_def_PK_id PRIMARY KEY CLUSTERED(id) + ); + + ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id) REFERENCES dbo.x_service_def (id); + ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES dbo.x_portal_user (id); + ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES dbo.x_portal_user (id); + END IF; +END +GO + +CREATE INDEX IF NOT EXISTS x_constraint_def_IDX_def_id ON dbo.x_constraint_def(def_id ASC) +GO diff --git a/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql b/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql index 68c864e74e1..4387dddc12f 100644 --- a/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql +++ b/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql @@ -237,6 +237,10 @@ IF (OBJECT_ID('x_atd_grants_FK_atdid') IS NOT NULL) BEGIN ALTER TABLE [dbo].[x_access_type_def_grants] DROP CONSTRAINT x_atd_grants_FK_atdid END +IF (OBJECT_ID('x_constraint_def_FK_defid') IS NOT NULL) +BEGIN + ALTER TABLE [dbo].[x_constraint_def] DROP CONSTRAINT x_constraint_def_FK_defid +END IF (OBJECT_ID('x_policy_condition_def_FK_defid') IS NOT NULL) BEGIN ALTER TABLE [dbo].[x_policy_condition_def] DROP CONSTRAINT x_policy_condition_def_FK_defid @@ -910,6 +914,10 @@ IF (OBJECT_ID('x_context_enricher_def') IS NOT NULL) BEGIN DROP TABLE [dbo].[x_context_enricher_def] END +IF (OBJECT_ID('x_constraint_def') IS NOT NULL) +BEGIN + DROP TABLE [dbo].[x_constraint_def] +END IF (OBJECT_ID('x_policy_condition_def') IS NOT NULL) BEGIN DROP TABLE [dbo].[x_policy_condition_def] @@ -1776,6 +1784,30 @@ CREATE TABLE [dbo].[x_policy_condition_def] ( [id] ASC )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY] ) ON [PRIMARY] +CREATE TABLE [dbo].[x_constraint_def] ( + [id] [bigint] IDENTITY(1,1) NOT NULL, + [guid] [varchar](1024) DEFAULT NULL NULL, + [create_time] [datetime2] DEFAULT NULL NULL, + [update_time] [datetime2] DEFAULT NULL NULL, + [added_by_id] [bigint] DEFAULT NULL NULL, + [upd_by_id] [bigint] DEFAULT NULL NULL, + [def_id] [bigint] NOT NULL, + [item_id] [bigint] NOT NULL, + [name] [varchar](1024) DEFAULT NULL NULL, + [label] [varchar](1024) DEFAULT NULL NULL, + [description] [varchar](1024) DEFAULT NULL NULL, + [rb_key_label] [varchar](1024) DEFAULT NULL NULL, + [rb_key_description] [varchar](1024) DEFAULT NULL NULL, + [resources] [nvarchar](max) DEFAULT NULL NULL, + [access_types] [nvarchar](max) DEFAULT NULL NULL, + [parameters] [nvarchar](max) DEFAULT NULL NULL, + [options] [nvarchar](max) DEFAULT NULL NULL, + [sort_order] [int] DEFAULT 0 NULL, + PRIMARY KEY CLUSTERED +( + [id] ASC +)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY] +) ON [PRIMARY] CREATE TABLE [dbo].[x_context_enricher_def]( [id] [bigint] IDENTITY(1,1) NOT NULL, [guid] [varchar](1024) DEFAULT NULL NULL, @@ -2923,6 +2955,15 @@ ALTER TABLE [dbo].[x_policy_condition_def] CHECK CONSTRAINT [x_policy_condition_ ALTER TABLE [dbo].[x_policy_condition_def] WITH CHECK ADD CONSTRAINT [x_policy_condition_def_FK_upd_by] FOREIGN KEY([upd_by_id]) REFERENCES [dbo].[x_portal_user] ([id]) ALTER TABLE [dbo].[x_policy_condition_def] CHECK CONSTRAINT [x_policy_condition_def_FK_upd_by] +ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_defid] FOREIGN KEY([def_id]) +REFERENCES [dbo].[x_service_def] ([id]) +ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_defid] +ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_added_by] FOREIGN KEY([added_by_id]) +REFERENCES [dbo].[x_portal_user] ([id]) +ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_added_by] +ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_upd_by] FOREIGN KEY([upd_by_id]) +REFERENCES [dbo].[x_portal_user] ([id]) +ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_upd_by] ALTER TABLE [dbo].[x_context_enricher_def] WITH CHECK ADD CONSTRAINT [x_context_enricher_def_FK_defid] FOREIGN KEY([def_id]) REFERENCES [dbo].[x_service_def] ([id]) ALTER TABLE [dbo].[x_context_enricher_def] CHECK CONSTRAINT [x_context_enricher_def_FK_defid] @@ -3708,6 +3749,11 @@ CREATE NONCLUSTERED INDEX [x_context_enricher_def_IDX_def_id] ON [x_context_enri [def_id] ASC ) WITH (SORT_IN_TEMPDB = OFF, DROP_EXISTING = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF) ON [PRIMARY] +CREATE NONCLUSTERED INDEX [x_constraint_def_IDX_def_id] ON [x_constraint_def] +( + [def_id] ASC +) +WITH (SORT_IN_TEMPDB = OFF, DROP_EXISTING = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF) ON [PRIMARY] CREATE NONCLUSTERED INDEX [x_enum_def_IDX_def_id] ON [x_enum_def] ( [def_id] ASC @@ -4538,6 +4584,7 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('076',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('077',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('078',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('079',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('DB_PATCHES',CURRENT_TIMESTAMP,'Ranger 1.0.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_user_module_perm (user_id,module_id,create_time,update_time,added_by_id,upd_by_id,is_allowed) VALUES (dbo.getXportalUIdByLoginId('admin'),dbo.getModulesIdByName('Reports'),CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,dbo.getXportalUIdByLoginId('admin'),dbo.getXportalUIdByLoginId('admin'),1); INSERT INTO x_user_module_perm (user_id,module_id,create_time,update_time,added_by_id,upd_by_id,is_allowed) VALUES (dbo.getXportalUIdByLoginId('admin'),dbo.getModulesIdByName('Resource Based Policies'),CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,dbo.getXportalUIdByLoginId('admin'),dbo.getXportalUIdByLoginId('admin'),1); diff --git a/security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql b/security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql new file mode 100644 index 00000000000..e8ef2980dc4 --- /dev/null +++ b/security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql @@ -0,0 +1,71 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +SET ANSI_NULLS ON +SET QUOTED_IDENTIFIER ON +SET ANSI_PADDING ON +GO + +IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = 'x_constraint_def') +BEGIN + CREATE TABLE [dbo].[x_constraint_def] ( + [id] [bigint] IDENTITY(1,1) NOT NULL, + [guid] [varchar](1024) DEFAULT NULL NULL, + [create_time] [datetime2] DEFAULT NULL NULL, + [update_time] [datetime2] DEFAULT NULL NULL, + [added_by_id] [bigint] DEFAULT NULL NULL, + [upd_by_id] [bigint] DEFAULT NULL NULL, + [def_id] [bigint] NOT NULL, + [item_id] [bigint] NOT NULL, + [name] [varchar](1024) DEFAULT NULL NULL, + [label] [varchar](1024) DEFAULT NULL NULL, + [description] [varchar](1024) DEFAULT NULL NULL, + [rb_key_label] [varchar](1024) DEFAULT NULL NULL, + [rb_key_description] [varchar](1024) DEFAULT NULL NULL, + [resources] [nvarchar](max) DEFAULT NULL NULL, + [access_types] [nvarchar](max) DEFAULT NULL NULL, + [parameters] [nvarchar](max) DEFAULT NULL NULL, + [options] [nvarchar](max) DEFAULT NULL NULL, + [sort_order] [int] DEFAULT 0 NULL, + PRIMARY KEY CLUSTERED + ( + [id] ASC + )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY] + ) ON [PRIMARY]; + + ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_defid] FOREIGN KEY([def_id]) + REFERENCES [dbo].[x_service_def] ([id]); + ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_defid]; + ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_added_by] FOREIGN KEY([added_by_id]) + REFERENCES [dbo].[x_portal_user] ([id]); + ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_added_by]; + ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_upd_by] FOREIGN KEY([upd_by_id]) + REFERENCES [dbo].[x_portal_user] ([id]); + ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_upd_by]; +END +GO + +IF OBJECT_ID('x_constraint_def') IS NOT NULL +BEGIN + IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'x_constraint_def_IDX_def_id' AND object_id = OBJECT_ID('x_constraint_def')) + BEGIN + CREATE NONCLUSTERED INDEX [x_constraint_def_IDX_def_id] ON [dbo].[x_constraint_def] + ( + [def_id] ASC + ) + WITH (SORT_IN_TEMPDB = OFF, DROP_EXISTING = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF) ON [PRIMARY] + END +END +GO diff --git a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java index 0d3f5bc1bc1..7235ff445a9 100644 --- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java +++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java @@ -56,6 +56,7 @@ import org.apache.ranger.db.XXAccessTypeDefDao; import org.apache.ranger.db.XXAccessTypeDefGrantsDao; import org.apache.ranger.db.XXAuthSessionDao; +import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; import org.apache.ranger.db.XXEnumDefDao; @@ -73,6 +74,7 @@ import org.apache.ranger.db.XXTrxLogV2Dao; import org.apache.ranger.entity.XXAccessTypeDef; import org.apache.ranger.entity.XXAccessTypeDefGrants; +import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataHist; import org.apache.ranger.entity.XXDataMaskTypeDef; @@ -115,6 +117,7 @@ import org.apache.ranger.plugin.model.RangerService; import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerContextEnricherDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerDataMaskDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerDataMaskTypeDef; @@ -569,6 +572,23 @@ public RangerServiceDef createServiceDef(RangerServiceDef serviceDef) throws Exc xxPolCondDao.create(xPolicyCondition); } + List constraintDefs = serviceDef.getConstraintDefs() != null ? serviceDef.getConstraintDefs() : new ArrayList<>(); + + if (CollectionUtils.isNotEmpty(constraintDefs)) { + XXConstraintDefDao xxConstraintDefDao = daoMgr.getXXConstraintDef(); + + for (int i = 0; i < constraintDefs.size(); i++) { + RangerConstraintDef constraintDef = constraintDefs.get(i); + XXConstraintDef xConstraintDef = new XXConstraintDef(); + + xConstraintDef = serviceDefService.populateRangerConstraintDefToXX(constraintDef, xConstraintDef, createdSvcDef, RangerServiceDefService.OPERATION_CREATE_CONTEXT); + + xConstraintDef.setOrder(i); + + xxConstraintDefDao.create(xConstraintDef); + } + } + XXContextEnricherDefDao xxContextEnricherDao = daoMgr.getXXContextEnricherDef(); for (int i = 0; i < contextEnrichers.size(); i++) { @@ -735,6 +755,7 @@ public RangerServiceDef updateServiceDef(RangerServiceDef serviceDef) throws Exc List resources = serviceDef.getResources() != null ? serviceDef.getResources() : new ArrayList<>(); List accessTypes = serviceDef.getAccessTypes() != null ? serviceDef.getAccessTypes() : new ArrayList<>(); List policyConditions = serviceDef.getPolicyConditions() != null ? serviceDef.getPolicyConditions() : new ArrayList<>(); + List constraintDefs = serviceDef.getConstraintDefs() != null ? serviceDef.getConstraintDefs() : new ArrayList<>(); List contextEnrichers = serviceDef.getContextEnrichers() != null ? serviceDef.getContextEnrichers() : new ArrayList<>(); List enums = serviceDef.getEnums() != null ? serviceDef.getEnums() : new ArrayList<>(); RangerDataMaskDef dataMaskDef = serviceDef.getDataMaskDef(); @@ -751,7 +772,7 @@ public RangerServiceDef updateServiceDef(RangerServiceDef serviceDef) throws Exc XXServiceDef createdSvcDef = daoMgr.getXXServiceDef().getById(serviceDefId); - updateChildObjectsOfServiceDef(createdSvcDef, configs, resources, accessTypes, policyConditions, contextEnrichers, enums, dataMaskDef, rowFilterDef); + updateChildObjectsOfServiceDef(createdSvcDef, configs, resources, accessTypes, policyConditions, contextEnrichers, enums, dataMaskDef, rowFilterDef, constraintDefs); RangerServiceDef updatedSvcDef = getServiceDef(serviceDefId); @@ -845,6 +866,15 @@ public void deleteServiceDef(Long serviceDefId, Boolean forceDelete) throws Exce policyCondDao.remove(policyCond); } + XXConstraintDefDao constraintDefDao = daoMgr.getXXConstraintDef(); + List constraintDefList = constraintDefDao.findByServiceDefId(serviceDefId); + + if (constraintDefList != null) { + for (XXConstraintDef constraintDef : constraintDefList) { + constraintDefDao.remove(constraintDef); + } + } + List resDefList = daoMgr.getXXResourceDef().findByServiceDefId(serviceDefId); for (XXResourceDef resDef : resDefList) { @@ -3251,16 +3281,26 @@ boolean hasServiceConfigForPluginChanged(List dbConfigMaps, private void updateChildObjectsOfServiceDef(XXServiceDef createdSvcDef, List configs, List resources, List accessTypes, List policyConditions, List contextEnrichers, - List enums, RangerDataMaskDef dataMaskDef, RangerRowFilterDef rowFilterDef) { + List enums, RangerDataMaskDef dataMaskDef, RangerRowFilterDef rowFilterDef, + List constraintDefs) { Long serviceDefId = createdSvcDef.getId(); List xxConfigs = daoMgr.getXXServiceConfigDef().findByServiceDefId(serviceDefId); List xxResources = daoMgr.getXXResourceDef().findByServiceDefId(serviceDefId); List xxAccessTypes = daoMgr.getXXAccessTypeDef().findByServiceDefId(serviceDefId); List xxPolicyConditions = daoMgr.getXXPolicyConditionDef().findByServiceDefId(serviceDefId); + List xxConstraintDefs = daoMgr.getXXConstraintDef().findByServiceDefId(serviceDefId); List xxContextEnrichers = daoMgr.getXXContextEnricherDef().findByServiceDefId(serviceDefId); List xxEnums = daoMgr.getXXEnumDef().findByServiceDefId(serviceDefId); XXServiceConfigDefDao xxServiceConfigDao = daoMgr.getXXServiceConfigDef(); + if (xxConstraintDefs == null) { + xxConstraintDefs = new ArrayList<>(); + } + + if (constraintDefs == null) { + constraintDefs = new ArrayList<>(); + } + for (int i = 0; i < configs.size(); i++) { RangerServiceConfigDef config = configs.get(i); boolean found = false; @@ -3521,6 +3561,54 @@ private void updateChildObjectsOfServiceDef(XXServiceDef createdSvcDef, List { + public XXConstraintDefDao(RangerDaoManagerBase daoManager) { + super(daoManager); + } + + public List findByServiceDefId(Long serviceDefId) { + if (serviceDefId == null) { + return new ArrayList<>(); + } + + try { + return getEntityManager() + .createNamedQuery("XXConstraintDef.findByServiceDefId", tClass) + .setParameter("serviceDefId", serviceDefId).getResultList(); + } catch (NoResultException e) { + return new ArrayList<>(); + } + } + + public XXConstraintDef findByServiceDefIdAndName(Long serviceDefId, String name) { + if (serviceDefId == null) { + return null; + } + + try { + return getEntityManager() + .createNamedQuery("XXConstraintDef.findByServiceDefIdAndName", tClass) + .setParameter("serviceDefId", serviceDefId) + .setParameter("name", name).getSingleResult(); + } catch (NoResultException e) { + return null; + } + } +} diff --git a/security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java b/security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java new file mode 100644 index 00000000000..125684ccf0e --- /dev/null +++ b/security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java @@ -0,0 +1,230 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.ranger.entity; + +import javax.persistence.Cacheable; +import javax.persistence.Column; +import javax.persistence.Entity; +import javax.persistence.GeneratedValue; +import javax.persistence.GenerationType; +import javax.persistence.Id; +import javax.persistence.SequenceGenerator; +import javax.persistence.Table; + +import java.util.Objects; + +@Entity +@Cacheable +@Table(name = "x_constraint_def") +public class XXConstraintDef extends XXDBBase implements java.io.Serializable { + private static final long serialVersionUID = 1L; + + @Id + @SequenceGenerator(name = "x_constraint_def_SEQ", sequenceName = "x_constraint_def_SEQ", allocationSize = 1) + @GeneratedValue(strategy = GenerationType.AUTO, generator = "x_constraint_def_SEQ") + @Column(name = "id") + protected Long id; + + @Column(name = "def_id") + protected Long defId; + + @Column(name = "item_id") + protected Long itemId; + + @Column(name = "name") + protected String name; + + @Column(name = "label") + protected String label; + + @Column(name = "description") + protected String description; + + @Column(name = "rb_key_label") + protected String rbKeyLabel; + + @Column(name = "rb_key_description") + protected String rbKeyDescription; + + @Column(name = "resources") + protected String resources; + + @Column(name = "access_types") + protected String accessTypes; + + @Column(name = "parameters") + protected String parameters; + + @Column(name = "options") + protected String options; + + @Column(name = "sort_order") + protected Integer order; + + public Long getId() { + return this.id; + } + + public void setId(Long id) { + this.id = id; + } + + @Override + public int hashCode() { + return super.hashCode(); + } + + @Override + public boolean equals(Object obj) { + if (this == obj) { + return true; + } else if (!super.equals(obj)) { + return false; + } + + XXConstraintDef other = (XXConstraintDef) obj; + + return Objects.equals(defId, other.defId) && + Objects.equals(itemId, other.itemId) && + Objects.equals(name, other.name) && + Objects.equals(label, other.label) && + Objects.equals(description, other.description) && + Objects.equals(rbKeyLabel, other.rbKeyLabel) && + Objects.equals(rbKeyDescription, other.rbKeyDescription) && + Objects.equals(resources, other.resources) && + Objects.equals(accessTypes, other.accessTypes) && + Objects.equals(parameters, other.parameters) && + Objects.equals(options, other.options) && + Objects.equals(id, other.id) && + Objects.equals(order, other.order); + } + + @Override + public String toString() { + String str = "XXConstraintDef={"; + + str += super.toString(); + str += " [id=" + id + ", defId=" + defId + ", itemId=" + itemId + + ", name=" + name + ", label=" + label + + ", description=" + description + ", rbKeyLabel=" + rbKeyLabel + + ", rbKeyDescription=" + rbKeyDescription + + ", resources=" + resources + ", accessTypes=" + accessTypes + + ", parameters=" + parameters + ", options=" + options + + ", order=" + order + "]"; + str += "}"; + + return str; + } + + public Long getDefid() { + return this.defId; + } + + public void setDefid(Long defId) { + this.defId = defId; + } + + public Long getItemId() { + return this.itemId; + } + + public void setItemId(Long itemId) { + this.itemId = itemId; + } + + public String getName() { + return this.name; + } + + public void setName(String name) { + this.name = name; + } + + public String getLabel() { + return this.label; + } + + public void setLabel(String label) { + this.label = label; + } + + public String getDescription() { + return this.description; + } + + public void setDescription(String description) { + this.description = description; + } + + public String getRbkeylabel() { + return this.rbKeyLabel; + } + + public void setRbkeylabel(String rbKeyLabel) { + this.rbKeyLabel = rbKeyLabel; + } + + public String getRbkeydescription() { + return this.rbKeyDescription; + } + + public void setRbkeydescription(String rbKeyDescription) { + this.rbKeyDescription = rbKeyDescription; + } + + public String getResources() { + return this.resources; + } + + public void setResources(String resources) { + this.resources = resources; + } + + public String getAccessTypes() { + return this.accessTypes; + } + + public void setAccessTypes(String accessTypes) { + this.accessTypes = accessTypes; + } + + public String getParameters() { + return this.parameters; + } + + public void setParameters(String parameters) { + this.parameters = parameters; + } + + public String getOptions() { + return this.options; + } + + public void setOptions(String options) { + this.options = options; + } + + public Integer getOrder() { + return this.order; + } + + public void setOrder(Integer order) { + this.order = order; + } +} diff --git a/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java b/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java index 1b93b2c84b8..9f837b27dbd 100644 --- a/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java +++ b/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java @@ -17,6 +17,7 @@ package org.apache.ranger.service; +import com.fasterxml.jackson.core.type.TypeReference; import org.apache.commons.collections.MapUtils; import org.apache.commons.lang3.StringUtils; import org.apache.ranger.common.AppConstants; @@ -29,6 +30,7 @@ import org.apache.ranger.common.SearchField.SEARCH_TYPE; import org.apache.ranger.common.SortField; import org.apache.ranger.entity.XXAccessTypeDef; +import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataMaskTypeDef; import org.apache.ranger.entity.XXEnumDef; @@ -41,6 +43,8 @@ import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef.AccessTypeCategory; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintParamDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerContextEnricherDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerDataMaskDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerDataMaskTypeDef; @@ -50,6 +54,7 @@ import org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerRowFilterDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerServiceConfigDef; +import org.apache.ranger.plugin.util.JsonUtilsV2; import org.apache.ranger.plugin.util.SearchFilter; import org.apache.ranger.plugin.util.ServiceDefUtil; import org.apache.ranger.view.RangerServiceDefList; @@ -75,6 +80,9 @@ public abstract class RangerServiceDefServiceBase> TYPE_REF_LIST_STRING = new TypeReference>() {}; + private static final TypeReference> TYPE_REF_LIST_CONSTRAINT_PARAM = new TypeReference>() {}; + @Autowired RangerAuditFields rangerAuditFields; @@ -346,6 +354,48 @@ public RangerPolicyConditionDef populateXXToRangerPolicyConditionDef(XXPolicyCon return vObj; } + public XXConstraintDef populateRangerConstraintDefToXX(RangerConstraintDef vObj, XXConstraintDef xObj, XXServiceDef serviceDef, int operationContext) { + if (serviceDef == null) { + LOG.error("RangerServiceDefServiceBase.populateRangerConstraintDefToXX, serviceDef can not be null"); + + throw restErrorUtil.createRESTException("RangerServiceDef cannot be null.", MessageEnums.DATA_NOT_FOUND); + } + + xObj = rangerAuditFields.populateAuditFields(xObj, serviceDef); + + xObj.setDefid(serviceDef.getId()); + xObj.setItemId(vObj.getItemId()); + xObj.setName(vObj.getName()); + xObj.setLabel(vObj.getLabel()); + xObj.setDescription(vObj.getDescription()); + xObj.setRbkeylabel(vObj.getRbKeyLabel()); + xObj.setRbkeydescription(vObj.getRbKeyDescription()); + xObj.setResources(vObj.getResources() == null ? null : jsonUtil.readListToString(vObj.getResources())); + xObj.setAccessTypes(vObj.getAccessTypes() == null ? null : jsonUtil.readListToString(vObj.getAccessTypes())); + xObj.setParameters(vObj.getParameters() == null ? null : objectToJson(new ArrayList<>(vObj.getParameters()))); + xObj.setOptions(mapToJsonString(vObj.getOptions())); + xObj.setOrder(AppConstants.DEFAULT_SORT_ORDER); + + return xObj; + } + + public RangerConstraintDef populateXXToRangerConstraintDef(XXConstraintDef xObj) { + RangerConstraintDef vObj = new RangerConstraintDef(); + + vObj.setItemId(xObj.getItemId()); + vObj.setName(xObj.getName()); + vObj.setLabel(xObj.getLabel()); + vObj.setDescription(xObj.getDescription()); + vObj.setRbKeyLabel(xObj.getRbkeylabel()); + vObj.setRbKeyDescription(xObj.getRbkeydescription()); + vObj.setResources(jsonToStringList(xObj.getResources())); + vObj.setAccessTypes(jsonToStringList(xObj.getAccessTypes())); + vObj.setParameters(jsonToConstraintParams(xObj.getParameters())); + vObj.setOptions(jsonStringToMap(xObj.getOptions())); + + return vObj; + } + public XXContextEnricherDef populateRangerContextEnricherDefToXX(RangerContextEnricherDef vObj, XXContextEnricherDef xObj, XXServiceDef serviceDef, int operationContext) { if (serviceDef == null) { LOG.error("RangerServiceDefServiceBase.populateRangerContextEnricherDefToXX, serviceDef can not be null"); @@ -537,6 +587,34 @@ public DST jsonToObject(String jsonStr, Class clz) { return ret; } + private List jsonToStringList(String jsonStr) { + List ret = null; + + if (StringUtils.isNotEmpty(jsonStr)) { + try { + ret = JsonUtilsV2.jsonToObj(jsonStr, TYPE_REF_LIST_STRING); + } catch (Exception excp) { + LOG.warn("jsonToStringList() failed to convert json to object: {}", jsonStr, excp); + } + } + + return ret; + } + + private List jsonToConstraintParams(String jsonStr) { + List ret = null; + + if (StringUtils.isNotEmpty(jsonStr)) { + try { + ret = JsonUtilsV2.jsonToObj(jsonStr, TYPE_REF_LIST_CONSTRAINT_PARAM); + } catch (Exception excp) { + LOG.warn("jsonToConstraintParams() failed to convert json to object: {}", jsonStr, excp); + } + } + + return ret; + } + @Override protected T mapViewToEntityBean(V vObj, T xObj, int operationContext) { String guid = (StringUtils.isEmpty(vObj.getGuid())) ? guidUtil.genGUID() : vObj.getGuid(); @@ -635,6 +713,20 @@ protected V populateViewBean(T xServiceDef) { serviceDef.setPolicyConditions(policyConditions); } + List xConstraintDefs = daoMgr.getXXConstraintDef().findByServiceDefId(serviceDefId); + + if (!stringUtil.isEmpty(xConstraintDefs)) { + List constraintDefs = new ArrayList<>(); + + for (XXConstraintDef xConstraintDef : xConstraintDefs) { + RangerConstraintDef constraintDef = populateXXToRangerConstraintDef(xConstraintDef); + + constraintDefs.add(constraintDef); + } + + serviceDef.setConstraintDefs(constraintDefs); + } + List xContextEnrichers = daoMgr.getXXContextEnricherDef().findByServiceDefId(serviceDefId); if (!stringUtil.isEmpty(xContextEnrichers)) { diff --git a/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java b/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java index 1642a7e12ec..5af8f9a0ca0 100644 --- a/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java +++ b/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java @@ -71,6 +71,8 @@ public void updateXXPortalUserReferences(long xXPortalUserId) { daoManager.getXXAccessTypeDefGrants().updateUserIDReference("upd_by_id", xXPortalUserId); daoManager.getXXPolicyConditionDef().updateUserIDReference("added_by_id", xXPortalUserId); daoManager.getXXPolicyConditionDef().updateUserIDReference("upd_by_id", xXPortalUserId); + daoManager.getXXConstraintDef().updateUserIDReference("added_by_id", xXPortalUserId); + daoManager.getXXConstraintDef().updateUserIDReference("upd_by_id", xXPortalUserId); daoManager.getXXContextEnricherDef().updateUserIDReference("added_by_id", xXPortalUserId); daoManager.getXXContextEnricherDef().updateUserIDReference("upd_by_id", xXPortalUserId); daoManager.getXXEnumDef().updateUserIDReference("added_by_id", xXPortalUserId); diff --git a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml index 1dcffe9aeec..fd5d10cfc20 100755 --- a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml +++ b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml @@ -691,6 +691,15 @@ select obj.id, obj.name from XXPolicyConditionDef obj where obj.defId = :serviceDefId and obj.name IN :names order by obj.order + + + select obj from XXConstraintDef obj where obj.defId = :serviceDefId order by obj.order + + + + select obj from XXConstraintDef obj where obj.defId = :serviceDefId and obj.name = :name order by obj.order + + select obj from XXContextEnricherDef obj where obj.defId = :serviceDefId order by obj.order diff --git a/security-admin/src/main/resources/META-INF/persistence.xml b/security-admin/src/main/resources/META-INF/persistence.xml index 827a312fdf9..8d75637464a 100644 --- a/security-admin/src/main/resources/META-INF/persistence.xml +++ b/security-admin/src/main/resources/META-INF/persistence.xml @@ -49,6 +49,7 @@ org.apache.ranger.entity.XXAccessTypeDef org.apache.ranger.entity.XXAccessTypeDefGrants org.apache.ranger.entity.XXPolicyConditionDef + org.apache.ranger.entity.XXConstraintDef org.apache.ranger.entity.XXContextEnricherDef org.apache.ranger.entity.XXEnumDef org.apache.ranger.entity.XXEnumElementDef diff --git a/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java b/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java index 5a36e7f297e..20afa062365 100644 --- a/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java +++ b/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java @@ -38,6 +38,7 @@ import org.apache.ranger.db.XXAccessTypeDefDao; import org.apache.ranger.db.XXAccessTypeDefGrantsDao; import org.apache.ranger.db.XXAuthSessionDao; +import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXDataHistDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; @@ -74,6 +75,7 @@ import org.apache.ranger.db.XXUserDao; import org.apache.ranger.entity.XXAccessTypeDef; import org.apache.ranger.entity.XXAccessTypeDefGrants; +import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataHist; import org.apache.ranger.entity.XXDataMaskTypeDef; @@ -423,6 +425,9 @@ public void test12updateServiceDef() throws Exception { Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResourceDefDao); Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAccessTypeDefDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); + XXConstraintDefDao xConstraintDefDao = Mockito.mock(XXConstraintDefDao.class); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDefDao); + Mockito.when(xConstraintDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDefDao); Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDataMaskDefDao); @@ -753,6 +758,14 @@ public void test13deleteServiceDef() throws Exception { Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); Mockito.when(xPolicyConditionDefDao.findByServiceDefId(serviceDefId)).thenReturn(xConditionDefList); + XXConstraintDefDao xConstraintDefDao = Mockito.mock(XXConstraintDefDao.class); + XXConstraintDef xConstraintDef = new XXConstraintDef(); + xConstraintDef.setId(Id); + List xConstraintDefList = new ArrayList<>(); + xConstraintDefList.add(xConstraintDef); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDefDao); + Mockito.when(xConstraintDefDao.findByServiceDefId(serviceDefId)).thenReturn(xConstraintDefList); + Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResourceDefDao); Mockito.when(xResourceDefDao.findByServiceDefId(serviceDefId)).thenReturn(resDefList); @@ -772,6 +785,7 @@ public void test13deleteServiceDef() throws Exception { Mockito.when(xDataMaskDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); serviceDBStore.deleteServiceDef(Id, true); + Mockito.verify(xConstraintDefDao).remove(xConstraintDef); Mockito.verify(daoMgr).getXXContextEnricherDef(); Mockito.verify(daoMgr).getXXEnumDef(); } @@ -6492,6 +6506,9 @@ public void test231updateChildObjectsOfServiceDef_updateCreateRemove() throws Ex xCond60.setItemId(60L); xCond60.setName("country"); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); + XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); + Mockito.when(xConstraintDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); Mockito.when(xCondDao.findByServiceDefId(1L)).thenReturn(new ArrayList() { { add(xCond60); @@ -6568,6 +6585,7 @@ public void test231updateChildObjectsOfServiceDef_updateCreateRemove() throws Ex Mockito.when(daoMgr.getXXPolicyRefResource()).thenReturn(xPolRefResDao); Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xGrantDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); Mockito.when(daoMgr.getXXEnumElementDef()).thenReturn(xEnumEleDao); @@ -6662,10 +6680,10 @@ public void test231updateChildObjectsOfServiceDef_updateCreateRemove() throws Ex Method m = ServiceDBStore.class.getDeclaredMethod("updateChildObjectsOfServiceDef", XXServiceDef.class, List.class, List.class, List.class, List.class, List.class, List.class, - RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class); + RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class, List.class); m.setAccessible(true); try { - m.invoke(serviceDBStore, createdSvcDef, configs, resources, accessTypes, conds, enrs, enums, dmDef, rfDef); + m.invoke(serviceDBStore, createdSvcDef, configs, resources, accessTypes, conds, enrs, enums, dmDef, rfDef, new ArrayList<>()); } catch (InvocationTargetException ite) { // ignore exception; we'll verify interactions below for coverage } @@ -6715,13 +6733,13 @@ public void test232updateChildObjectsOfServiceDef_resourceRefBlock() throws Exce Method m = ServiceDBStore.class.getDeclaredMethod("updateChildObjectsOfServiceDef", XXServiceDef.class, List.class, List.class, List.class, List.class, List.class, List.class, - RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class); + RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class, List.class); m.setAccessible(true); Assertions.assertThrows(RuntimeException.class, () -> { try { m.invoke(serviceDBStore, createdSvcDef, new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), - new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), null, null); + new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), null, null, new ArrayList<>()); } catch (InvocationTargetException e) { Throwable cause = e.getCause(); if (cause instanceof RuntimeException) { @@ -6794,6 +6812,207 @@ public void test233createServiceDefWithIdentityInsert() throws Exception { Mockito.verify(svcDefServiceWithAssignedId).create(sd); } + @Test + public void test262createServiceDef_persistsConstraintDefs() throws Exception { + serviceDBStore.setPopulateExistingBaseFields(false); + + XXServiceDefDao xSvcDefDao = Mockito.mock(XXServiceDefDao.class); + XXServiceDef created = new XXServiceDef(); + created.setId(1L); + Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xSvcDefDao); + Mockito.when(xSvcDefDao.findByName("agent")).thenReturn(null); + Mockito.when(xSvcDefDao.getById(1L)).thenReturn(created); + + XXServiceConfigDefDao xCfgDao = Mockito.mock(XXServiceConfigDefDao.class); + XXResourceDefDao xResDao = Mockito.mock(XXResourceDefDao.class); + XXAccessTypeDefDao xAtdDao = Mockito.mock(XXAccessTypeDefDao.class); + XXPolicyConditionDefDao xCondDao = Mockito.mock(XXPolicyConditionDefDao.class); + XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); + XXContextEnricherDefDao xEnrDao = Mockito.mock(XXContextEnricherDefDao.class); + XXEnumDefDao xEnumDao = Mockito.mock(XXEnumDefDao.class); + XXDataMaskTypeDefDao xDmDao = Mockito.mock(XXDataMaskTypeDefDao.class); + Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xCfgDao); + Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResDao); + Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAtdDao); + Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); + Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); + Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); + Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDmDao); + Mockito.when(xAtdDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xResDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xDmDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xConstraintDao.create(Mockito.any())).thenAnswer(inv -> inv.getArgument(0)); + Mockito.when(serviceDefService.populateRangerConstraintDefToXX(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt())).thenAnswer(inv -> { + RangerServiceDef.RangerConstraintDef view = inv.getArgument(0); + XXConstraintDef entity = inv.getArgument(1); + entity.setItemId(view.getItemId()); + entity.setName(view.getName()); + return entity; + }); + + RangerServiceDef sd = new RangerServiceDef(); + sd.setName("agent"); + RangerServiceDef.RangerConstraintDef constraintDef = new RangerServiceDef.RangerConstraintDef(); + constraintDef.setItemId(1L); + constraintDef.setName("requireApproval"); + sd.getConstraintDefs().add(constraintDef); + + Mockito.when(serviceDefService.create(Mockito.any())).thenAnswer(inv -> { + RangerServiceDef createdDef = inv.getArgument(0); + createdDef.setId(1L); + return createdDef; + }); + Mockito.when(serviceDefService.getPopulatedViewObject(Mockito.any(XXServiceDef.class))).thenReturn(sd); + + RangerServiceDef out = serviceDBStore.createServiceDef(sd); + Assertions.assertNotNull(out); + + ArgumentCaptor createdConstraint = ArgumentCaptor.forClass(XXConstraintDef.class); + Mockito.verify(xConstraintDao).create(createdConstraint.capture()); + Assertions.assertEquals(Long.valueOf(1L), createdConstraint.getValue().getItemId()); + Assertions.assertEquals(Integer.valueOf(0), createdConstraint.getValue().getOrder()); + } + + @Test + public void test263updateChildObjectsOfServiceDef_constraintDefs() throws Exception { + XXServiceDef createdSvcDef = new XXServiceDef(); + createdSvcDef.setId(1L); + + XXServiceConfigDefDao xCfgDao = Mockito.mock(XXServiceConfigDefDao.class); + XXResourceDefDao xResDao = Mockito.mock(XXResourceDefDao.class); + XXAccessTypeDefDao xAtdDao = Mockito.mock(XXAccessTypeDefDao.class); + XXPolicyConditionDefDao xCondDao = Mockito.mock(XXPolicyConditionDefDao.class); + XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); + XXContextEnricherDefDao xEnrDao = Mockito.mock(XXContextEnricherDefDao.class); + XXEnumDefDao xEnumDao = Mockito.mock(XXEnumDefDao.class); + XXDataMaskTypeDefDao xDmDao = Mockito.mock(XXDataMaskTypeDefDao.class); + + XXConstraintDef existingUpdate = new XXConstraintDef(); + existingUpdate.setId(2L); + existingUpdate.setItemId(2L); + existingUpdate.setName("maxRows"); + XXConstraintDef existingRemove = new XXConstraintDef(); + existingRemove.setId(3L); + existingRemove.setItemId(3L); + existingRemove.setName("gone"); + List existing = new ArrayList<>(); + existing.add(existingUpdate); + existing.add(existingRemove); + + Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xCfgDao); + Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResDao); + Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAtdDao); + Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); + Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); + Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); + Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDmDao); + Mockito.when(xCfgDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xResDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xAtdDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xCondDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xConstraintDao.findByServiceDefId(1L)).thenReturn(existing); + Mockito.when(xEnrDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xEnumDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xDmDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(xConstraintDao.create(Mockito.any())).thenAnswer(inv -> inv.getArgument(0)); + Mockito.when(xConstraintDao.update(Mockito.any())).thenAnswer(inv -> inv.getArgument(0)); + Mockito.when(serviceDefService.populateRangerConstraintDefToXX(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt())).thenAnswer(inv -> { + RangerServiceDef.RangerConstraintDef view = inv.getArgument(0); + XXConstraintDef entity = inv.getArgument(1); + entity.setItemId(view.getItemId()); + entity.setName(view.getName()); + return entity; + }); + Mockito.when(serviceDefService.populateXXToRangerConstraintDef(Mockito.any())).thenReturn(new RangerServiceDef.RangerConstraintDef()); + + RangerServiceDef.RangerConstraintDef createDef = new RangerServiceDef.RangerConstraintDef(); + createDef.setItemId(1L); + createDef.setName("requireApproval"); + RangerServiceDef.RangerConstraintDef updateDef = new RangerServiceDef.RangerConstraintDef(); + updateDef.setItemId(2L); + updateDef.setName("maxRows"); + List constraintDefs = new ArrayList<>(); + constraintDefs.add(createDef); + constraintDefs.add(updateDef); + + Method m = ServiceDBStore.class.getDeclaredMethod("updateChildObjectsOfServiceDef", XXServiceDef.class, + List.class, List.class, List.class, List.class, List.class, List.class, + RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class, List.class); + m.setAccessible(true); + m.invoke(serviceDBStore, createdSvcDef, new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), + new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), new RangerServiceDef.RangerDataMaskDef(), + new RangerServiceDef.RangerRowFilterDef(), constraintDefs); + + ArgumentCaptor createdConstraint = ArgumentCaptor.forClass(XXConstraintDef.class); + Mockito.verify(xConstraintDao).create(createdConstraint.capture()); + Assertions.assertEquals(Long.valueOf(1L), createdConstraint.getValue().getItemId()); + Assertions.assertEquals(Integer.valueOf(0), createdConstraint.getValue().getOrder()); + + ArgumentCaptor updatedConstraint = ArgumentCaptor.forClass(XXConstraintDef.class); + Mockito.verify(xConstraintDao).update(updatedConstraint.capture()); + Assertions.assertEquals(Long.valueOf(2L), updatedConstraint.getValue().getItemId()); + Assertions.assertEquals(Integer.valueOf(1), updatedConstraint.getValue().getOrder()); + Mockito.verify(xConstraintDao).remove(existingRemove); + Mockito.verify(daoMgr, Mockito.never()).getXXPolicyRefCondition(); + } + + @Test + public void test264deleteServiceDef_removesEachConstraintDef() throws Exception { + setup(); + + RangerServiceDef serviceDef = new RangerServiceDef(); + serviceDef.setId(1L); + serviceDef.setName("agent"); + serviceDef.setVersion(1L); + Mockito.when(serviceDefService.read(1L)).thenReturn(serviceDef); + + XXServiceDao xServiceDao = Mockito.mock(XXServiceDao.class); + Mockito.when(daoMgr.getXXService()).thenReturn(xServiceDao); + Mockito.when(xServiceDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + + XXDataMaskTypeDefDao xDmDao = Mockito.mock(XXDataMaskTypeDefDao.class); + XXAccessTypeDefDao xAtdDao = Mockito.mock(XXAccessTypeDefDao.class); + XXContextEnricherDefDao xEnrDao = Mockito.mock(XXContextEnricherDefDao.class); + XXEnumDefDao xEnumDao = Mockito.mock(XXEnumDefDao.class); + XXPolicyConditionDefDao xCondDao = Mockito.mock(XXPolicyConditionDefDao.class); + XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); + XXResourceDefDao xResDao = Mockito.mock(XXResourceDefDao.class); + XXServiceConfigDefDao xCfgDao = Mockito.mock(XXServiceConfigDefDao.class); + Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDmDao); + Mockito.when(xDmDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAtdDao); + Mockito.when(xAtdDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); + Mockito.when(xEnrDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); + Mockito.when(xEnumDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); + Mockito.when(xCondDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResDao); + Mockito.when(xResDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xCfgDao); + Mockito.when(xCfgDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); + + XXConstraintDef requireApproval = new XXConstraintDef(); + requireApproval.setId(11L); + requireApproval.setName("requireApproval"); + XXConstraintDef maxRows = new XXConstraintDef(); + maxRows.setId(12L); + maxRows.setName("maxRows"); + List rows = new ArrayList<>(); + rows.add(requireApproval); + rows.add(maxRows); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); + Mockito.when(xConstraintDao.findByServiceDefId(1L)).thenReturn(rows); + + serviceDBStore.deleteServiceDef(1L, true); + + Mockito.verify(xConstraintDao).remove(requireApproval); + Mockito.verify(xConstraintDao).remove(maxRows); + } + @Test public void test234searchRangerPolicies_withServiceName() throws Exception { SearchFilter f = new SearchFilter(); diff --git a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java index 41d0be2d98d..15c93d243a1 100644 --- a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java +++ b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java @@ -27,6 +27,7 @@ import org.apache.ranger.db.RangerDaoManager; import org.apache.ranger.db.XXAccessTypeDefDao; import org.apache.ranger.db.XXAccessTypeDefGrantsDao; +import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; import org.apache.ranger.db.XXEnumDefDao; @@ -35,6 +36,7 @@ import org.apache.ranger.db.XXPortalUserDao; import org.apache.ranger.db.XXResourceDefDao; import org.apache.ranger.db.XXServiceConfigDefDao; +import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataMaskTypeDef; import org.apache.ranger.entity.XXEnumDef; @@ -71,6 +73,7 @@ import java.lang.reflect.Method; import java.util.ArrayList; +import java.util.Arrays; import java.util.Collections; import java.util.Date; import java.util.HashMap; @@ -295,6 +298,7 @@ public void test3PopulateViewBean() { Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(Mockito.mock(XXConstraintDefDao.class)); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(contextEnrichersList); @@ -493,6 +497,7 @@ public void test4getAllServiceDefs() { Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(Mockito.mock(XXConstraintDefDao.class)); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(contextEnrichersList); @@ -668,6 +673,7 @@ public void test5getPopulatedViewObject() { Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(Mockito.mock(XXConstraintDefDao.class)); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(contextEnrichersList); @@ -911,6 +917,71 @@ public void testValidateForUpdate() throws NoSuchMethodException { } } + @Test + public void test6PopulateViewBeanLoadsConstraintDefs() { + serviceDefService.bizUtil = Mockito.mock(RangerBizUtil.class); + serviceDefService.stringUtil = new StringUtil(); + + XXServiceDef serviceDef = serviceDef(); + XXPortalUser portalUser = new XXPortalUser(); + portalUser.setId(Id); + portalUser.setFirstName("Admin"); + + XXConstraintDef xConstraintDef = new XXConstraintDef(); + xConstraintDef.setId(Id); + xConstraintDef.setDefid(serviceDef.getId()); + xConstraintDef.setItemId(4L); + xConstraintDef.setName("requireApproval"); + xConstraintDef.setResources("[\"database\",\"udf\"]"); + xConstraintDef.setAccessTypes("[\"select\"]"); + xConstraintDef.setParameters("[{\"itemId\":1,\"name\":\"approver\",\"type\":\"user\",\"mandatory\":true}]"); + List xConstraintDefs = new ArrayList<>(); + xConstraintDefs.add(xConstraintDef); + + XXPortalUserDao xPortalUserDao = Mockito.mock(XXPortalUserDao.class); + XXServiceConfigDefDao xServiceConfigDefDao = Mockito.mock(XXServiceConfigDefDao.class); + XXResourceDefDao xResourceDefDao = Mockito.mock(XXResourceDefDao.class); + XXAccessTypeDefDao xAccessTypeDefDao = Mockito.mock(XXAccessTypeDefDao.class); + XXAccessTypeDefGrantsDao xAccessTypeDefGrantsDao = Mockito.mock(XXAccessTypeDefGrantsDao.class); + XXPolicyConditionDefDao xPolicyConditionDefDao = Mockito.mock(XXPolicyConditionDefDao.class); + XXConstraintDefDao xConstraintDefDao = Mockito.mock(XXConstraintDefDao.class); + XXContextEnricherDefDao xContextEnricherDefDao = Mockito.mock(XXContextEnricherDefDao.class); + XXEnumDefDao xEnumDefDao = Mockito.mock(XXEnumDefDao.class); + XXDataMaskTypeDefDao xDataMaskTypeDao = Mockito.mock(XXDataMaskTypeDefDao.class); + + Mockito.when(daoMgr.getXXPortalUser()).thenReturn(xPortalUserDao); + Mockito.when(xPortalUserDao.getById(Id)).thenReturn(portalUser); + Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xServiceConfigDefDao); + Mockito.when(xServiceConfigDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResourceDefDao); + Mockito.when(xResourceDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAccessTypeDefDao); + Mockito.when(xAccessTypeDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xAccessTypeDefGrantsDao); + Mockito.when(xAccessTypeDefGrantsDao.findImpliedGrantsByServiceDefId(serviceDef.getId())).thenReturn(Collections.emptyMap()); + Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); + Mockito.when(xPolicyConditionDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDefDao); + Mockito.when(xConstraintDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(xConstraintDefs); + Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); + Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDefDao); + Mockito.when(xEnumDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDataMaskTypeDao); + Mockito.when(xDataMaskTypeDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + + RangerServiceDef loaded = serviceDefService.populateViewBean(serviceDef); + + assertNotNull(loaded.getConstraintDefs()); + assertEquals(1, loaded.getConstraintDefs().size()); + assertEquals(Long.valueOf(4L), loaded.getConstraintDefs().get(0).getItemId()); + assertEquals("requireApproval", loaded.getConstraintDefs().get(0).getName()); + assertEquals(Arrays.asList("database", "udf"), loaded.getConstraintDefs().get(0).getResources()); + assertEquals(Collections.singletonList("select"), loaded.getConstraintDefs().get(0).getAccessTypes()); + assertEquals("approver", loaded.getConstraintDefs().get(0).getParameters().get(0).getName()); + assertEquals("user", loaded.getConstraintDefs().get(0).getParameters().get(0).getType()); + } + private boolean hasActionMatchesCondition(RangerServiceDef serviceDef) { if (serviceDef.getPolicyConditions() == null) { return false; diff --git a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java index b58f047c75c..ca2280a812f 100644 --- a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java +++ b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java @@ -29,6 +29,7 @@ import org.apache.ranger.db.XXEnumElementDefDao; import org.apache.ranger.db.XXResourceDefDao; import org.apache.ranger.entity.XXAccessTypeDef; +import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXEnumDef; import org.apache.ranger.entity.XXEnumElementDef; @@ -38,6 +39,8 @@ import org.apache.ranger.entity.XXServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintParamDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerContextEnricherDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumElementDef; @@ -64,7 +67,9 @@ import java.util.ArrayList; import java.util.Collections; import java.util.Date; +import java.util.HashMap; import java.util.List; +import java.util.Map; import static org.junit.jupiter.api.Assertions.assertThrows; @@ -589,6 +594,118 @@ public void test21searchRangerServiceDefs() { Assertions.assertNotNull(dbRangerServiceDefList); } + @Test + public void test22populateRangerConstraintDefRoundTrip() { + rangerServiceDefService.jsonUtil = new JSONUtil(); + + RangerConstraintParamDef approver = new RangerConstraintParamDef(); + approver.setItemId(1L); + approver.setName("approver"); + approver.setLabel("Approver"); + approver.setType("user"); + approver.setMandatory(true); + + RangerConstraintParamDef mode = new RangerConstraintParamDef(); + mode.setItemId(2L); + mode.setName("mode"); + mode.setType("enum"); + mode.setSubType("authType"); + mode.setMandatory(false); + mode.setDefaultValue("simple"); + + List resources = new ArrayList<>(); + resources.add("database"); + resources.add("udf"); + List accessTypes = new ArrayList<>(); + accessTypes.add("select"); + List parameters = new ArrayList<>(); + parameters.add(approver); + parameters.add(mode); + Map options = new HashMap<>(); + options.put("ui", "tab"); + + RangerConstraintDef constraintDef = new RangerConstraintDef(); + constraintDef.setItemId(4L); + constraintDef.setName("requireApproval"); + constraintDef.setLabel("Require approval"); + constraintDef.setDescription("Pause for approval"); + constraintDef.setRbKeyLabel("rb.label"); + constraintDef.setRbKeyDescription("rb.description"); + constraintDef.setResources(resources); + constraintDef.setAccessTypes(accessTypes); + constraintDef.setParameters(parameters); + constraintDef.setOptions(options); + + XXConstraintDef xConstraintDef = new XXConstraintDef(); + XXServiceDef serviceDef = new XXServiceDef(); + serviceDef.setId(Id); + Mockito.when((XXConstraintDef) rangerAuditFields.populateAuditFields(xConstraintDef, serviceDef)).thenReturn(xConstraintDef); + + XXConstraintDef stored = rangerServiceDefService.populateRangerConstraintDefToXX(constraintDef, xConstraintDef, serviceDef, 1); + Assertions.assertEquals(Integer.valueOf(0), stored.getOrder()); + Assertions.assertEquals(serviceDef.getId(), stored.getDefid()); + + RangerConstraintDef roundTrip = rangerServiceDefService.populateXXToRangerConstraintDef(stored); + Assertions.assertEquals(Long.valueOf(4L), roundTrip.getItemId()); + Assertions.assertEquals("requireApproval", roundTrip.getName()); + Assertions.assertEquals("Require approval", roundTrip.getLabel()); + Assertions.assertEquals("Pause for approval", roundTrip.getDescription()); + Assertions.assertEquals("rb.label", roundTrip.getRbKeyLabel()); + Assertions.assertEquals("rb.description", roundTrip.getRbKeyDescription()); + Assertions.assertEquals(resources, roundTrip.getResources()); + Assertions.assertEquals(accessTypes, roundTrip.getAccessTypes()); + Assertions.assertEquals("tab", roundTrip.getOptions().get("ui")); + Assertions.assertEquals(2, roundTrip.getParameters().size()); + + RangerConstraintParamDef approverOut = roundTrip.getParameters().get(0); + Assertions.assertEquals("approver", approverOut.getName()); + Assertions.assertEquals("user", approverOut.getType()); + Assertions.assertNull(approverOut.getSubType()); + Assertions.assertEquals(Boolean.TRUE, approverOut.getMandatory()); + + RangerConstraintParamDef modeOut = roundTrip.getParameters().get(1); + Assertions.assertEquals("mode", modeOut.getName()); + Assertions.assertEquals("enum", modeOut.getType()); + Assertions.assertEquals("authType", modeOut.getSubType()); + Assertions.assertEquals(Boolean.FALSE, modeOut.getMandatory()); + Assertions.assertEquals("simple", modeOut.getDefaultValue()); + } + + @Test + public void test23populateRangerConstraintDefToXXNullServiceDef() { + Mockito.when(restErrorUtil.createRESTException("RangerServiceDef cannot be null.", MessageEnums.DATA_NOT_FOUND)).thenThrow(new WebApplicationException()); + + assertThrows(WebApplicationException.class, () -> { + rangerServiceDefService.populateRangerConstraintDefToXX(new RangerConstraintDef(), new XXConstraintDef(), null, 1); + }); + } + + @Test + public void test24populateRangerConstraintDefNullListsStoredAsNull() { + rangerServiceDefService.jsonUtil = new JSONUtil(); + + RangerConstraintDef constraintDef = Mockito.spy(new RangerConstraintDef()); + constraintDef.setItemId(1L); + constraintDef.setName("requireApproval"); + Mockito.doReturn(null).when(constraintDef).getResources(); + Mockito.doReturn(null).when(constraintDef).getAccessTypes(); + + XXConstraintDef xConstraintDef = new XXConstraintDef(); + XXServiceDef serviceDef = new XXServiceDef(); + serviceDef.setId(Id); + Mockito.when((XXConstraintDef) rangerAuditFields.populateAuditFields(xConstraintDef, serviceDef)).thenReturn(xConstraintDef); + + XXConstraintDef stored = rangerServiceDefService.populateRangerConstraintDefToXX(constraintDef, xConstraintDef, serviceDef, 1); + + Assertions.assertNull(stored.getResources()); + Assertions.assertNull(stored.getAccessTypes()); + + RangerConstraintDef roundTrip = rangerServiceDefService.populateXXToRangerConstraintDef(stored); + + Assertions.assertTrue(roundTrip.getResources().isEmpty()); + Assertions.assertTrue(roundTrip.getAccessTypes().isEmpty()); + } + private RangerServiceDef rangerServiceDef() { List configs = new ArrayList<>(); List resources = new ArrayList<>(); diff --git a/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java b/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java index aedc02e2e5b..e1a8c5e0683 100644 --- a/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java +++ b/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java @@ -24,6 +24,7 @@ import org.apache.ranger.db.XXAssetDao; import org.apache.ranger.db.XXAuditMapDao; import org.apache.ranger.db.XXAuthSessionDao; +import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXCredentialStoreDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; @@ -117,6 +118,7 @@ public class TestXPortalUserService { @Mock private XXAccessTypeDefDao xxAccessTypeDefDao; @Mock private XXAccessTypeDefGrantsDao xxAccessTypeDefGrantsDao; @Mock private XXPolicyConditionDefDao xxPolicyConditionDefDao; + @Mock private XXConstraintDefDao xxConstraintDefDao; @Mock private XXContextEnricherDefDao xxContextEnricherDefDao; @Mock private XXEnumDefDao xxEnumDefDao; @Mock private XXEnumElementDefDao xxEnumElementDefDao; @@ -176,6 +178,7 @@ public void testUpdateXXPortalUserReferences_invokesAllDaosForAddedAndUpdatedBy( when(daoManager.getXXAccessTypeDef()).thenReturn(xxAccessTypeDefDao); when(daoManager.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); when(daoManager.getXXPolicyConditionDef()).thenReturn(xxPolicyConditionDefDao); + when(daoManager.getXXConstraintDef()).thenReturn(xxConstraintDefDao); when(daoManager.getXXContextEnricherDef()).thenReturn(xxContextEnricherDefDao); when(daoManager.getXXEnumDef()).thenReturn(xxEnumDefDao); when(daoManager.getXXEnumElementDef()).thenReturn(xxEnumElementDefDao); From 6a9d0f9597622cb161ef05601d7c240bad98d903 Mon Sep 17 00:00:00 2001 From: Vyom Mani Tiwari Date: Fri, 23 Oct 2026 11:32:29 +0530 Subject: [PATCH 2/3] RANGER-5851: Admin: persist constraintDefs of service definitions --- dev-support/checkstyle-suppressions.xml | 1 + .../current/ranger_core_db_mysql.sql | 29 +-- .../079-add-def_text-to-x_service_def.sql | 30 +++ .../patches/079-add-x_constraint_def.sql | 54 ---- .../current/ranger_core_db_oracle.sql | 31 +-- .../079-add-def_text-to-x_service_def.sql | 24 ++ .../patches/079-add-x_constraint_def.sql | 62 ----- .../current/ranger_core_db_postgres.sql | 31 +-- .../079-add-def_text-to-x_service_def.sql | 32 +++ .../patches/079-add-x_constraint_def.sql | 41 ---- .../current/ranger_core_db_sqlanywhere.sql | 34 +-- .../079-add-def_text-to-x_service_def.sql | 19 ++ .../patches/079-add-x_constraint_def.sql | 48 ---- .../current/ranger_core_db_sqlserver.sql | 48 +--- .../079-add-def_text-to-x_service_def.sql | 21 ++ .../patches/079-add-x_constraint_def.sql | 71 ------ .../org/apache/ranger/biz/ServiceDBStore.java | 108 ++------ .../ranger/db/RangerDaoManagerBase.java | 4 - .../apache/ranger/db/XXConstraintDefDao.java | 63 ----- .../apache/ranger/entity/XXConstraintDef.java | 230 ------------------ .../ranger/entity/XXServiceDefBase.java | 27 ++ .../patch/PatchForServiceDefJson_J10067.java | 134 ++++++++++ .../service/RangerServiceDefServiceBase.java | 165 +++++-------- .../ranger/service/XPortalUserService.java | 2 - .../resources/META-INF/jpa_named_queries.xml | 9 - .../main/resources/META-INF/persistence.xml | 1 - .../apache/ranger/biz/TestServiceDBStore.java | 227 +---------------- .../TestPatchForServiceDefJson_J10067.java | 113 +++++++++ .../service/TestRangerServiceDefService.java | 220 +++++++++++++---- .../TestRangerServiceDefServiceBase.java | 134 +++++----- .../service/TestXPortalUserService.java | 3 - 31 files changed, 726 insertions(+), 1290 deletions(-) create mode 100644 security-admin/db/mysql/patches/079-add-def_text-to-x_service_def.sql delete mode 100644 security-admin/db/mysql/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/oracle/patches/079-add-def_text-to-x_service_def.sql delete mode 100644 security-admin/db/oracle/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/postgres/patches/079-add-def_text-to-x_service_def.sql delete mode 100644 security-admin/db/postgres/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql delete mode 100644 security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql create mode 100644 security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql delete mode 100644 security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql delete mode 100644 security-admin/src/main/java/org/apache/ranger/db/XXConstraintDefDao.java delete mode 100644 security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java create mode 100644 security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceDefJson_J10067.java create mode 100644 security-admin/src/test/java/org/apache/ranger/patch/TestPatchForServiceDefJson_J10067.java diff --git a/dev-support/checkstyle-suppressions.xml b/dev-support/checkstyle-suppressions.xml index f20f609e94a..b82da722ad0 100644 --- a/dev-support/checkstyle-suppressions.xml +++ b/dev-support/checkstyle-suppressions.xml @@ -93,4 +93,5 @@ + diff --git a/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql b/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql index 60d25a77726..0818c859033 100644 --- a/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql +++ b/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql @@ -59,7 +59,6 @@ DROP TABLE IF EXISTS `x_service_config_map`; DROP TABLE IF EXISTS `x_enum_element_def`; DROP TABLE IF EXISTS `x_enum_def`; DROP TABLE IF EXISTS `x_context_enricher_def`; -DROP TABLE IF EXISTS `x_constraint_def`; DROP TABLE IF EXISTS `x_policy_condition_def`; DROP TABLE IF EXISTS `x_access_type_def_grants`; DROP TABLE IF EXISTS `x_access_type_def`; @@ -534,6 +533,7 @@ CREATE TABLE `x_service_def` ( `rb_key_description` varchar(1024) DEFAULT NULL, `is_enabled` tinyint DEFAULT 1, `def_options` VARCHAR(1024) DEFAULT NULL NULL, +`def_text` MEDIUMTEXT NULL DEFAULT NULL, primary key (`id`), KEY `x_service_def_added_by_id` (`added_by_id`), KEY `x_service_def_upd_by_id` (`upd_by_id`), @@ -828,31 +828,6 @@ CONSTRAINT `x_policy_condition_def_FK_added_by_id` FOREIGN KEY (`added_by_id`) R CONSTRAINT `x_policy_condition_def_FK_upd_by_id` FOREIGN KEY (`upd_by_id`) REFERENCES `x_portal_user` (`id`) )ROW_FORMAT=DYNAMIC; -CREATE TABLE `x_constraint_def` ( -`id` bigint(20) NOT NULL AUTO_INCREMENT , -`guid` varchar(1024) DEFAULT NULL, -`create_time` datetime DEFAULT NULL, -`update_time` datetime DEFAULT NULL, -`added_by_id` bigint(20) DEFAULT NULL, -`upd_by_id` bigint(20) DEFAULT NULL, -`def_id` bigint(20) NOT NULL, -`item_id` bigint(20) NOT NULL, -`name` varchar(1024) DEFAULT NULL, -`label` varchar(1024) DEFAULT NULL, -`description` varchar(1024) DEFAULT NULL, -`rb_key_label` varchar(1024) DEFAULT NULL, -`rb_key_description` varchar(1024) DEFAULT NULL, -`resources` mediumtext DEFAULT NULL, -`access_types` mediumtext DEFAULT NULL, -`parameters` mediumtext DEFAULT NULL, -`options` mediumtext DEFAULT NULL, -`sort_order` int DEFAULT 0, -primary key (`id`) , -CONSTRAINT `x_constraint_def_FK_defid` FOREIGN KEY (`def_id`) REFERENCES `x_service_def` (`id`), -CONSTRAINT `x_constraint_def_FK_added_by_id` FOREIGN KEY (`added_by_id`) REFERENCES `x_portal_user` (`id`), -CONSTRAINT `x_constraint_def_FK_upd_by_id` FOREIGN KEY (`upd_by_id`) REFERENCES `x_portal_user` (`id`) -)ROW_FORMAT=DYNAMIC; - CREATE TABLE `x_context_enricher_def` ( `id` bigint(20) NOT NULL AUTO_INCREMENT , `guid` varchar(1024) DEFAULT NULL, @@ -1530,7 +1505,6 @@ CREATE INDEX x_resource_def_IDX_def_id ON x_resource_def(def_id); CREATE INDEX x_access_type_def_IDX_def_id ON x_access_type_def(def_id); CREATE INDEX x_access_type_def_IDX_grants_atd_id ON x_access_type_def_grants(atd_id); CREATE INDEX x_context_enricher_def_IDX_def_id ON x_context_enricher_def(def_id); -CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); CREATE INDEX x_enum_def_IDX_def_id ON x_enum_def(def_id); CREATE INDEX x_enum_element_def_IDX_enum_def_id ON x_enum_element_def(enum_def_id); CREATE INDEX x_service_config_map_IDX_service ON x_service_config_map(service); @@ -2057,4 +2031,5 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10064',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10065',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10066',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10067',UTC_TIMESTAMP(),'Ranger 3.0.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',UTC_TIMESTAMP(),'Ranger 1.0.0',UTC_TIMESTAMP(),'localhost','Y'); diff --git a/security-admin/db/mysql/patches/079-add-def_text-to-x_service_def.sql b/security-admin/db/mysql/patches/079-add-def_text-to-x_service_def.sql new file mode 100644 index 00000000000..7acdb89053d --- /dev/null +++ b/security-admin/db/mysql/patches/079-add-def_text-to-x_service_def.sql @@ -0,0 +1,30 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +drop procedure if exists add_def_text_in_x_service_def; + +delimiter ;; +create procedure add_def_text_in_x_service_def() begin + +if not exists (select * from information_schema.columns where table_schema=database() and table_name = 'x_service_def' and column_name='def_text') then + ALTER TABLE x_service_def ADD def_text MEDIUMTEXT NULL DEFAULT NULL; +end if; + +end;; + +delimiter ; +call add_def_text_in_x_service_def(); + +drop procedure if exists add_def_text_in_x_service_def; diff --git a/security-admin/db/mysql/patches/079-add-x_constraint_def.sql b/security-admin/db/mysql/patches/079-add-x_constraint_def.sql deleted file mode 100644 index 392f68ad387..00000000000 --- a/security-admin/db/mysql/patches/079-add-x_constraint_def.sql +++ /dev/null @@ -1,54 +0,0 @@ --- Licensed to the Apache Software Foundation (ASF) under one or more --- contributor license agreements. See the NOTICE file distributed with --- this work for additional information regarding copyright ownership. --- The ASF licenses this file to You under the Apache License, Version 2.0 --- (the "License"); you may not use this file except in compliance with --- the License. You may obtain a copy of the License at --- --- http://www.apache.org/licenses/LICENSE-2.0 --- --- Unless required by applicable law or agreed to in writing, software --- distributed under the License is distributed on an "AS IS" BASIS, --- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. --- See the License for the specific language governing permissions and --- limitations under the License. - -CREATE TABLE IF NOT EXISTS `x_constraint_def` ( -`id` bigint(20) NOT NULL AUTO_INCREMENT, -`guid` varchar(1024) DEFAULT NULL, -`create_time` datetime DEFAULT NULL, -`update_time` datetime DEFAULT NULL, -`added_by_id` bigint(20) DEFAULT NULL, -`upd_by_id` bigint(20) DEFAULT NULL, -`def_id` bigint(20) NOT NULL, -`item_id` bigint(20) NOT NULL, -`name` varchar(1024) DEFAULT NULL, -`label` varchar(1024) DEFAULT NULL, -`description` varchar(1024) DEFAULT NULL, -`rb_key_label` varchar(1024) DEFAULT NULL, -`rb_key_description` varchar(1024) DEFAULT NULL, -`resources` mediumtext DEFAULT NULL, -`access_types` mediumtext DEFAULT NULL, -`parameters` mediumtext DEFAULT NULL, -`options` mediumtext DEFAULT NULL, -`sort_order` int DEFAULT 0, -primary key (`id`), -CONSTRAINT `x_constraint_def_FK_defid` FOREIGN KEY (`def_id`) REFERENCES `x_service_def` (`id`), -CONSTRAINT `x_constraint_def_FK_added_by_id` FOREIGN KEY (`added_by_id`) REFERENCES `x_portal_user` (`id`), -CONSTRAINT `x_constraint_def_FK_upd_by_id` FOREIGN KEY (`upd_by_id`) REFERENCES `x_portal_user` (`id`) -)ROW_FORMAT=DYNAMIC; - -drop procedure if exists create_index_x_constraint_def; - -delimiter ;; -create procedure create_index_x_constraint_def() begin -if exists (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=DATABASE() AND table_name='x_constraint_def') then - if not exists (SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE table_schema=DATABASE() AND table_name='x_constraint_def' AND index_name='x_constraint_def_IDX_def_id') then - CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); - end if; -end if; -end;; - -delimiter ; -call create_index_x_constraint_def(); -drop procedure if exists create_index_x_constraint_def; diff --git a/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql b/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql index 6e5e09c162e..ec8dfff613c 100644 --- a/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql +++ b/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql @@ -58,7 +58,6 @@ call spdropsequence('X_ENUM_ELEMENT_DEF_SEQ'); call spdropsequence('X_RESOURCE_DEF_SEQ'); call spdropsequence('X_ACCESS_TYPE_DEF_SEQ'); call spdropsequence('X_ACCESS_TYPE_DEF_GRANTS_SEQ'); -call spdropsequence('X_CONSTRAINT_DEF_SEQ'); call spdropsequence('X_POLICY_CONDITION_DEF_SEQ'); call spdropsequence('X_ENUM_DEF_SEQ'); call spdropsequence('X_SERVICE_CONFIG_MAP_SEQ'); @@ -140,7 +139,6 @@ CREATE SEQUENCE X_RESOURCE_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ACCESS_TYPE_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ACCESS_TYPE_DEF_GRANTS_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_POLICY_CONDITION_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; -CREATE SEQUENCE X_CONSTRAINT_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ENUM_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_ENUM_ELEMENT_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; CREATE SEQUENCE X_SERVICE_CONFIG_MAP_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE; @@ -272,7 +270,6 @@ call spdroptable('x_service_config_map'); call spdroptable('x_enum_element_def'); call spdroptable('x_enum_def'); call spdroptable('x_context_enricher_def'); -call spdroptable('x_constraint_def'); call spdroptable('x_policy_condition_def'); call spdroptable('x_access_type_def_grants'); call spdroptable('x_access_type_def'); @@ -665,6 +662,7 @@ rb_key_label VARCHAR(1024) DEFAULT NULL NULL, rb_key_description VARCHAR(1024) DEFAULT NULL NULL, is_enabled NUMBER(1) DEFAULT '1' NULL, def_options VARCHAR(1024) DEFAULT NULL NULL, +def_text CLOB DEFAULT NULL NULL, PRIMARY KEY (id), CONSTRAINT x_service_def_FK_added_by_id FOREIGN KEY (added_by_id) REFERENCES x_portal_user (id), CONSTRAINT x_service_def_FK_upd_by_id FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id) @@ -952,31 +950,6 @@ CONSTRAINT x_policy_cond_def_FK_added_by FOREIGN KEY (added_by_id) REFERENCES x_ CONSTRAINT x_policy_cond_def_FK_upd_by FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id) ); -CREATE TABLE x_constraint_def ( -id NUMBER(20) NOT NULL, -guid VARCHAR(1024) DEFAULT NULL NULL, -create_time DATE DEFAULT NULL NULL, -update_time DATE DEFAULT NULL NULL, -added_by_id NUMBER(20) DEFAULT NULL NULL, -upd_by_id NUMBER(20) DEFAULT NULL NULL, -def_id NUMBER(20) NOT NULL, -item_id NUMBER(20) NOT NULL, -name VARCHAR(1024) DEFAULT NULL NULL, -label VARCHAR(1024) DEFAULT NULL NULL, -description VARCHAR(1024) DEFAULT NULL NULL, -rb_key_label VARCHAR(1024) DEFAULT NULL NULL, -rb_key_description VARCHAR(1024) DEFAULT NULL NULL, -resources CLOB DEFAULT NULL NULL, -access_types CLOB DEFAULT NULL NULL, -parameters CLOB DEFAULT NULL NULL, -options CLOB DEFAULT NULL NULL, -sort_order NUMBER(10) DEFAULT '0' NULL, -primary key (id), -CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY (def_id) REFERENCES x_service_def (id), -CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY (added_by_id) REFERENCES x_portal_user (id), -CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id) -); - CREATE TABLE x_context_enricher_def( id NUMBER(20) NOT NULL, guid varchar(1024) DEFAULT NULL NULL, @@ -1750,7 +1723,6 @@ CREATE INDEX x_resource_def_IDX_def_id ON x_resource_def(def_id); CREATE INDEX x_access_type_def_IDX_def_id ON x_access_type_def(def_id); CREATE INDEX x_atd_grants_IDX_atdid ON x_access_type_def_grants(atd_id); CREATE INDEX x_cont_enr_def_IDX_defid ON x_context_enricher_def(def_id); -CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); CREATE INDEX x_enum_def_IDX_def_id ON x_enum_def(def_id); CREATE INDEX x_enum_element_def_IDX_defid ON x_enum_element_def(enum_def_id); CREATE INDEX x_service_conf_map_IDX_service ON x_service_config_map(service); @@ -2283,5 +2255,6 @@ INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,act INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10064',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10065',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10066',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); +INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10067',sys_extract_utc(systimestamp),'Ranger 3.0.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'JAVA_PATCHES',sys_extract_utc(systimestamp),'Ranger 1.0.0',sys_extract_utc(systimestamp),'localhost','Y'); commit; diff --git a/security-admin/db/oracle/patches/079-add-def_text-to-x_service_def.sql b/security-admin/db/oracle/patches/079-add-def_text-to-x_service_def.sql new file mode 100644 index 00000000000..70d084fcaea --- /dev/null +++ b/security-admin/db/oracle/patches/079-add-def_text-to-x_service_def.sql @@ -0,0 +1,24 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +DECLARE + v_count number:=0; +BEGIN + select count(*) into v_count from user_tab_cols where table_name='X_SERVICE_DEF' and column_name='DEF_TEXT'; + if (v_count = 0) then + execute immediate 'ALTER TABLE x_service_def ADD def_text CLOB DEFAULT NULL NULL'; + end if; + commit; +END;/ diff --git a/security-admin/db/oracle/patches/079-add-x_constraint_def.sql b/security-admin/db/oracle/patches/079-add-x_constraint_def.sql deleted file mode 100644 index 9e98951419a..00000000000 --- a/security-admin/db/oracle/patches/079-add-x_constraint_def.sql +++ /dev/null @@ -1,62 +0,0 @@ --- Licensed to the Apache Software Foundation (ASF) under one or more --- contributor license agreements. See the NOTICE file distributed with --- this work for additional information regarding copyright ownership. --- The ASF licenses this file to You under the Apache License, Version 2.0 --- (the "License"); you may not use this file except in compliance with --- the License. You may obtain a copy of the License at --- --- http://www.apache.org/licenses/LICENSE-2.0 --- --- Unless required by applicable law or agreed to in writing, software --- distributed under the License is distributed on an "AS IS" BASIS, --- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. --- See the License for the specific language governing permissions and --- limitations under the License. - -DECLARE - v_table_count NUMBER := 0; - v_seq_count NUMBER := 0; - v_idx_count NUMBER := 0; -BEGIN - SELECT count(*) INTO v_table_count FROM user_tables WHERE table_name = 'X_CONSTRAINT_DEF'; - IF (v_table_count = 0) THEN - EXECUTE IMMEDIATE ' - CREATE TABLE x_constraint_def ( - id NUMBER(20) NOT NULL, - guid VARCHAR(1024) DEFAULT NULL NULL, - create_time DATE DEFAULT NULL NULL, - update_time DATE DEFAULT NULL NULL, - added_by_id NUMBER(20) DEFAULT NULL NULL, - upd_by_id NUMBER(20) DEFAULT NULL NULL, - def_id NUMBER(20) NOT NULL, - item_id NUMBER(20) NOT NULL, - name VARCHAR(1024) DEFAULT NULL NULL, - label VARCHAR(1024) DEFAULT NULL NULL, - description VARCHAR(1024) DEFAULT NULL NULL, - rb_key_label VARCHAR(1024) DEFAULT NULL NULL, - rb_key_description VARCHAR(1024) DEFAULT NULL NULL, - resources CLOB DEFAULT NULL NULL, - access_types CLOB DEFAULT NULL NULL, - parameters CLOB DEFAULT NULL NULL, - options CLOB DEFAULT NULL NULL, - sort_order NUMBER(10) DEFAULT ''0'' NULL, - primary key (id), - CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY (def_id) REFERENCES x_service_def (id), - CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY (added_by_id) REFERENCES x_portal_user (id), - CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY (upd_by_id) REFERENCES x_portal_user (id) - )'; - END IF; - - SELECT count(*) INTO v_seq_count FROM user_sequences WHERE sequence_name = 'X_CONSTRAINT_DEF_SEQ'; - IF (v_seq_count = 0) THEN - EXECUTE IMMEDIATE 'CREATE SEQUENCE X_CONSTRAINT_DEF_SEQ START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE'; - END IF; - - SELECT count(*) INTO v_idx_count FROM user_indexes WHERE index_name = 'X_CONSTRAINT_DEF_IDX_DEF_ID'; - IF (v_idx_count = 0) THEN - EXECUTE IMMEDIATE 'CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id)'; - END IF; -END; -/ - -commit; diff --git a/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql b/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql index de89dc19366..019ab57820c 100644 --- a/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql +++ b/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql @@ -58,7 +58,6 @@ DROP TABLE IF EXISTS x_service_config_map CASCADE; DROP TABLE IF EXISTS x_enum_element_def CASCADE; DROP TABLE IF EXISTS x_enum_def CASCADE; DROP TABLE IF EXISTS x_context_enricher_def CASCADE; -DROP TABLE IF EXISTS x_constraint_def CASCADE; DROP TABLE IF EXISTS x_policy_condition_def CASCADE; DROP TABLE IF EXISTS x_access_type_def_grants CASCADE; DROP TABLE IF EXISTS x_access_type_def CASCADE; @@ -144,7 +143,6 @@ DROP SEQUENCE IF EXISTS x_service_config_map_seq; DROP SEQUENCE IF EXISTS x_enum_element_def_seq; DROP SEQUENCE IF EXISTS x_enum_def_seq; DROP SEQUENCE IF EXISTS x_context_enricher_def_seq; -DROP SEQUENCE IF EXISTS x_constraint_def_seq; DROP SEQUENCE IF EXISTS x_policy_condition_def_seq; DROP SEQUENCE IF EXISTS x_access_type_def_grants_seq; DROP SEQUENCE IF EXISTS x_access_type_def_seq; @@ -551,6 +549,7 @@ rb_key_label VARCHAR(1024) DEFAULT NULL NULL, rb_key_description VARCHAR(1024) DEFAULT NULL NULL, is_enabled BOOLEAN DEFAULT '1' NULL, def_options VARCHAR(1024) DEFAULT NULL NULL, +def_text TEXT DEFAULT NULL NULL, PRIMARY KEY(id), CONSTRAINT x_service_def_FK_added_by_id FOREIGN KEY(added_by_id) REFERENCES x_portal_user(id), CONSTRAINT x_service_def_FK_upd_by_id FOREIGN KEY(upd_by_id) REFERENCES x_portal_user(id) @@ -795,32 +794,6 @@ CONSTRAINT x_policy_cond_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES x_p CONSTRAINT x_policy_cond_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES x_portal_user(id) ); -CREATE SEQUENCE x_constraint_def_seq; -CREATE TABLE x_constraint_def( -id BIGINT DEFAULT nextval('x_constraint_def_seq'::regclass), -guid VARCHAR(1024) DEFAULT NULL NULL, -create_time TIMESTAMP DEFAULT NULL NULL, -update_time TIMESTAMP DEFAULT NULL NULL, -added_by_id BIGINT DEFAULT NULL NULL, -upd_by_id BIGINT DEFAULT NULL NULL, -def_id BIGINT NOT NULL, -item_id BIGINT NOT NULL, -name VARCHAR(1024) DEFAULT NULL NULL, -label VARCHAR(1024) DEFAULT NULL NULL, -description VARCHAR(1024) DEFAULT NULL NULL, -rb_key_label VARCHAR(1024) DEFAULT NULL NULL, -rb_key_description VARCHAR(1024) DEFAULT NULL NULL, -resources TEXT DEFAULT NULL NULL, -access_types TEXT DEFAULT NULL NULL, -parameters TEXT DEFAULT NULL NULL, -options TEXT DEFAULT NULL NULL, -sort_order INT DEFAULT '0' NULL, -primary key(id), -CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id) REFERENCES x_service_def(id), -CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES x_portal_user(id), -CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES x_portal_user(id) -); - CREATE SEQUENCE x_context_enricher_def_seq; CREATE TABLE x_context_enricher_def( id BIGINT DEFAULT nextval('x_context_enricher_def_seq'::regclass), @@ -1970,7 +1943,6 @@ CREATE INDEX x_resource_def_IDX_def_id ON x_resource_def(def_id); CREATE INDEX x_access_type_def_IDX_def_id ON x_access_type_def(def_id); CREATE INDEX x_access_type_def_IDX_grants_atd_id ON x_access_type_def_grants(atd_id); CREATE INDEX x_context_enricher_def_IDX_def_id ON x_context_enricher_def(def_id); -CREATE INDEX x_constraint_def_IDX_def_id ON x_constraint_def(def_id); CREATE INDEX x_enum_def_IDX_def_id ON x_enum_def(def_id); CREATE INDEX x_enum_element_def_IDX_enum_def_id ON x_enum_element_def(enum_def_id); CREATE INDEX x_service_config_map_IDX_service ON x_service_config_map(service); @@ -2216,6 +2188,7 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10064',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10065',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10066',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10067',current_timestamp,'Ranger 3.0.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',current_timestamp,'Ranger 1.0.0',current_timestamp,'localhost','Y'); DROP VIEW IF EXISTS vx_principal; diff --git a/security-admin/db/postgres/patches/079-add-def_text-to-x_service_def.sql b/security-admin/db/postgres/patches/079-add-def_text-to-x_service_def.sql new file mode 100644 index 00000000000..30e74e03e19 --- /dev/null +++ b/security-admin/db/postgres/patches/079-add-def_text-to-x_service_def.sql @@ -0,0 +1,32 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +select 'delimiter start'; +CREATE OR REPLACE FUNCTION add_def_text_in_x_service_def() +RETURNS void AS $$ +DECLARE + v_column_exists integer := 0; +BEGIN + select count(*) into v_column_exists from pg_attribute where attrelid in(select oid from pg_class where relname='x_service_def') and attname='def_text'; + IF v_column_exists = 0 THEN + ALTER TABLE x_service_def ADD COLUMN def_text TEXT DEFAULT NULL NULL; + END IF; +END; +$$ LANGUAGE plpgsql; +select 'delimiter end'; + +select add_def_text_in_x_service_def(); +select 'delimiter end'; +commit; diff --git a/security-admin/db/postgres/patches/079-add-x_constraint_def.sql b/security-admin/db/postgres/patches/079-add-x_constraint_def.sql deleted file mode 100644 index f2fcc87210e..00000000000 --- a/security-admin/db/postgres/patches/079-add-x_constraint_def.sql +++ /dev/null @@ -1,41 +0,0 @@ --- Licensed to the Apache Software Foundation (ASF) under one or more --- contributor license agreements. See the NOTICE file distributed with --- this work for additional information regarding copyright ownership. --- The ASF licenses this file to You under the Apache License, Version 2.0 --- (the "License"); you may not use this file except in compliance with --- the License. You may obtain a copy of the License at --- --- http://www.apache.org/licenses/LICENSE-2.0 --- --- Unless required by applicable law or agreed to in writing, software --- distributed under the License is distributed on an "AS IS" BASIS, --- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. --- See the License for the specific language governing permissions and --- limitations under the License. - -CREATE SEQUENCE IF NOT EXISTS x_constraint_def_seq; -CREATE TABLE IF NOT EXISTS x_constraint_def( -id BIGINT DEFAULT nextval('x_constraint_def_seq'::regclass), -guid VARCHAR(1024) DEFAULT NULL NULL, -create_time TIMESTAMP DEFAULT NULL NULL, -update_time TIMESTAMP DEFAULT NULL NULL, -added_by_id BIGINT DEFAULT NULL NULL, -upd_by_id BIGINT DEFAULT NULL NULL, -def_id BIGINT NOT NULL, -item_id BIGINT NOT NULL, -name VARCHAR(1024) DEFAULT NULL NULL, -label VARCHAR(1024) DEFAULT NULL NULL, -description VARCHAR(1024) DEFAULT NULL NULL, -rb_key_label VARCHAR(1024) DEFAULT NULL NULL, -rb_key_description VARCHAR(1024) DEFAULT NULL NULL, -resources TEXT DEFAULT NULL NULL, -access_types TEXT DEFAULT NULL NULL, -parameters TEXT DEFAULT NULL NULL, -options TEXT DEFAULT NULL NULL, -sort_order INT DEFAULT '0' NULL, -primary key(id), -CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id) REFERENCES x_service_def(id), -CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES x_portal_user(id), -CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES x_portal_user(id) -); -CREATE INDEX IF NOT EXISTS x_constraint_def_IDX_def_id ON x_constraint_def(def_id); diff --git a/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql b/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql index 4468d794df2..cac26327a5d 100644 --- a/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql +++ b/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql @@ -126,8 +126,6 @@ call dbo.removeForeignKeysAndTable('x_enum_def') GO call dbo.removeForeignKeysAndTable('x_context_enricher_def') GO -call dbo.removeForeignKeysAndTable('x_constraint_def') -GO call dbo.removeForeignKeysAndTable('x_policy_condition_def') GO call dbo.removeForeignKeysAndTable('x_access_type_def_grants') @@ -499,6 +497,7 @@ create table dbo.x_service_def( rb_key_description varchar(1024) DEFAULT NULL NULL, is_enabled tinyint DEFAULT 1 NULL, def_options varchar(1024) DEFAULT NULL NULL, + def_text text DEFAULT NULL NULL, CONSTRAINT x_service_def_PK_id PRIMARY KEY CLUSTERED(id) ) GO @@ -703,28 +702,6 @@ create table dbo.x_policy_condition_def ( CONSTRAINT x_policy_condition_def_grants_PK_id PRIMARY KEY CLUSTERED(id) ) GO -create table dbo.x_constraint_def ( - id bigint IDENTITY NOT NULL, - guid varchar(1024) DEFAULT NULL NULL, - create_time datetime DEFAULT NULL NULL, - update_time datetime DEFAULT NULL NULL, - added_by_id bigint DEFAULT NULL NULL, - upd_by_id bigint DEFAULT NULL NULL, - def_id bigint NOT NULL, - item_id bigint NOT NULL, - name varchar(1024) DEFAULT NULL NULL, - label varchar(1024) DEFAULT NULL NULL, - description varchar(1024) DEFAULT NULL NULL, - rb_key_label varchar(1024) DEFAULT NULL NULL, - rb_key_description varchar(1024) DEFAULT NULL NULL, - resources text DEFAULT NULL NULL, - access_types text DEFAULT NULL NULL, - parameters text DEFAULT NULL NULL, - options text DEFAULT NULL NULL, - sort_order int DEFAULT 0 NULL, - CONSTRAINT x_constraint_def_PK_id PRIMARY KEY CLUSTERED(id) -) -GO create table dbo.x_context_enricher_def( id bigint IDENTITY NOT NULL, guid varchar(1024) DEFAULT NULL NULL, @@ -1505,12 +1482,6 @@ ALTER TABLE dbo.x_policy_condition_def ADD CONSTRAINT x_policy_condition_def_FK_ GO ALTER TABLE dbo.x_policy_condition_def ADD CONSTRAINT x_policy_condition_def_FK_upd_by FOREIGN KEY(upd_by_id)REFERENCES dbo.x_portal_user (id) GO -ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id)REFERENCES dbo.x_service_def (id) -GO -ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id)REFERENCES dbo.x_portal_user (id) -GO -ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id)REFERENCES dbo.x_portal_user (id) -GO ALTER TABLE dbo.x_context_enricher_def ADD CONSTRAINT x_context_enricher_def_FK_defid FOREIGN KEY(def_id)REFERENCES dbo.x_service_def (id) GO ALTER TABLE dbo.x_context_enricher_def ADD CONSTRAINT x_context_enricher_def_FK_added_by_id FOREIGN KEY(added_by_id)REFERENCES dbo.x_portal_user (id) @@ -1981,8 +1952,6 @@ CREATE NONCLUSTERED INDEX x_access_type_def_IDX_grants_atd_id ON dbo.x_access_ty GO CREATE NONCLUSTERED INDEX x_context_enricher_def_IDX_def_id ON dbo.x_context_enricher_def(def_id ASC) GO -CREATE NONCLUSTERED INDEX x_constraint_def_IDX_def_id ON dbo.x_constraint_def(def_id ASC) -GO CREATE NONCLUSTERED INDEX x_enum_def_IDX_def_id ON dbo.x_enum_def(def_id ASC) GO CREATE NONCLUSTERED INDEX x_enum_element_def_IDX_enum_def_id ON dbo.x_enum_element_def(enum_def_id ASC) @@ -2453,6 +2422,7 @@ GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10065',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10066',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10067',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',CURRENT_TIMESTAMP,'Ranger 1.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO diff --git a/security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql b/security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql new file mode 100644 index 00000000000..9cdae886fa5 --- /dev/null +++ b/security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql @@ -0,0 +1,19 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +IF NOT EXISTS(select * from SYS.SYSCOLUMNS where tname = 'x_service_def' and cname = 'def_text') THEN + ALTER TABLE dbo.x_service_def ADD def_text text DEFAULT NULL NULL; +END IF; +GO diff --git a/security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql b/security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql deleted file mode 100644 index 12cff3fb528..00000000000 --- a/security-admin/db/sqlanywhere/patches/079-add-x_constraint_def.sql +++ /dev/null @@ -1,48 +0,0 @@ --- Licensed to the Apache Software Foundation (ASF) under one or more --- contributor license agreements. See the NOTICE file distributed with --- this work for additional information regarding copyright ownership. --- The ASF licenses this file to You under the Apache License, Version 2.0 --- (the "License"); you may not use this file except in compliance with --- the License. You may obtain a copy of the License at --- --- http://www.apache.org/licenses/LICENSE-2.0 --- --- Unless required by applicable law or agreed to in writing, software --- distributed under the License is distributed on an "AS IS" BASIS, --- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. --- See the License for the specific language governing permissions and --- limitations under the License. - -BEGIN - IF NOT EXISTS(SELECT * FROM SYS.SYSTABLE WHERE table_name = 'x_constraint_def') THEN - CREATE TABLE dbo.x_constraint_def ( - id bigint IDENTITY NOT NULL, - guid varchar(1024) DEFAULT NULL NULL, - create_time datetime DEFAULT NULL NULL, - update_time datetime DEFAULT NULL NULL, - added_by_id bigint DEFAULT NULL NULL, - upd_by_id bigint DEFAULT NULL NULL, - def_id bigint NOT NULL, - item_id bigint NOT NULL, - name varchar(1024) DEFAULT NULL NULL, - label varchar(1024) DEFAULT NULL NULL, - description varchar(1024) DEFAULT NULL NULL, - rb_key_label varchar(1024) DEFAULT NULL NULL, - rb_key_description varchar(1024) DEFAULT NULL NULL, - resources text DEFAULT NULL NULL, - access_types text DEFAULT NULL NULL, - parameters text DEFAULT NULL NULL, - options text DEFAULT NULL NULL, - sort_order int DEFAULT 0 NULL, - CONSTRAINT x_constraint_def_PK_id PRIMARY KEY CLUSTERED(id) - ); - - ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_defid FOREIGN KEY(def_id) REFERENCES dbo.x_service_def (id); - ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_added_by FOREIGN KEY(added_by_id) REFERENCES dbo.x_portal_user (id); - ALTER TABLE dbo.x_constraint_def ADD CONSTRAINT x_constraint_def_FK_upd_by FOREIGN KEY(upd_by_id) REFERENCES dbo.x_portal_user (id); - END IF; -END -GO - -CREATE INDEX IF NOT EXISTS x_constraint_def_IDX_def_id ON dbo.x_constraint_def(def_id ASC) -GO diff --git a/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql b/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql index 4387dddc12f..fef115ed7d8 100644 --- a/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql +++ b/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql @@ -237,10 +237,6 @@ IF (OBJECT_ID('x_atd_grants_FK_atdid') IS NOT NULL) BEGIN ALTER TABLE [dbo].[x_access_type_def_grants] DROP CONSTRAINT x_atd_grants_FK_atdid END -IF (OBJECT_ID('x_constraint_def_FK_defid') IS NOT NULL) -BEGIN - ALTER TABLE [dbo].[x_constraint_def] DROP CONSTRAINT x_constraint_def_FK_defid -END IF (OBJECT_ID('x_policy_condition_def_FK_defid') IS NOT NULL) BEGIN ALTER TABLE [dbo].[x_policy_condition_def] DROP CONSTRAINT x_policy_condition_def_FK_defid @@ -914,10 +910,6 @@ IF (OBJECT_ID('x_context_enricher_def') IS NOT NULL) BEGIN DROP TABLE [dbo].[x_context_enricher_def] END -IF (OBJECT_ID('x_constraint_def') IS NOT NULL) -BEGIN - DROP TABLE [dbo].[x_constraint_def] -END IF (OBJECT_ID('x_policy_condition_def') IS NOT NULL) BEGIN DROP TABLE [dbo].[x_policy_condition_def] @@ -1505,6 +1497,7 @@ CREATE TABLE [dbo].[x_service_def]( [rb_key_description] [varchar](1024) DEFAULT NULL NULL, [is_enabled] [tinyint] DEFAULT 1 NULL, [def_options] [varchar](1024) DEFAULT NULL NULL, + [def_text] [nvarchar](max) DEFAULT NULL NULL, PRIMARY KEY CLUSTERED ( [id] ASC @@ -1784,30 +1777,6 @@ CREATE TABLE [dbo].[x_policy_condition_def] ( [id] ASC )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY] ) ON [PRIMARY] -CREATE TABLE [dbo].[x_constraint_def] ( - [id] [bigint] IDENTITY(1,1) NOT NULL, - [guid] [varchar](1024) DEFAULT NULL NULL, - [create_time] [datetime2] DEFAULT NULL NULL, - [update_time] [datetime2] DEFAULT NULL NULL, - [added_by_id] [bigint] DEFAULT NULL NULL, - [upd_by_id] [bigint] DEFAULT NULL NULL, - [def_id] [bigint] NOT NULL, - [item_id] [bigint] NOT NULL, - [name] [varchar](1024) DEFAULT NULL NULL, - [label] [varchar](1024) DEFAULT NULL NULL, - [description] [varchar](1024) DEFAULT NULL NULL, - [rb_key_label] [varchar](1024) DEFAULT NULL NULL, - [rb_key_description] [varchar](1024) DEFAULT NULL NULL, - [resources] [nvarchar](max) DEFAULT NULL NULL, - [access_types] [nvarchar](max) DEFAULT NULL NULL, - [parameters] [nvarchar](max) DEFAULT NULL NULL, - [options] [nvarchar](max) DEFAULT NULL NULL, - [sort_order] [int] DEFAULT 0 NULL, - PRIMARY KEY CLUSTERED -( - [id] ASC -)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY] -) ON [PRIMARY] CREATE TABLE [dbo].[x_context_enricher_def]( [id] [bigint] IDENTITY(1,1) NOT NULL, [guid] [varchar](1024) DEFAULT NULL NULL, @@ -2955,15 +2924,6 @@ ALTER TABLE [dbo].[x_policy_condition_def] CHECK CONSTRAINT [x_policy_condition_ ALTER TABLE [dbo].[x_policy_condition_def] WITH CHECK ADD CONSTRAINT [x_policy_condition_def_FK_upd_by] FOREIGN KEY([upd_by_id]) REFERENCES [dbo].[x_portal_user] ([id]) ALTER TABLE [dbo].[x_policy_condition_def] CHECK CONSTRAINT [x_policy_condition_def_FK_upd_by] -ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_defid] FOREIGN KEY([def_id]) -REFERENCES [dbo].[x_service_def] ([id]) -ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_defid] -ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_added_by] FOREIGN KEY([added_by_id]) -REFERENCES [dbo].[x_portal_user] ([id]) -ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_added_by] -ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_upd_by] FOREIGN KEY([upd_by_id]) -REFERENCES [dbo].[x_portal_user] ([id]) -ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_upd_by] ALTER TABLE [dbo].[x_context_enricher_def] WITH CHECK ADD CONSTRAINT [x_context_enricher_def_FK_defid] FOREIGN KEY([def_id]) REFERENCES [dbo].[x_service_def] ([id]) ALTER TABLE [dbo].[x_context_enricher_def] CHECK CONSTRAINT [x_context_enricher_def_FK_defid] @@ -3749,11 +3709,6 @@ CREATE NONCLUSTERED INDEX [x_context_enricher_def_IDX_def_id] ON [x_context_enri [def_id] ASC ) WITH (SORT_IN_TEMPDB = OFF, DROP_EXISTING = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF) ON [PRIMARY] -CREATE NONCLUSTERED INDEX [x_constraint_def_IDX_def_id] ON [x_constraint_def] -( - [def_id] ASC -) -WITH (SORT_IN_TEMPDB = OFF, DROP_EXISTING = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF) ON [PRIMARY] CREATE NONCLUSTERED INDEX [x_enum_def_IDX_def_id] ON [x_enum_def] ( [def_id] ASC @@ -4673,5 +4628,6 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10064',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10065',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10066',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10067',CURRENT_TIMESTAMP,'Ranger 3.0.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',CURRENT_TIMESTAMP,'Ranger 1.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO diff --git a/security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql b/security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql new file mode 100644 index 00000000000..6b15584728e --- /dev/null +++ b/security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql @@ -0,0 +1,21 @@ +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. + +GO +IF NOT EXISTS(select * from INFORMATION_SCHEMA.columns where table_name = 'x_service_def' and column_name = 'def_text') +BEGIN + ALTER TABLE [dbo].[x_service_def] ADD [def_text] [nvarchar](max) DEFAULT NULL NULL; +END +GO diff --git a/security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql b/security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql deleted file mode 100644 index e8ef2980dc4..00000000000 --- a/security-admin/db/sqlserver/patches/079-add-x_constraint_def.sql +++ /dev/null @@ -1,71 +0,0 @@ --- Licensed to the Apache Software Foundation (ASF) under one or more --- contributor license agreements. See the NOTICE file distributed with --- this work for additional information regarding copyright ownership. --- The ASF licenses this file to You under the Apache License, Version 2.0 --- (the "License"); you may not use this file except in compliance with --- the License. You may obtain a copy of the License at --- --- http://www.apache.org/licenses/LICENSE-2.0 --- --- Unless required by applicable law or agreed to in writing, software --- distributed under the License is distributed on an "AS IS" BASIS, --- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. --- See the License for the specific language governing permissions and --- limitations under the License. - -SET ANSI_NULLS ON -SET QUOTED_IDENTIFIER ON -SET ANSI_PADDING ON -GO - -IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = 'x_constraint_def') -BEGIN - CREATE TABLE [dbo].[x_constraint_def] ( - [id] [bigint] IDENTITY(1,1) NOT NULL, - [guid] [varchar](1024) DEFAULT NULL NULL, - [create_time] [datetime2] DEFAULT NULL NULL, - [update_time] [datetime2] DEFAULT NULL NULL, - [added_by_id] [bigint] DEFAULT NULL NULL, - [upd_by_id] [bigint] DEFAULT NULL NULL, - [def_id] [bigint] NOT NULL, - [item_id] [bigint] NOT NULL, - [name] [varchar](1024) DEFAULT NULL NULL, - [label] [varchar](1024) DEFAULT NULL NULL, - [description] [varchar](1024) DEFAULT NULL NULL, - [rb_key_label] [varchar](1024) DEFAULT NULL NULL, - [rb_key_description] [varchar](1024) DEFAULT NULL NULL, - [resources] [nvarchar](max) DEFAULT NULL NULL, - [access_types] [nvarchar](max) DEFAULT NULL NULL, - [parameters] [nvarchar](max) DEFAULT NULL NULL, - [options] [nvarchar](max) DEFAULT NULL NULL, - [sort_order] [int] DEFAULT 0 NULL, - PRIMARY KEY CLUSTERED - ( - [id] ASC - )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY] - ) ON [PRIMARY]; - - ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_defid] FOREIGN KEY([def_id]) - REFERENCES [dbo].[x_service_def] ([id]); - ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_defid]; - ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_added_by] FOREIGN KEY([added_by_id]) - REFERENCES [dbo].[x_portal_user] ([id]); - ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_added_by]; - ALTER TABLE [dbo].[x_constraint_def] WITH CHECK ADD CONSTRAINT [x_constraint_def_FK_upd_by] FOREIGN KEY([upd_by_id]) - REFERENCES [dbo].[x_portal_user] ([id]); - ALTER TABLE [dbo].[x_constraint_def] CHECK CONSTRAINT [x_constraint_def_FK_upd_by]; -END -GO - -IF OBJECT_ID('x_constraint_def') IS NOT NULL -BEGIN - IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'x_constraint_def_IDX_def_id' AND object_id = OBJECT_ID('x_constraint_def')) - BEGIN - CREATE NONCLUSTERED INDEX [x_constraint_def_IDX_def_id] ON [dbo].[x_constraint_def] - ( - [def_id] ASC - ) - WITH (SORT_IN_TEMPDB = OFF, DROP_EXISTING = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF) ON [PRIMARY] - END -END -GO diff --git a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java index 7235ff445a9..83e32d3ff72 100644 --- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java +++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java @@ -56,7 +56,6 @@ import org.apache.ranger.db.XXAccessTypeDefDao; import org.apache.ranger.db.XXAccessTypeDefGrantsDao; import org.apache.ranger.db.XXAuthSessionDao; -import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; import org.apache.ranger.db.XXEnumDefDao; @@ -74,7 +73,6 @@ import org.apache.ranger.db.XXTrxLogV2Dao; import org.apache.ranger.entity.XXAccessTypeDef; import org.apache.ranger.entity.XXAccessTypeDefGrants; -import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataHist; import org.apache.ranger.entity.XXDataMaskTypeDef; @@ -470,6 +468,7 @@ public RangerServiceDef createServiceDef(RangerServiceDef serviceDef) throws Exc List enums = serviceDef.getEnums(); RangerDataMaskDef dataMaskDef = serviceDef.getDataMaskDef(); RangerRowFilterDef rowFilterDef = serviceDef.getRowFilterDef(); + List constraintDefs = serviceDef.getConstraintDefs(); List dataMaskTypes = dataMaskDef == null || dataMaskDef.getMaskTypes() == null ? new ArrayList<>() : dataMaskDef.getMaskTypes(); List dataMaskAccessTypes = dataMaskDef == null || dataMaskDef.getAccessTypes() == null ? new ArrayList<>() : dataMaskDef.getAccessTypes(); List dataMaskResources = dataMaskDef == null || dataMaskDef.getResources() == null ? new ArrayList<>() : dataMaskDef.getResources(); @@ -572,23 +571,6 @@ public RangerServiceDef createServiceDef(RangerServiceDef serviceDef) throws Exc xxPolCondDao.create(xPolicyCondition); } - List constraintDefs = serviceDef.getConstraintDefs() != null ? serviceDef.getConstraintDefs() : new ArrayList<>(); - - if (CollectionUtils.isNotEmpty(constraintDefs)) { - XXConstraintDefDao xxConstraintDefDao = daoMgr.getXXConstraintDef(); - - for (int i = 0; i < constraintDefs.size(); i++) { - RangerConstraintDef constraintDef = constraintDefs.get(i); - XXConstraintDef xConstraintDef = new XXConstraintDef(); - - xConstraintDef = serviceDefService.populateRangerConstraintDefToXX(constraintDef, xConstraintDef, createdSvcDef, RangerServiceDefService.OPERATION_CREATE_CONTEXT); - - xConstraintDef.setOrder(i); - - xxConstraintDefDao.create(xConstraintDef); - } - } - XXContextEnricherDefDao xxContextEnricherDao = daoMgr.getXXContextEnricherDef(); for (int i = 0; i < contextEnrichers.size(); i++) { @@ -718,6 +700,8 @@ public RangerServiceDef createServiceDef(RangerServiceDef serviceDef) throws Exc } } + updateServiceDefText(createdSvcDef, constraintDefs); + RangerServiceDef createdServiceDef = serviceDefService.getPopulatedViewObject(createdSvcDef); dataHistService.createObjectDataHistory(createdServiceDef, RangerDataHistService.ACTION_CREATE); @@ -755,11 +739,11 @@ public RangerServiceDef updateServiceDef(RangerServiceDef serviceDef) throws Exc List resources = serviceDef.getResources() != null ? serviceDef.getResources() : new ArrayList<>(); List accessTypes = serviceDef.getAccessTypes() != null ? serviceDef.getAccessTypes() : new ArrayList<>(); List policyConditions = serviceDef.getPolicyConditions() != null ? serviceDef.getPolicyConditions() : new ArrayList<>(); - List constraintDefs = serviceDef.getConstraintDefs() != null ? serviceDef.getConstraintDefs() : new ArrayList<>(); List contextEnrichers = serviceDef.getContextEnrichers() != null ? serviceDef.getContextEnrichers() : new ArrayList<>(); List enums = serviceDef.getEnums() != null ? serviceDef.getEnums() : new ArrayList<>(); RangerDataMaskDef dataMaskDef = serviceDef.getDataMaskDef(); RangerRowFilterDef rowFilterDef = serviceDef.getRowFilterDef(); + List constraintDefs = serviceDef.getConstraintDefs(); RangerServiceDefHelper defHelper = new RangerServiceDefHelper(serviceDef, false); defHelper.patchServiceDefWithDefaultValues(); @@ -772,7 +756,9 @@ public RangerServiceDef updateServiceDef(RangerServiceDef serviceDef) throws Exc XXServiceDef createdSvcDef = daoMgr.getXXServiceDef().getById(serviceDefId); - updateChildObjectsOfServiceDef(createdSvcDef, configs, resources, accessTypes, policyConditions, contextEnrichers, enums, dataMaskDef, rowFilterDef, constraintDefs); + updateChildObjectsOfServiceDef(createdSvcDef, configs, resources, accessTypes, policyConditions, contextEnrichers, enums, dataMaskDef, rowFilterDef); + + updateServiceDefText(createdSvcDef, constraintDefs); RangerServiceDef updatedSvcDef = getServiceDef(serviceDefId); @@ -866,15 +852,6 @@ public void deleteServiceDef(Long serviceDefId, Boolean forceDelete) throws Exce policyCondDao.remove(policyCond); } - XXConstraintDefDao constraintDefDao = daoMgr.getXXConstraintDef(); - List constraintDefList = constraintDefDao.findByServiceDefId(serviceDefId); - - if (constraintDefList != null) { - for (XXConstraintDef constraintDef : constraintDefList) { - constraintDefDao.remove(constraintDef); - } - } - List resDefList = daoMgr.getXXResourceDef().findByServiceDefId(serviceDefId); for (XXResourceDef resDef : resDefList) { @@ -3278,29 +3255,30 @@ boolean hasServiceConfigForPluginChanged(List dbConfigMaps, return ret; } + // Writes x_service_def.def_text after the child rows. constraintDefs are stored only in this JSON. + private void updateServiceDefText(XXServiceDef xServiceDef, List constraintDefs) { + if (xServiceDef == null) { + return; + } + + xServiceDef.setDefText(serviceDefService.buildDefText(xServiceDef, constraintDefs)); + + daoMgr.getXXServiceDef().update(xServiceDef); + } + private void updateChildObjectsOfServiceDef(XXServiceDef createdSvcDef, List configs, List resources, List accessTypes, List policyConditions, List contextEnrichers, - List enums, RangerDataMaskDef dataMaskDef, RangerRowFilterDef rowFilterDef, - List constraintDefs) { + List enums, RangerDataMaskDef dataMaskDef, RangerRowFilterDef rowFilterDef) { Long serviceDefId = createdSvcDef.getId(); List xxConfigs = daoMgr.getXXServiceConfigDef().findByServiceDefId(serviceDefId); List xxResources = daoMgr.getXXResourceDef().findByServiceDefId(serviceDefId); List xxAccessTypes = daoMgr.getXXAccessTypeDef().findByServiceDefId(serviceDefId); List xxPolicyConditions = daoMgr.getXXPolicyConditionDef().findByServiceDefId(serviceDefId); - List xxConstraintDefs = daoMgr.getXXConstraintDef().findByServiceDefId(serviceDefId); List xxContextEnrichers = daoMgr.getXXContextEnricherDef().findByServiceDefId(serviceDefId); List xxEnums = daoMgr.getXXEnumDef().findByServiceDefId(serviceDefId); XXServiceConfigDefDao xxServiceConfigDao = daoMgr.getXXServiceConfigDef(); - if (xxConstraintDefs == null) { - xxConstraintDefs = new ArrayList<>(); - } - - if (constraintDefs == null) { - constraintDefs = new ArrayList<>(); - } - for (int i = 0; i < configs.size(); i++) { RangerServiceConfigDef config = configs.get(i); boolean found = false; @@ -3561,54 +3539,6 @@ private void updateChildObjectsOfServiceDef(XXServiceDef createdSvcDef, List { - public XXConstraintDefDao(RangerDaoManagerBase daoManager) { - super(daoManager); - } - - public List findByServiceDefId(Long serviceDefId) { - if (serviceDefId == null) { - return new ArrayList<>(); - } - - try { - return getEntityManager() - .createNamedQuery("XXConstraintDef.findByServiceDefId", tClass) - .setParameter("serviceDefId", serviceDefId).getResultList(); - } catch (NoResultException e) { - return new ArrayList<>(); - } - } - - public XXConstraintDef findByServiceDefIdAndName(Long serviceDefId, String name) { - if (serviceDefId == null) { - return null; - } - - try { - return getEntityManager() - .createNamedQuery("XXConstraintDef.findByServiceDefIdAndName", tClass) - .setParameter("serviceDefId", serviceDefId) - .setParameter("name", name).getSingleResult(); - } catch (NoResultException e) { - return null; - } - } -} diff --git a/security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java b/security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java deleted file mode 100644 index 125684ccf0e..00000000000 --- a/security-admin/src/main/java/org/apache/ranger/entity/XXConstraintDef.java +++ /dev/null @@ -1,230 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.ranger.entity; - -import javax.persistence.Cacheable; -import javax.persistence.Column; -import javax.persistence.Entity; -import javax.persistence.GeneratedValue; -import javax.persistence.GenerationType; -import javax.persistence.Id; -import javax.persistence.SequenceGenerator; -import javax.persistence.Table; - -import java.util.Objects; - -@Entity -@Cacheable -@Table(name = "x_constraint_def") -public class XXConstraintDef extends XXDBBase implements java.io.Serializable { - private static final long serialVersionUID = 1L; - - @Id - @SequenceGenerator(name = "x_constraint_def_SEQ", sequenceName = "x_constraint_def_SEQ", allocationSize = 1) - @GeneratedValue(strategy = GenerationType.AUTO, generator = "x_constraint_def_SEQ") - @Column(name = "id") - protected Long id; - - @Column(name = "def_id") - protected Long defId; - - @Column(name = "item_id") - protected Long itemId; - - @Column(name = "name") - protected String name; - - @Column(name = "label") - protected String label; - - @Column(name = "description") - protected String description; - - @Column(name = "rb_key_label") - protected String rbKeyLabel; - - @Column(name = "rb_key_description") - protected String rbKeyDescription; - - @Column(name = "resources") - protected String resources; - - @Column(name = "access_types") - protected String accessTypes; - - @Column(name = "parameters") - protected String parameters; - - @Column(name = "options") - protected String options; - - @Column(name = "sort_order") - protected Integer order; - - public Long getId() { - return this.id; - } - - public void setId(Long id) { - this.id = id; - } - - @Override - public int hashCode() { - return super.hashCode(); - } - - @Override - public boolean equals(Object obj) { - if (this == obj) { - return true; - } else if (!super.equals(obj)) { - return false; - } - - XXConstraintDef other = (XXConstraintDef) obj; - - return Objects.equals(defId, other.defId) && - Objects.equals(itemId, other.itemId) && - Objects.equals(name, other.name) && - Objects.equals(label, other.label) && - Objects.equals(description, other.description) && - Objects.equals(rbKeyLabel, other.rbKeyLabel) && - Objects.equals(rbKeyDescription, other.rbKeyDescription) && - Objects.equals(resources, other.resources) && - Objects.equals(accessTypes, other.accessTypes) && - Objects.equals(parameters, other.parameters) && - Objects.equals(options, other.options) && - Objects.equals(id, other.id) && - Objects.equals(order, other.order); - } - - @Override - public String toString() { - String str = "XXConstraintDef={"; - - str += super.toString(); - str += " [id=" + id + ", defId=" + defId + ", itemId=" + itemId - + ", name=" + name + ", label=" + label - + ", description=" + description + ", rbKeyLabel=" + rbKeyLabel - + ", rbKeyDescription=" + rbKeyDescription - + ", resources=" + resources + ", accessTypes=" + accessTypes - + ", parameters=" + parameters + ", options=" + options - + ", order=" + order + "]"; - str += "}"; - - return str; - } - - public Long getDefid() { - return this.defId; - } - - public void setDefid(Long defId) { - this.defId = defId; - } - - public Long getItemId() { - return this.itemId; - } - - public void setItemId(Long itemId) { - this.itemId = itemId; - } - - public String getName() { - return this.name; - } - - public void setName(String name) { - this.name = name; - } - - public String getLabel() { - return this.label; - } - - public void setLabel(String label) { - this.label = label; - } - - public String getDescription() { - return this.description; - } - - public void setDescription(String description) { - this.description = description; - } - - public String getRbkeylabel() { - return this.rbKeyLabel; - } - - public void setRbkeylabel(String rbKeyLabel) { - this.rbKeyLabel = rbKeyLabel; - } - - public String getRbkeydescription() { - return this.rbKeyDescription; - } - - public void setRbkeydescription(String rbKeyDescription) { - this.rbKeyDescription = rbKeyDescription; - } - - public String getResources() { - return this.resources; - } - - public void setResources(String resources) { - this.resources = resources; - } - - public String getAccessTypes() { - return this.accessTypes; - } - - public void setAccessTypes(String accessTypes) { - this.accessTypes = accessTypes; - } - - public String getParameters() { - return this.parameters; - } - - public void setParameters(String parameters) { - this.parameters = parameters; - } - - public String getOptions() { - return this.options; - } - - public void setOptions(String options) { - this.options = options; - } - - public Integer getOrder() { - return this.order; - } - - public void setOrder(Integer order) { - this.order = order; - } -} diff --git a/security-admin/src/main/java/org/apache/ranger/entity/XXServiceDefBase.java b/security-admin/src/main/java/org/apache/ranger/entity/XXServiceDefBase.java index ba86de242d7..567d5ace0da 100644 --- a/security-admin/src/main/java/org/apache/ranger/entity/XXServiceDefBase.java +++ b/security-admin/src/main/java/org/apache/ranger/entity/XXServiceDefBase.java @@ -93,6 +93,14 @@ public abstract class XXServiceDefBase extends XXDBBase implements Serializable @Column(name = "def_options") protected String defOptions; + /** + * defText of the XXServiceDef + *
    + *
+ */ + @Column(name = "def_text") + protected String defText; + /** * rbKeyLabel of the XXServiceDef *
    @@ -238,6 +246,24 @@ public void setDefOptions(String options) { this.defOptions = options; } + /** + * Returns the value for the member attribute defText + * + * @return String - value of member attribute defText . + */ + public String getDefText() { + return this.defText; + } + + /** + * This method sets the value to the member attribute defText . + * + * @param defText Value to set member attribute defText + */ + public void setDefText(String defText) { + this.defText = defText; + } + /** * Returns the value for the member attribute rbKeyLabel * @@ -332,6 +358,7 @@ public boolean equals(Object obj) { XXServiceDefBase other = (XXServiceDefBase) obj; return Objects.equals(description, other.description) && + Objects.equals(defText, other.defText) && Objects.equals(guid, other.guid) && Objects.equals(implClassName, other.implClassName) && Objects.equals(label, other.label) && diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceDefJson_J10067.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceDefJson_J10067.java new file mode 100644 index 00000000000..d95a5a0a162 --- /dev/null +++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceDefJson_J10067.java @@ -0,0 +1,134 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.ranger.patch; + +import org.apache.commons.collections.CollectionUtils; +import org.apache.commons.lang3.StringUtils; +import org.apache.ranger.db.RangerDaoManager; +import org.apache.ranger.entity.XXServiceDef; +import org.apache.ranger.service.RangerServiceDefService; +import org.apache.ranger.util.CLIUtil; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.stereotype.Component; +import org.springframework.transaction.PlatformTransactionManager; +import org.springframework.transaction.TransactionDefinition; +import org.springframework.transaction.support.TransactionTemplate; + +import java.util.List; + +@Component +public class PatchForServiceDefJson_J10067 extends BaseLoader { + private static final Logger logger = LoggerFactory.getLogger(PatchForServiceDefJson_J10067.class); + + @Autowired + RangerDaoManager daoMgr; + + @Autowired + RangerServiceDefService serviceDefService; + + @Autowired + @Qualifier(value = "transactionManager") + PlatformTransactionManager txManager; + + public static void main(String[] args) { + logger.info("main()"); + try { + PatchForServiceDefJson_J10067 loader = (PatchForServiceDefJson_J10067) CLIUtil.getBean(PatchForServiceDefJson_J10067.class); + + loader.init(); + + while (loader.isMoreToProcess()) { + loader.load(); + } + + logger.info("Load complete. Exiting!!!"); + System.exit(0); + } catch (Exception e) { + logger.error("Error loading", e); + System.exit(1); + } + } + + @Override + public void init() throws Exception { + // Do Nothing + } + + @Override + public void printStats() { + logger.info("PatchForServiceDefJson_J10067"); + } + + @Override + public void execLoad() { + logger.info("==> PatchForServiceDefJson_J10067.execLoad()"); + + try { + updateServiceDefText(); + } catch (Exception e) { + logger.error("Error while applying PatchForServiceDefJson_J10067", e); + throw new RuntimeException("PatchForServiceDefJson_J10067 failed", e); + } + + logger.info("<== PatchForServiceDefJson_J10067.execLoad()"); + } + + private void updateServiceDefText() { + List serviceDefs = daoMgr.getXXServiceDef().getAll(); + + if (CollectionUtils.isEmpty(serviceDefs)) { + logger.info("No service-defs found"); + + return; + } + + TransactionTemplate txTemplate = new TransactionTemplate(txManager); + + txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW); + + for (XXServiceDef xServiceDef : serviceDefs) { + Long serviceDefId = xServiceDef.getId(); + + txTemplate.execute(status -> { + XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().getById(serviceDefId); + + if (dbServiceDef != null && StringUtils.isEmpty(dbServiceDef.getDefText())) { + // constraintDefs were not stored before def_text existed, so there are none to carry over + String defText = serviceDefService.buildDefText(dbServiceDef, null); + + if (StringUtils.isEmpty(defText)) { + throw new IllegalStateException("failed to build JSON for service-def(id=" + serviceDefId + ", name=" + dbServiceDef.getName() + ")"); + } + + dbServiceDef.setDefText(defText); + + daoMgr.getXXServiceDef().update(dbServiceDef); + + logger.info("Stored JSON for service-def(id={}, name={})", serviceDefId, dbServiceDef.getName()); + } else if (dbServiceDef != null) { + logger.info("JSON already present for service-def(id={}, name={}); skipping", serviceDefId, dbServiceDef.getName()); + } + + return null; + }); + } + } +} diff --git a/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java b/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java index 9f837b27dbd..ef95be6a590 100644 --- a/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java +++ b/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java @@ -17,9 +17,9 @@ package org.apache.ranger.service; -import com.fasterxml.jackson.core.type.TypeReference; import org.apache.commons.collections.MapUtils; import org.apache.commons.lang3.StringUtils; +import org.apache.ranger.authorization.utils.JsonUtils; import org.apache.ranger.common.AppConstants; import org.apache.ranger.common.GUIDUtil; import org.apache.ranger.common.JSONUtil; @@ -30,7 +30,6 @@ import org.apache.ranger.common.SearchField.SEARCH_TYPE; import org.apache.ranger.common.SortField; import org.apache.ranger.entity.XXAccessTypeDef; -import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataMaskTypeDef; import org.apache.ranger.entity.XXEnumDef; @@ -44,7 +43,6 @@ import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef.AccessTypeCategory; import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; -import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintParamDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerContextEnricherDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerDataMaskDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerDataMaskTypeDef; @@ -54,7 +52,6 @@ import org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerRowFilterDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerServiceConfigDef; -import org.apache.ranger.plugin.util.JsonUtilsV2; import org.apache.ranger.plugin.util.SearchFilter; import org.apache.ranger.plugin.util.ServiceDefUtil; import org.apache.ranger.view.RangerServiceDefList; @@ -80,9 +77,6 @@ public abstract class RangerServiceDefServiceBase> TYPE_REF_LIST_STRING = new TypeReference>() {}; - private static final TypeReference> TYPE_REF_LIST_CONSTRAINT_PARAM = new TypeReference>() {}; - @Autowired RangerAuditFields rangerAuditFields; @@ -354,48 +348,6 @@ public RangerPolicyConditionDef populateXXToRangerPolicyConditionDef(XXPolicyCon return vObj; } - public XXConstraintDef populateRangerConstraintDefToXX(RangerConstraintDef vObj, XXConstraintDef xObj, XXServiceDef serviceDef, int operationContext) { - if (serviceDef == null) { - LOG.error("RangerServiceDefServiceBase.populateRangerConstraintDefToXX, serviceDef can not be null"); - - throw restErrorUtil.createRESTException("RangerServiceDef cannot be null.", MessageEnums.DATA_NOT_FOUND); - } - - xObj = rangerAuditFields.populateAuditFields(xObj, serviceDef); - - xObj.setDefid(serviceDef.getId()); - xObj.setItemId(vObj.getItemId()); - xObj.setName(vObj.getName()); - xObj.setLabel(vObj.getLabel()); - xObj.setDescription(vObj.getDescription()); - xObj.setRbkeylabel(vObj.getRbKeyLabel()); - xObj.setRbkeydescription(vObj.getRbKeyDescription()); - xObj.setResources(vObj.getResources() == null ? null : jsonUtil.readListToString(vObj.getResources())); - xObj.setAccessTypes(vObj.getAccessTypes() == null ? null : jsonUtil.readListToString(vObj.getAccessTypes())); - xObj.setParameters(vObj.getParameters() == null ? null : objectToJson(new ArrayList<>(vObj.getParameters()))); - xObj.setOptions(mapToJsonString(vObj.getOptions())); - xObj.setOrder(AppConstants.DEFAULT_SORT_ORDER); - - return xObj; - } - - public RangerConstraintDef populateXXToRangerConstraintDef(XXConstraintDef xObj) { - RangerConstraintDef vObj = new RangerConstraintDef(); - - vObj.setItemId(xObj.getItemId()); - vObj.setName(xObj.getName()); - vObj.setLabel(xObj.getLabel()); - vObj.setDescription(xObj.getDescription()); - vObj.setRbKeyLabel(xObj.getRbkeylabel()); - vObj.setRbKeyDescription(xObj.getRbkeydescription()); - vObj.setResources(jsonToStringList(xObj.getResources())); - vObj.setAccessTypes(jsonToStringList(xObj.getAccessTypes())); - vObj.setParameters(jsonToConstraintParams(xObj.getParameters())); - vObj.setOptions(jsonStringToMap(xObj.getOptions())); - - return vObj; - } - public XXContextEnricherDef populateRangerContextEnricherDefToXX(RangerContextEnricherDef vObj, XXContextEnricherDef xObj, XXServiceDef serviceDef, int operationContext) { if (serviceDef == null) { LOG.error("RangerServiceDefServiceBase.populateRangerContextEnricherDefToXX, serviceDef can not be null"); @@ -587,34 +539,6 @@ public DST jsonToObject(String jsonStr, Class clz) { return ret; } - private List jsonToStringList(String jsonStr) { - List ret = null; - - if (StringUtils.isNotEmpty(jsonStr)) { - try { - ret = JsonUtilsV2.jsonToObj(jsonStr, TYPE_REF_LIST_STRING); - } catch (Exception excp) { - LOG.warn("jsonToStringList() failed to convert json to object: {}", jsonStr, excp); - } - } - - return ret; - } - - private List jsonToConstraintParams(String jsonStr) { - List ret = null; - - if (StringUtils.isNotEmpty(jsonStr)) { - try { - ret = JsonUtilsV2.jsonToObj(jsonStr, TYPE_REF_LIST_CONSTRAINT_PARAM); - } catch (Exception excp) { - LOG.warn("jsonToConstraintParams() failed to convert json to object: {}", jsonStr, excp); - } - } - - return ret; - } - @Override protected T mapViewToEntityBean(V vObj, T xObj, int operationContext) { String guid = (StringUtils.isEmpty(vObj.getGuid())) ? guidUtil.genGUID() : vObj.getGuid(); @@ -635,6 +559,39 @@ protected T mapViewToEntityBean(V vObj, T xObj, int operationContext) { @Override protected V mapEntityToViewBean(V vObj, T xObj) { + return mapServiceDefColumns(vObj, xObj); + } + + @Override + protected V populateViewBean(T xServiceDef) { + V serviceDef = super.populateViewBean(xServiceDef); + + if (!applyDefText(serviceDef, xServiceDef.getDefText())) { + loadChildTables(serviceDef, xServiceDef); + } + + serviceDef.setMarkerAccessTypes(ServiceDefUtil.getMarkerAccessTypes(serviceDef.getAccessTypes())); + addImplicitConditionExpressionIfNeeded(serviceDef); + ServiceDefUtil.normalize(serviceDef); + + return serviceDef; + } + + // JSON for x_service_def.def_text, built after the child rows are written. + // Marker access types, the implicit condition, and read-time options are left out. + public String buildDefText(T xServiceDef, List constraintDefs) { + V serviceDef = createViewObject(); + + serviceDef.setId(xServiceDef.getId()); + mapServiceDefColumns(serviceDef, xServiceDef); + loadChildTables(serviceDef, xServiceDef); + serviceDef.setConstraintDefs(constraintDefs); + serviceDef.setMarkerAccessTypes(null); + + return JsonUtils.objectToJson(serviceDef); + } + + private V mapServiceDefColumns(V vObj, T xObj) { vObj.setGuid(xObj.getGuid()); vObj.setVersion(xObj.getVersion()); vObj.setName(xObj.getName()); @@ -650,10 +607,34 @@ protected V mapEntityToViewBean(V vObj, T xObj) { return vObj; } - @Override - protected V populateViewBean(T xServiceDef) { - V serviceDef = super.populateViewBean(xServiceDef); - Long serviceDefId = xServiceDef.getId(); + private boolean applyDefText(V serviceDef, String defText) { + if (StringUtils.isEmpty(defText)) { + return false; + } + + V fromJson = JsonUtils.jsonToObject(defText, tViewClass); + + if (fromJson == null) { + LOG.warn("failed to read def_text of service-def(id={}, name={}); loading it from child tables", serviceDef.getId(), serviceDef.getName()); + + return false; + } + + serviceDef.setConfigs(fromJson.getConfigs()); + serviceDef.setResources(fromJson.getResources()); + serviceDef.setAccessTypes(fromJson.getAccessTypes()); + serviceDef.setPolicyConditions(fromJson.getPolicyConditions()); + serviceDef.setConstraintDefs(fromJson.getConstraintDefs()); + serviceDef.setContextEnrichers(fromJson.getContextEnrichers()); + serviceDef.setEnums(fromJson.getEnums()); + serviceDef.setDataMaskDef(fromJson.getDataMaskDef()); + serviceDef.setRowFilterDef(fromJson.getRowFilterDef()); + + return true; + } + + private void loadChildTables(V serviceDef, T xServiceDef) { + Long serviceDefId = xServiceDef.getId(); List xConfigs = daoMgr.getXXServiceConfigDef().findByServiceDefId(serviceDefId); if (!stringUtil.isEmpty(xConfigs)) { @@ -697,8 +678,6 @@ protected V populateViewBean(T xServiceDef) { serviceDef.setAccessTypes(accessTypes); } - serviceDef.setMarkerAccessTypes(ServiceDefUtil.getMarkerAccessTypes(serviceDef.getAccessTypes())); - List xPolicyConditions = daoMgr.getXXPolicyConditionDef().findByServiceDefId(serviceDefId); if (!stringUtil.isEmpty(xPolicyConditions)) { @@ -713,20 +692,6 @@ protected V populateViewBean(T xServiceDef) { serviceDef.setPolicyConditions(policyConditions); } - List xConstraintDefs = daoMgr.getXXConstraintDef().findByServiceDefId(serviceDefId); - - if (!stringUtil.isEmpty(xConstraintDefs)) { - List constraintDefs = new ArrayList<>(); - - for (XXConstraintDef xConstraintDef : xConstraintDefs) { - RangerConstraintDef constraintDef = populateXXToRangerConstraintDef(xConstraintDef); - - constraintDefs.add(constraintDef); - } - - serviceDef.setConstraintDefs(constraintDefs); - } - List xContextEnrichers = daoMgr.getXXContextEnricherDef().findByServiceDefId(serviceDefId); if (!stringUtil.isEmpty(xContextEnrichers)) { @@ -805,12 +770,6 @@ protected V populateViewBean(T xServiceDef) { serviceDef.setDataMaskDef(dataMaskDef); serviceDef.setRowFilterDef(rowFilterDef); - - addImplicitConditionExpressionIfNeeded(serviceDef); - - ServiceDefUtil.normalize(serviceDef); - - return serviceDef; } protected Map jsonStringToMap(String jsonStr) { diff --git a/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java b/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java index 5af8f9a0ca0..1642a7e12ec 100644 --- a/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java +++ b/security-admin/src/main/java/org/apache/ranger/service/XPortalUserService.java @@ -71,8 +71,6 @@ public void updateXXPortalUserReferences(long xXPortalUserId) { daoManager.getXXAccessTypeDefGrants().updateUserIDReference("upd_by_id", xXPortalUserId); daoManager.getXXPolicyConditionDef().updateUserIDReference("added_by_id", xXPortalUserId); daoManager.getXXPolicyConditionDef().updateUserIDReference("upd_by_id", xXPortalUserId); - daoManager.getXXConstraintDef().updateUserIDReference("added_by_id", xXPortalUserId); - daoManager.getXXConstraintDef().updateUserIDReference("upd_by_id", xXPortalUserId); daoManager.getXXContextEnricherDef().updateUserIDReference("added_by_id", xXPortalUserId); daoManager.getXXContextEnricherDef().updateUserIDReference("upd_by_id", xXPortalUserId); daoManager.getXXEnumDef().updateUserIDReference("added_by_id", xXPortalUserId); diff --git a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml index fd5d10cfc20..1dcffe9aeec 100755 --- a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml +++ b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml @@ -691,15 +691,6 @@ select obj.id, obj.name from XXPolicyConditionDef obj where obj.defId = :serviceDefId and obj.name IN :names order by obj.order - - - select obj from XXConstraintDef obj where obj.defId = :serviceDefId order by obj.order - - - - select obj from XXConstraintDef obj where obj.defId = :serviceDefId and obj.name = :name order by obj.order - - select obj from XXContextEnricherDef obj where obj.defId = :serviceDefId order by obj.order diff --git a/security-admin/src/main/resources/META-INF/persistence.xml b/security-admin/src/main/resources/META-INF/persistence.xml index 8d75637464a..827a312fdf9 100644 --- a/security-admin/src/main/resources/META-INF/persistence.xml +++ b/security-admin/src/main/resources/META-INF/persistence.xml @@ -49,7 +49,6 @@ org.apache.ranger.entity.XXAccessTypeDef org.apache.ranger.entity.XXAccessTypeDefGrants org.apache.ranger.entity.XXPolicyConditionDef - org.apache.ranger.entity.XXConstraintDef org.apache.ranger.entity.XXContextEnricherDef org.apache.ranger.entity.XXEnumDef org.apache.ranger.entity.XXEnumElementDef diff --git a/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java b/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java index 20afa062365..5a36e7f297e 100644 --- a/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java +++ b/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java @@ -38,7 +38,6 @@ import org.apache.ranger.db.XXAccessTypeDefDao; import org.apache.ranger.db.XXAccessTypeDefGrantsDao; import org.apache.ranger.db.XXAuthSessionDao; -import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXDataHistDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; @@ -75,7 +74,6 @@ import org.apache.ranger.db.XXUserDao; import org.apache.ranger.entity.XXAccessTypeDef; import org.apache.ranger.entity.XXAccessTypeDefGrants; -import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataHist; import org.apache.ranger.entity.XXDataMaskTypeDef; @@ -425,9 +423,6 @@ public void test12updateServiceDef() throws Exception { Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResourceDefDao); Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAccessTypeDefDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); - XXConstraintDefDao xConstraintDefDao = Mockito.mock(XXConstraintDefDao.class); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDefDao); - Mockito.when(xConstraintDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDefDao); Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDataMaskDefDao); @@ -758,14 +753,6 @@ public void test13deleteServiceDef() throws Exception { Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); Mockito.when(xPolicyConditionDefDao.findByServiceDefId(serviceDefId)).thenReturn(xConditionDefList); - XXConstraintDefDao xConstraintDefDao = Mockito.mock(XXConstraintDefDao.class); - XXConstraintDef xConstraintDef = new XXConstraintDef(); - xConstraintDef.setId(Id); - List xConstraintDefList = new ArrayList<>(); - xConstraintDefList.add(xConstraintDef); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDefDao); - Mockito.when(xConstraintDefDao.findByServiceDefId(serviceDefId)).thenReturn(xConstraintDefList); - Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResourceDefDao); Mockito.when(xResourceDefDao.findByServiceDefId(serviceDefId)).thenReturn(resDefList); @@ -785,7 +772,6 @@ public void test13deleteServiceDef() throws Exception { Mockito.when(xDataMaskDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); serviceDBStore.deleteServiceDef(Id, true); - Mockito.verify(xConstraintDefDao).remove(xConstraintDef); Mockito.verify(daoMgr).getXXContextEnricherDef(); Mockito.verify(daoMgr).getXXEnumDef(); } @@ -6506,9 +6492,6 @@ public void test231updateChildObjectsOfServiceDef_updateCreateRemove() throws Ex xCond60.setItemId(60L); xCond60.setName("country"); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); - XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); - Mockito.when(xConstraintDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); Mockito.when(xCondDao.findByServiceDefId(1L)).thenReturn(new ArrayList() { { add(xCond60); @@ -6585,7 +6568,6 @@ public void test231updateChildObjectsOfServiceDef_updateCreateRemove() throws Ex Mockito.when(daoMgr.getXXPolicyRefResource()).thenReturn(xPolRefResDao); Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xGrantDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); Mockito.when(daoMgr.getXXEnumElementDef()).thenReturn(xEnumEleDao); @@ -6680,10 +6662,10 @@ public void test231updateChildObjectsOfServiceDef_updateCreateRemove() throws Ex Method m = ServiceDBStore.class.getDeclaredMethod("updateChildObjectsOfServiceDef", XXServiceDef.class, List.class, List.class, List.class, List.class, List.class, List.class, - RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class, List.class); + RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class); m.setAccessible(true); try { - m.invoke(serviceDBStore, createdSvcDef, configs, resources, accessTypes, conds, enrs, enums, dmDef, rfDef, new ArrayList<>()); + m.invoke(serviceDBStore, createdSvcDef, configs, resources, accessTypes, conds, enrs, enums, dmDef, rfDef); } catch (InvocationTargetException ite) { // ignore exception; we'll verify interactions below for coverage } @@ -6733,13 +6715,13 @@ public void test232updateChildObjectsOfServiceDef_resourceRefBlock() throws Exce Method m = ServiceDBStore.class.getDeclaredMethod("updateChildObjectsOfServiceDef", XXServiceDef.class, List.class, List.class, List.class, List.class, List.class, List.class, - RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class, List.class); + RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class); m.setAccessible(true); Assertions.assertThrows(RuntimeException.class, () -> { try { m.invoke(serviceDBStore, createdSvcDef, new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), - new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), null, null, new ArrayList<>()); + new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), null, null); } catch (InvocationTargetException e) { Throwable cause = e.getCause(); if (cause instanceof RuntimeException) { @@ -6812,207 +6794,6 @@ public void test233createServiceDefWithIdentityInsert() throws Exception { Mockito.verify(svcDefServiceWithAssignedId).create(sd); } - @Test - public void test262createServiceDef_persistsConstraintDefs() throws Exception { - serviceDBStore.setPopulateExistingBaseFields(false); - - XXServiceDefDao xSvcDefDao = Mockito.mock(XXServiceDefDao.class); - XXServiceDef created = new XXServiceDef(); - created.setId(1L); - Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xSvcDefDao); - Mockito.when(xSvcDefDao.findByName("agent")).thenReturn(null); - Mockito.when(xSvcDefDao.getById(1L)).thenReturn(created); - - XXServiceConfigDefDao xCfgDao = Mockito.mock(XXServiceConfigDefDao.class); - XXResourceDefDao xResDao = Mockito.mock(XXResourceDefDao.class); - XXAccessTypeDefDao xAtdDao = Mockito.mock(XXAccessTypeDefDao.class); - XXPolicyConditionDefDao xCondDao = Mockito.mock(XXPolicyConditionDefDao.class); - XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); - XXContextEnricherDefDao xEnrDao = Mockito.mock(XXContextEnricherDefDao.class); - XXEnumDefDao xEnumDao = Mockito.mock(XXEnumDefDao.class); - XXDataMaskTypeDefDao xDmDao = Mockito.mock(XXDataMaskTypeDefDao.class); - Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xCfgDao); - Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResDao); - Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAtdDao); - Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); - Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); - Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); - Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDmDao); - Mockito.when(xAtdDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xResDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xDmDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xConstraintDao.create(Mockito.any())).thenAnswer(inv -> inv.getArgument(0)); - Mockito.when(serviceDefService.populateRangerConstraintDefToXX(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt())).thenAnswer(inv -> { - RangerServiceDef.RangerConstraintDef view = inv.getArgument(0); - XXConstraintDef entity = inv.getArgument(1); - entity.setItemId(view.getItemId()); - entity.setName(view.getName()); - return entity; - }); - - RangerServiceDef sd = new RangerServiceDef(); - sd.setName("agent"); - RangerServiceDef.RangerConstraintDef constraintDef = new RangerServiceDef.RangerConstraintDef(); - constraintDef.setItemId(1L); - constraintDef.setName("requireApproval"); - sd.getConstraintDefs().add(constraintDef); - - Mockito.when(serviceDefService.create(Mockito.any())).thenAnswer(inv -> { - RangerServiceDef createdDef = inv.getArgument(0); - createdDef.setId(1L); - return createdDef; - }); - Mockito.when(serviceDefService.getPopulatedViewObject(Mockito.any(XXServiceDef.class))).thenReturn(sd); - - RangerServiceDef out = serviceDBStore.createServiceDef(sd); - Assertions.assertNotNull(out); - - ArgumentCaptor createdConstraint = ArgumentCaptor.forClass(XXConstraintDef.class); - Mockito.verify(xConstraintDao).create(createdConstraint.capture()); - Assertions.assertEquals(Long.valueOf(1L), createdConstraint.getValue().getItemId()); - Assertions.assertEquals(Integer.valueOf(0), createdConstraint.getValue().getOrder()); - } - - @Test - public void test263updateChildObjectsOfServiceDef_constraintDefs() throws Exception { - XXServiceDef createdSvcDef = new XXServiceDef(); - createdSvcDef.setId(1L); - - XXServiceConfigDefDao xCfgDao = Mockito.mock(XXServiceConfigDefDao.class); - XXResourceDefDao xResDao = Mockito.mock(XXResourceDefDao.class); - XXAccessTypeDefDao xAtdDao = Mockito.mock(XXAccessTypeDefDao.class); - XXPolicyConditionDefDao xCondDao = Mockito.mock(XXPolicyConditionDefDao.class); - XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); - XXContextEnricherDefDao xEnrDao = Mockito.mock(XXContextEnricherDefDao.class); - XXEnumDefDao xEnumDao = Mockito.mock(XXEnumDefDao.class); - XXDataMaskTypeDefDao xDmDao = Mockito.mock(XXDataMaskTypeDefDao.class); - - XXConstraintDef existingUpdate = new XXConstraintDef(); - existingUpdate.setId(2L); - existingUpdate.setItemId(2L); - existingUpdate.setName("maxRows"); - XXConstraintDef existingRemove = new XXConstraintDef(); - existingRemove.setId(3L); - existingRemove.setItemId(3L); - existingRemove.setName("gone"); - List existing = new ArrayList<>(); - existing.add(existingUpdate); - existing.add(existingRemove); - - Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xCfgDao); - Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResDao); - Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAtdDao); - Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); - Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); - Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); - Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDmDao); - Mockito.when(xCfgDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xResDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xAtdDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xCondDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xConstraintDao.findByServiceDefId(1L)).thenReturn(existing); - Mockito.when(xEnrDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xEnumDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xDmDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(xConstraintDao.create(Mockito.any())).thenAnswer(inv -> inv.getArgument(0)); - Mockito.when(xConstraintDao.update(Mockito.any())).thenAnswer(inv -> inv.getArgument(0)); - Mockito.when(serviceDefService.populateRangerConstraintDefToXX(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyInt())).thenAnswer(inv -> { - RangerServiceDef.RangerConstraintDef view = inv.getArgument(0); - XXConstraintDef entity = inv.getArgument(1); - entity.setItemId(view.getItemId()); - entity.setName(view.getName()); - return entity; - }); - Mockito.when(serviceDefService.populateXXToRangerConstraintDef(Mockito.any())).thenReturn(new RangerServiceDef.RangerConstraintDef()); - - RangerServiceDef.RangerConstraintDef createDef = new RangerServiceDef.RangerConstraintDef(); - createDef.setItemId(1L); - createDef.setName("requireApproval"); - RangerServiceDef.RangerConstraintDef updateDef = new RangerServiceDef.RangerConstraintDef(); - updateDef.setItemId(2L); - updateDef.setName("maxRows"); - List constraintDefs = new ArrayList<>(); - constraintDefs.add(createDef); - constraintDefs.add(updateDef); - - Method m = ServiceDBStore.class.getDeclaredMethod("updateChildObjectsOfServiceDef", XXServiceDef.class, - List.class, List.class, List.class, List.class, List.class, List.class, - RangerServiceDef.RangerDataMaskDef.class, RangerServiceDef.RangerRowFilterDef.class, List.class); - m.setAccessible(true); - m.invoke(serviceDBStore, createdSvcDef, new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), - new ArrayList<>(), new ArrayList<>(), new ArrayList<>(), new RangerServiceDef.RangerDataMaskDef(), - new RangerServiceDef.RangerRowFilterDef(), constraintDefs); - - ArgumentCaptor createdConstraint = ArgumentCaptor.forClass(XXConstraintDef.class); - Mockito.verify(xConstraintDao).create(createdConstraint.capture()); - Assertions.assertEquals(Long.valueOf(1L), createdConstraint.getValue().getItemId()); - Assertions.assertEquals(Integer.valueOf(0), createdConstraint.getValue().getOrder()); - - ArgumentCaptor updatedConstraint = ArgumentCaptor.forClass(XXConstraintDef.class); - Mockito.verify(xConstraintDao).update(updatedConstraint.capture()); - Assertions.assertEquals(Long.valueOf(2L), updatedConstraint.getValue().getItemId()); - Assertions.assertEquals(Integer.valueOf(1), updatedConstraint.getValue().getOrder()); - Mockito.verify(xConstraintDao).remove(existingRemove); - Mockito.verify(daoMgr, Mockito.never()).getXXPolicyRefCondition(); - } - - @Test - public void test264deleteServiceDef_removesEachConstraintDef() throws Exception { - setup(); - - RangerServiceDef serviceDef = new RangerServiceDef(); - serviceDef.setId(1L); - serviceDef.setName("agent"); - serviceDef.setVersion(1L); - Mockito.when(serviceDefService.read(1L)).thenReturn(serviceDef); - - XXServiceDao xServiceDao = Mockito.mock(XXServiceDao.class); - Mockito.when(daoMgr.getXXService()).thenReturn(xServiceDao); - Mockito.when(xServiceDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - - XXDataMaskTypeDefDao xDmDao = Mockito.mock(XXDataMaskTypeDefDao.class); - XXAccessTypeDefDao xAtdDao = Mockito.mock(XXAccessTypeDefDao.class); - XXContextEnricherDefDao xEnrDao = Mockito.mock(XXContextEnricherDefDao.class); - XXEnumDefDao xEnumDao = Mockito.mock(XXEnumDefDao.class); - XXPolicyConditionDefDao xCondDao = Mockito.mock(XXPolicyConditionDefDao.class); - XXConstraintDefDao xConstraintDao = Mockito.mock(XXConstraintDefDao.class); - XXResourceDefDao xResDao = Mockito.mock(XXResourceDefDao.class); - XXServiceConfigDefDao xCfgDao = Mockito.mock(XXServiceConfigDefDao.class); - Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDmDao); - Mockito.when(xDmDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAtdDao); - Mockito.when(xAtdDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xEnrDao); - Mockito.when(xEnrDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDao); - Mockito.when(xEnumDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xCondDao); - Mockito.when(xCondDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResDao); - Mockito.when(xResDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xCfgDao); - Mockito.when(xCfgDao.findByServiceDefId(1L)).thenReturn(new ArrayList<>()); - - XXConstraintDef requireApproval = new XXConstraintDef(); - requireApproval.setId(11L); - requireApproval.setName("requireApproval"); - XXConstraintDef maxRows = new XXConstraintDef(); - maxRows.setId(12L); - maxRows.setName("maxRows"); - List rows = new ArrayList<>(); - rows.add(requireApproval); - rows.add(maxRows); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDao); - Mockito.when(xConstraintDao.findByServiceDefId(1L)).thenReturn(rows); - - serviceDBStore.deleteServiceDef(1L, true); - - Mockito.verify(xConstraintDao).remove(requireApproval); - Mockito.verify(xConstraintDao).remove(maxRows); - } - @Test public void test234searchRangerPolicies_withServiceName() throws Exception { SearchFilter f = new SearchFilter(); diff --git a/security-admin/src/test/java/org/apache/ranger/patch/TestPatchForServiceDefJson_J10067.java b/security-admin/src/test/java/org/apache/ranger/patch/TestPatchForServiceDefJson_J10067.java new file mode 100644 index 00000000000..b306d823fb2 --- /dev/null +++ b/security-admin/src/test/java/org/apache/ranger/patch/TestPatchForServiceDefJson_J10067.java @@ -0,0 +1,113 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.ranger.patch; + +import org.apache.ranger.db.RangerDaoManager; +import org.apache.ranger.db.XXServiceDefDao; +import org.apache.ranger.entity.XXServiceDef; +import org.apache.ranger.service.RangerServiceDefService; +import org.junit.jupiter.api.Assertions; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.mockito.Mockito; +import org.mockito.junit.jupiter.MockitoExtension; +import org.springframework.transaction.PlatformTransactionManager; +import org.springframework.transaction.TransactionStatus; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.Collections; + +@ExtendWith(MockitoExtension.class) +public class TestPatchForServiceDefJson_J10067 { + private RangerDaoManager daoMgr; + private XXServiceDefDao xServiceDefDao; + private RangerServiceDefService serviceDefService; + private PatchForServiceDefJson_J10067 patch; + + @BeforeEach + public void setUp() { + daoMgr = Mockito.mock(RangerDaoManager.class); + xServiceDefDao = Mockito.mock(XXServiceDefDao.class); + serviceDefService = Mockito.mock(RangerServiceDefService.class); + + PlatformTransactionManager txManager = Mockito.mock(PlatformTransactionManager.class); + + Mockito.lenient().when(txManager.getTransaction(Mockito.any())).thenReturn(Mockito.mock(TransactionStatus.class)); + Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xServiceDefDao); + + patch = new PatchForServiceDefJson_J10067(); + patch.daoMgr = daoMgr; + patch.serviceDefService = serviceDefService; + patch.txManager = txManager; + } + + @Test + public void testStoresJsonOnlyForServiceDefsWithoutIt() { + XXServiceDef withoutJson = serviceDef(1L, "hive", null); + XXServiceDef withJson = serviceDef(2L, "hdfs", "{\"name\":\"hdfs\"}"); + + Mockito.when(xServiceDefDao.getAll()).thenReturn(new ArrayList<>(Arrays.asList(withoutJson, withJson))); + Mockito.when(xServiceDefDao.getById(1L)).thenReturn(withoutJson); + Mockito.when(xServiceDefDao.getById(2L)).thenReturn(withJson); + Mockito.when(serviceDefService.buildDefText(withoutJson, null)).thenReturn("{\"name\":\"hive\"}"); + + patch.execLoad(); + + Assertions.assertEquals("{\"name\":\"hive\"}", withoutJson.getDefText()); + Assertions.assertEquals("{\"name\":\"hdfs\"}", withJson.getDefText()); + Mockito.verify(xServiceDefDao).update(withoutJson); + Mockito.verify(xServiceDefDao, Mockito.never()).update(withJson); + Mockito.verify(serviceDefService, Mockito.never()).buildDefText(Mockito.eq(withJson), Mockito.any()); + } + + @Test + public void testFailsWhenJsonCannotBeBuilt() { + XXServiceDef withoutJson = serviceDef(1L, "hive", null); + + Mockito.when(xServiceDefDao.getAll()).thenReturn(new ArrayList<>(Collections.singletonList(withoutJson))); + Mockito.when(xServiceDefDao.getById(1L)).thenReturn(withoutJson); + Mockito.when(serviceDefService.buildDefText(withoutJson, null)).thenReturn(null); + + Assertions.assertThrows(RuntimeException.class, () -> patch.execLoad()); + Mockito.verify(xServiceDefDao, Mockito.never()).update(Mockito.any()); + } + + @Test + public void testNoServiceDefs() { + Mockito.when(xServiceDefDao.getAll()).thenReturn(new ArrayList<>()); + + patch.execLoad(); + patch.printStats(); + + Mockito.verify(xServiceDefDao, Mockito.never()).update(Mockito.any()); + } + + private static XXServiceDef serviceDef(Long id, String name, String defText) { + XXServiceDef ret = new XXServiceDef(); + + ret.setId(id); + ret.setName(name); + ret.setDefText(defText); + + return ret; + } +} diff --git a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java index 15c93d243a1..090d2ba6345 100644 --- a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java +++ b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefService.java @@ -18,8 +18,10 @@ import org.apache.commons.lang3.StringUtils; import org.apache.ranger.authorization.hadoop.config.RangerAdminConfig; +import org.apache.ranger.authorization.utils.JsonUtils; import org.apache.ranger.biz.RangerBizUtil; import org.apache.ranger.common.ContextUtil; +import org.apache.ranger.common.JSONUtil; import org.apache.ranger.common.PropertiesUtil; import org.apache.ranger.common.StringUtil; import org.apache.ranger.common.UserSessionBase; @@ -27,7 +29,6 @@ import org.apache.ranger.db.RangerDaoManager; import org.apache.ranger.db.XXAccessTypeDefDao; import org.apache.ranger.db.XXAccessTypeDefGrantsDao; -import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; import org.apache.ranger.db.XXEnumDefDao; @@ -36,7 +37,6 @@ import org.apache.ranger.db.XXPortalUserDao; import org.apache.ranger.db.XXResourceDefDao; import org.apache.ranger.db.XXServiceConfigDefDao; -import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXDataMaskTypeDef; import org.apache.ranger.entity.XXEnumDef; @@ -52,6 +52,7 @@ import org.apache.ranger.entity.XXServiceDefWithAssignedId; import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerContextEnricherDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerPolicyConditionDef; @@ -88,6 +89,7 @@ import static org.junit.jupiter.api.Assertions.assertTrue; import static org.mockito.ArgumentMatchers.any; import static org.mockito.Mockito.doReturn; +import static org.mockito.Mockito.never; import static org.mockito.Mockito.spy; import static org.mockito.Mockito.verify; @@ -298,7 +300,6 @@ public void test3PopulateViewBean() { Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(Mockito.mock(XXConstraintDefDao.class)); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(contextEnrichersList); @@ -497,7 +498,6 @@ public void test4getAllServiceDefs() { Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(Mockito.mock(XXConstraintDefDao.class)); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(contextEnrichersList); @@ -673,7 +673,6 @@ public void test5getPopulatedViewObject() { Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(Mockito.mock(XXConstraintDefDao.class)); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(contextEnrichersList); @@ -918,68 +917,199 @@ public void testValidateForUpdate() throws NoSuchMethodException { } @Test - public void test6PopulateViewBeanLoadsConstraintDefs() { + public void test6PopulateViewBeanLoadsConstraintDefs() throws Exception { + serviceDefService.jsonUtil = new JSONUtil(); + + RangerConstraintDef constraintDef = new RangerConstraintDef(); + constraintDef.setItemId(4L); + constraintDef.setName("requireApproval"); + constraintDef.setResources(Arrays.asList("database", "udf")); + constraintDef.setAccessTypes(Collections.singletonList("select")); + RangerServiceDef.RangerConstraintParamDef approver = new RangerServiceDef.RangerConstraintParamDef(); + approver.setItemId(1L); + approver.setName("approver"); + approver.setType("user"); + approver.setMandatory(true); + constraintDef.getParameters().add(approver); + + RangerServiceDef jsonBody = new RangerServiceDef(); + jsonBody.setName("json-name"); + jsonBody.getConstraintDefs().add(constraintDef); + + XXServiceDef serviceDef = serviceDef(); + serviceDef.setAddedByUserId(null); + serviceDef.setUpdatedByUserId(null); + serviceDef.setName("hdfs"); + serviceDef.setDefOptions("{}"); + serviceDef.setDefText(serviceDefService.objectToJson(jsonBody)); + + RangerServiceDef loaded = serviceDefService.populateViewBean(serviceDef); + + assertNotNull(loaded.getConstraintDefs()); + assertEquals(serviceDef.getName(), loaded.getName()); + assertEquals(1, loaded.getConstraintDefs().size()); + assertEquals(Long.valueOf(4L), loaded.getConstraintDefs().get(0).getItemId()); + assertEquals("requireApproval", loaded.getConstraintDefs().get(0).getName()); + assertEquals(Arrays.asList("database", "udf"), loaded.getConstraintDefs().get(0).getResources()); + assertEquals(Collections.singletonList("select"), loaded.getConstraintDefs().get(0).getAccessTypes()); + assertEquals("approver", loaded.getConstraintDefs().get(0).getParameters().get(0).getName()); + assertEquals("user", loaded.getConstraintDefs().get(0).getParameters().get(0).getType()); + } + + @Test + public void testPopulateViewBeanReadsDefText() { + mockBaseFieldsForPopulateViewBean(); + + RangerResourceDef tool = new RangerResourceDef(); + tool.setItemId(1L); + tool.setName("tool"); + tool.setLevel(10); + + RangerAccessTypeDef execute = new RangerAccessTypeDef(); + execute.setItemId(1L); + execute.setName("execute"); + + RangerServiceDef stored = new RangerServiceDef(); + stored.setName("stale-name-in-json"); + stored.setResources(Collections.singletonList(tool)); + stored.setAccessTypes(Collections.singletonList(execute)); + stored.setConstraintDefs(Collections.singletonList(constraintDef())); + + XXServiceDef xServiceDef = serviceDef(); + xServiceDef.setName("agent"); + xServiceDef.setDefOptions("{}"); + xServiceDef.setDefText(JsonUtils.objectToJson(stored)); + + RangerServiceDef loaded = serviceDefService.populateViewBean(xServiceDef); + + assertEquals("agent", loaded.getName()); + assertEquals(1, loaded.getResources().size()); + assertEquals("tool", loaded.getResources().get(0).getName()); + assertEquals("execute", loaded.getAccessTypes().get(0).getName()); + assertEquals(1, loaded.getConstraintDefs().size()); + assertEquals("requireApproval", loaded.getConstraintDefs().get(0).getName()); + assertEquals(Collections.singletonList("tool"), loaded.getConstraintDefs().get(0).getResources()); + assertEquals("approver", loaded.getConstraintDefs().get(0).getParameters().get(0).getName()); + verify(daoMgr, never()).getXXResourceDef(); + verify(daoMgr, never()).getXXAccessTypeDef(); + verify(daoMgr, never()).getXXServiceConfigDef(); + } + + @Test + public void testPopulateViewBeanFallsBackToChildTables() { + mockBaseFieldsForPopulateViewBean(); + mockEmptyChildTables(Id); + + XXServiceDef xServiceDef = serviceDef(); + xServiceDef.setDefOptions("{}"); + xServiceDef.setDefText("not-a-json"); + + RangerServiceDef loaded = serviceDefService.populateViewBean(xServiceDef); + + assertNotNull(loaded); + assertTrue(loaded.getConstraintDefs().isEmpty()); + verify(daoMgr).getXXResourceDef(); + verify(daoMgr).getXXAccessTypeDef(); + } + + @Test + public void testBuildDefTextIncludesConstraintDefsAndNoDerivedValues() { + serviceDefService.stringUtil = new StringUtil(); + serviceDefService.jsonUtil = new JSONUtil(); + + mockEmptyChildTables(Id); + + XXServiceDef xServiceDef = serviceDef(); + xServiceDef.setName("agent"); + xServiceDef.setDefOptions("{\"custom\":\"value\"}"); + + String defText = serviceDefService.buildDefText(xServiceDef, Collections.singletonList(constraintDef())); + + assertNotNull(defText); + assertFalse(defText.contains("markerAccessTypes")); + assertFalse(defText.contains(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)); + + RangerServiceDef stored = JsonUtils.jsonToObject(defText, RangerServiceDef.class); + + assertNotNull(stored); + assertEquals("agent", stored.getName()); + assertEquals("value", stored.getOptions().get("custom")); + assertEquals(1, stored.getConstraintDefs().size()); + assertEquals("requireApproval", stored.getConstraintDefs().get(0).getName()); + assertEquals(Arrays.asList("execute"), stored.getConstraintDefs().get(0).getAccessTypes()); + } + + @Test + public void testBuildDefTextWithoutConstraintDefs() { + serviceDefService.stringUtil = new StringUtil(); + + mockEmptyChildTables(Id); + + String defText = serviceDefService.buildDefText(serviceDef(), null); + RangerServiceDef stored = JsonUtils.jsonToObject(defText, RangerServiceDef.class); + + assertNotNull(stored); + assertTrue(stored.getConstraintDefs() == null || stored.getConstraintDefs().isEmpty()); + } + + private void mockBaseFieldsForPopulateViewBean() { serviceDefService.bizUtil = Mockito.mock(RangerBizUtil.class); serviceDefService.stringUtil = new StringUtil(); + serviceDefService.jsonUtil = new JSONUtil(); + + XXPortalUserDao xPortalUserDao = Mockito.mock(XXPortalUserDao.class); + XXPortalUser portalUser = new XXPortalUser(); - XXServiceDef serviceDef = serviceDef(); - XXPortalUser portalUser = new XXPortalUser(); portalUser.setId(Id); portalUser.setFirstName("Admin"); - XXConstraintDef xConstraintDef = new XXConstraintDef(); - xConstraintDef.setId(Id); - xConstraintDef.setDefid(serviceDef.getId()); - xConstraintDef.setItemId(4L); - xConstraintDef.setName("requireApproval"); - xConstraintDef.setResources("[\"database\",\"udf\"]"); - xConstraintDef.setAccessTypes("[\"select\"]"); - xConstraintDef.setParameters("[{\"itemId\":1,\"name\":\"approver\",\"type\":\"user\",\"mandatory\":true}]"); - List xConstraintDefs = new ArrayList<>(); - xConstraintDefs.add(xConstraintDef); - - XXPortalUserDao xPortalUserDao = Mockito.mock(XXPortalUserDao.class); + Mockito.lenient().when(daoMgr.getXXPortalUser()).thenReturn(xPortalUserDao); + Mockito.lenient().when(xPortalUserDao.getById(Id)).thenReturn(portalUser); + } + + private void mockEmptyChildTables(Long serviceDefId) { XXServiceConfigDefDao xServiceConfigDefDao = Mockito.mock(XXServiceConfigDefDao.class); XXResourceDefDao xResourceDefDao = Mockito.mock(XXResourceDefDao.class); XXAccessTypeDefDao xAccessTypeDefDao = Mockito.mock(XXAccessTypeDefDao.class); XXAccessTypeDefGrantsDao xAccessTypeDefGrantsDao = Mockito.mock(XXAccessTypeDefGrantsDao.class); XXPolicyConditionDefDao xPolicyConditionDefDao = Mockito.mock(XXPolicyConditionDefDao.class); - XXConstraintDefDao xConstraintDefDao = Mockito.mock(XXConstraintDefDao.class); XXContextEnricherDefDao xContextEnricherDefDao = Mockito.mock(XXContextEnricherDefDao.class); XXEnumDefDao xEnumDefDao = Mockito.mock(XXEnumDefDao.class); - XXDataMaskTypeDefDao xDataMaskTypeDao = Mockito.mock(XXDataMaskTypeDefDao.class); + XXDataMaskTypeDefDao xDataMaskTypeDefDao = Mockito.mock(XXDataMaskTypeDefDao.class); - Mockito.when(daoMgr.getXXPortalUser()).thenReturn(xPortalUserDao); - Mockito.when(xPortalUserDao.getById(Id)).thenReturn(portalUser); Mockito.when(daoMgr.getXXServiceConfigDef()).thenReturn(xServiceConfigDefDao); - Mockito.when(xServiceConfigDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(xServiceConfigDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); Mockito.when(daoMgr.getXXResourceDef()).thenReturn(xResourceDefDao); - Mockito.when(xResourceDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(xResourceDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); Mockito.when(daoMgr.getXXAccessTypeDef()).thenReturn(xAccessTypeDefDao); - Mockito.when(xAccessTypeDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(xAccessTypeDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); Mockito.when(daoMgr.getXXAccessTypeDefGrants()).thenReturn(xAccessTypeDefGrantsDao); - Mockito.when(xAccessTypeDefGrantsDao.findImpliedGrantsByServiceDefId(serviceDef.getId())).thenReturn(Collections.emptyMap()); + Mockito.when(xAccessTypeDefGrantsDao.findImpliedGrantsByServiceDefId(serviceDefId)).thenReturn(Collections.emptyMap()); Mockito.when(daoMgr.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao); - Mockito.when(xPolicyConditionDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXConstraintDef()).thenReturn(xConstraintDefDao); - Mockito.when(xConstraintDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(xConstraintDefs); + Mockito.when(xPolicyConditionDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); Mockito.when(daoMgr.getXXContextEnricherDef()).thenReturn(xContextEnricherDefDao); - Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); + Mockito.when(xContextEnricherDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); Mockito.when(daoMgr.getXXEnumDef()).thenReturn(xEnumDefDao); - Mockito.when(xEnumDefDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); - Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDataMaskTypeDao); - Mockito.when(xDataMaskTypeDao.findByServiceDefId(serviceDef.getId())).thenReturn(new ArrayList<>()); - - RangerServiceDef loaded = serviceDefService.populateViewBean(serviceDef); + Mockito.when(xEnumDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); + Mockito.when(daoMgr.getXXDataMaskTypeDef()).thenReturn(xDataMaskTypeDefDao); + Mockito.when(xDataMaskTypeDefDao.findByServiceDefId(serviceDefId)).thenReturn(new ArrayList<>()); + } - assertNotNull(loaded.getConstraintDefs()); - assertEquals(1, loaded.getConstraintDefs().size()); - assertEquals(Long.valueOf(4L), loaded.getConstraintDefs().get(0).getItemId()); - assertEquals("requireApproval", loaded.getConstraintDefs().get(0).getName()); - assertEquals(Arrays.asList("database", "udf"), loaded.getConstraintDefs().get(0).getResources()); - assertEquals(Collections.singletonList("select"), loaded.getConstraintDefs().get(0).getAccessTypes()); - assertEquals("approver", loaded.getConstraintDefs().get(0).getParameters().get(0).getName()); - assertEquals("user", loaded.getConstraintDefs().get(0).getParameters().get(0).getType()); + private RangerConstraintDef constraintDef() { + RangerServiceDef.RangerConstraintParamDef approver = new RangerServiceDef.RangerConstraintParamDef(); + approver.setItemId(1L); + approver.setName("approver"); + approver.setType("group"); + approver.setMandatory(true); + + RangerConstraintDef ret = new RangerConstraintDef(); + ret.setItemId(1L); + ret.setName("requireApproval"); + ret.setResources(Collections.singletonList("tool")); + ret.setAccessTypes(Collections.singletonList("execute")); + ret.setParameters(Collections.singletonList(approver)); + + return ret; } private boolean hasActionMatchesCondition(RangerServiceDef serviceDef) { diff --git a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java index ca2280a812f..a2d73b75078 100644 --- a/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java +++ b/security-admin/src/test/java/org/apache/ranger/service/TestRangerServiceDefServiceBase.java @@ -29,7 +29,6 @@ import org.apache.ranger.db.XXEnumElementDefDao; import org.apache.ranger.db.XXResourceDefDao; import org.apache.ranger.entity.XXAccessTypeDef; -import org.apache.ranger.entity.XXConstraintDef; import org.apache.ranger.entity.XXContextEnricherDef; import org.apache.ranger.entity.XXEnumDef; import org.apache.ranger.entity.XXEnumElementDef; @@ -65,6 +64,7 @@ import javax.ws.rs.WebApplicationException; import java.util.ArrayList; +import java.util.Arrays; import java.util.Collections; import java.util.Date; import java.util.HashMap; @@ -595,13 +595,63 @@ public void test21searchRangerServiceDefs() { } @Test - public void test22populateRangerConstraintDefRoundTrip() { - rangerServiceDefService.jsonUtil = new JSONUtil(); + public void test22mapViewToEntityBeanLeavesDefTextUnset() { + RangerServiceDef view = rangerServiceDef(); + view.setGuid("column-guid"); + view.setName("hdfs"); + view.getConstraintDefs().add(constraintDef()); + XXServiceDef stored = rangerServiceDefService.mapViewToEntityBean(view, serviceDef(), 1); + + Assertions.assertNull(stored.getDefText()); + } + + @Test + public void test23populateViewBeanReadsDefTextWithoutOverwritingColumns() throws Exception { + JSONUtil jsonUtil = new JSONUtil(); + rangerServiceDefService.jsonUtil = jsonUtil; + + RangerServiceDef jsonBody = new RangerServiceDef(); + jsonBody.setName("json-name"); + jsonBody.setGuid("json-guid"); + jsonBody.setLabel("json-label"); + jsonBody.setDescription("json-description"); + Map jsonOptions = new HashMap<>(); + jsonOptions.put("fromJson", "yes"); + jsonBody.setOptions(jsonOptions); + jsonBody.getConstraintDefs().add(constraintDef()); + + XXServiceDef row = serviceDef(); + row.setAddedByUserId(null); + row.setUpdatedByUserId(null); + row.setName("hdfs"); + row.setGuid("column-guid"); + row.setLabel("column-label"); + row.setDescription("column-description"); + row.setDefOptions("{\"stored\":\"yes\"}"); + row.setDefText(jsonUtil.writeObjectAsString(jsonBody)); + + RangerServiceDef loaded = rangerServiceDefService.populateViewBean(row); + + Assertions.assertEquals("hdfs", loaded.getName()); + Assertions.assertEquals("column-guid", loaded.getGuid()); + Assertions.assertEquals("column-label", loaded.getLabel()); + Assertions.assertEquals("column-description", loaded.getDescription()); + Assertions.assertEquals("yes", loaded.getOptions().get("stored")); + Assertions.assertNull(loaded.getOptions().get("fromJson")); + Assertions.assertEquals(1, loaded.getConstraintDefs().size()); + Assertions.assertEquals("requireApproval", loaded.getConstraintDefs().get(0).getName()); + Assertions.assertEquals(Arrays.asList("database", "udf"), loaded.getConstraintDefs().get(0).getResources()); + Assertions.assertEquals(Collections.singletonList("select"), loaded.getConstraintDefs().get(0).getAccessTypes()); + Assertions.assertEquals("approver", loaded.getConstraintDefs().get(0).getParameters().get(0).getName()); + Assertions.assertEquals("user", loaded.getConstraintDefs().get(0).getParameters().get(0).getType()); + Assertions.assertEquals("authType", loaded.getConstraintDefs().get(0).getParameters().get(1).getSubType()); + } + + private RangerConstraintDef constraintDef() { RangerConstraintParamDef approver = new RangerConstraintParamDef(); approver.setItemId(1L); approver.setName("approver"); - approver.setLabel("Approver"); approver.setType("user"); approver.setMandatory(true); @@ -621,89 +671,15 @@ public void test22populateRangerConstraintDefRoundTrip() { List parameters = new ArrayList<>(); parameters.add(approver); parameters.add(mode); - Map options = new HashMap<>(); - options.put("ui", "tab"); RangerConstraintDef constraintDef = new RangerConstraintDef(); constraintDef.setItemId(4L); constraintDef.setName("requireApproval"); - constraintDef.setLabel("Require approval"); - constraintDef.setDescription("Pause for approval"); - constraintDef.setRbKeyLabel("rb.label"); - constraintDef.setRbKeyDescription("rb.description"); constraintDef.setResources(resources); constraintDef.setAccessTypes(accessTypes); constraintDef.setParameters(parameters); - constraintDef.setOptions(options); - - XXConstraintDef xConstraintDef = new XXConstraintDef(); - XXServiceDef serviceDef = new XXServiceDef(); - serviceDef.setId(Id); - Mockito.when((XXConstraintDef) rangerAuditFields.populateAuditFields(xConstraintDef, serviceDef)).thenReturn(xConstraintDef); - - XXConstraintDef stored = rangerServiceDefService.populateRangerConstraintDefToXX(constraintDef, xConstraintDef, serviceDef, 1); - Assertions.assertEquals(Integer.valueOf(0), stored.getOrder()); - Assertions.assertEquals(serviceDef.getId(), stored.getDefid()); - - RangerConstraintDef roundTrip = rangerServiceDefService.populateXXToRangerConstraintDef(stored); - Assertions.assertEquals(Long.valueOf(4L), roundTrip.getItemId()); - Assertions.assertEquals("requireApproval", roundTrip.getName()); - Assertions.assertEquals("Require approval", roundTrip.getLabel()); - Assertions.assertEquals("Pause for approval", roundTrip.getDescription()); - Assertions.assertEquals("rb.label", roundTrip.getRbKeyLabel()); - Assertions.assertEquals("rb.description", roundTrip.getRbKeyDescription()); - Assertions.assertEquals(resources, roundTrip.getResources()); - Assertions.assertEquals(accessTypes, roundTrip.getAccessTypes()); - Assertions.assertEquals("tab", roundTrip.getOptions().get("ui")); - Assertions.assertEquals(2, roundTrip.getParameters().size()); - - RangerConstraintParamDef approverOut = roundTrip.getParameters().get(0); - Assertions.assertEquals("approver", approverOut.getName()); - Assertions.assertEquals("user", approverOut.getType()); - Assertions.assertNull(approverOut.getSubType()); - Assertions.assertEquals(Boolean.TRUE, approverOut.getMandatory()); - - RangerConstraintParamDef modeOut = roundTrip.getParameters().get(1); - Assertions.assertEquals("mode", modeOut.getName()); - Assertions.assertEquals("enum", modeOut.getType()); - Assertions.assertEquals("authType", modeOut.getSubType()); - Assertions.assertEquals(Boolean.FALSE, modeOut.getMandatory()); - Assertions.assertEquals("simple", modeOut.getDefaultValue()); - } - - @Test - public void test23populateRangerConstraintDefToXXNullServiceDef() { - Mockito.when(restErrorUtil.createRESTException("RangerServiceDef cannot be null.", MessageEnums.DATA_NOT_FOUND)).thenThrow(new WebApplicationException()); - - assertThrows(WebApplicationException.class, () -> { - rangerServiceDefService.populateRangerConstraintDefToXX(new RangerConstraintDef(), new XXConstraintDef(), null, 1); - }); - } - - @Test - public void test24populateRangerConstraintDefNullListsStoredAsNull() { - rangerServiceDefService.jsonUtil = new JSONUtil(); - - RangerConstraintDef constraintDef = Mockito.spy(new RangerConstraintDef()); - constraintDef.setItemId(1L); - constraintDef.setName("requireApproval"); - Mockito.doReturn(null).when(constraintDef).getResources(); - Mockito.doReturn(null).when(constraintDef).getAccessTypes(); - - XXConstraintDef xConstraintDef = new XXConstraintDef(); - XXServiceDef serviceDef = new XXServiceDef(); - serviceDef.setId(Id); - Mockito.when((XXConstraintDef) rangerAuditFields.populateAuditFields(xConstraintDef, serviceDef)).thenReturn(xConstraintDef); - - XXConstraintDef stored = rangerServiceDefService.populateRangerConstraintDefToXX(constraintDef, xConstraintDef, serviceDef, 1); - - Assertions.assertNull(stored.getResources()); - Assertions.assertNull(stored.getAccessTypes()); - - RangerConstraintDef roundTrip = rangerServiceDefService.populateXXToRangerConstraintDef(stored); - Assertions.assertTrue(roundTrip.getResources().isEmpty()); - Assertions.assertTrue(roundTrip.getAccessTypes().isEmpty()); + return constraintDef; } private RangerServiceDef rangerServiceDef() { diff --git a/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java b/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java index e1a8c5e0683..aedc02e2e5b 100644 --- a/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java +++ b/security-admin/src/test/java/org/apache/ranger/service/TestXPortalUserService.java @@ -24,7 +24,6 @@ import org.apache.ranger.db.XXAssetDao; import org.apache.ranger.db.XXAuditMapDao; import org.apache.ranger.db.XXAuthSessionDao; -import org.apache.ranger.db.XXConstraintDefDao; import org.apache.ranger.db.XXContextEnricherDefDao; import org.apache.ranger.db.XXCredentialStoreDao; import org.apache.ranger.db.XXDataMaskTypeDefDao; @@ -118,7 +117,6 @@ public class TestXPortalUserService { @Mock private XXAccessTypeDefDao xxAccessTypeDefDao; @Mock private XXAccessTypeDefGrantsDao xxAccessTypeDefGrantsDao; @Mock private XXPolicyConditionDefDao xxPolicyConditionDefDao; - @Mock private XXConstraintDefDao xxConstraintDefDao; @Mock private XXContextEnricherDefDao xxContextEnricherDefDao; @Mock private XXEnumDefDao xxEnumDefDao; @Mock private XXEnumElementDefDao xxEnumElementDefDao; @@ -178,7 +176,6 @@ public void testUpdateXXPortalUserReferences_invokesAllDaosForAddedAndUpdatedBy( when(daoManager.getXXAccessTypeDef()).thenReturn(xxAccessTypeDefDao); when(daoManager.getXXAccessTypeDefGrants()).thenReturn(xxAccessTypeDefGrantsDao); when(daoManager.getXXPolicyConditionDef()).thenReturn(xxPolicyConditionDefDao); - when(daoManager.getXXConstraintDef()).thenReturn(xxConstraintDefDao); when(daoManager.getXXContextEnricherDef()).thenReturn(xxContextEnricherDefDao); when(daoManager.getXXEnumDef()).thenReturn(xxEnumDefDao); when(daoManager.getXXEnumElementDef()).thenReturn(xxEnumElementDefDao); From b0b41dca10a1fd7b9af40b70ff9d1446ac56a563 Mon Sep 17 00:00:00 2001 From: Vyom Mani Tiwari Date: Fri, 23 Oct 2026 12:16:14 +0530 Subject: [PATCH 3/3] RANGER-5851: Admin: persist constraintDefs of service definitions --- .../079-add-def_text-to-x_service_def.sql | 1 + .../079-add-def_text-to-x_service_def.sql | 1 + .../service/RangerServiceDefServiceBase.java | 2 +- .../apache/ranger/biz/TestServiceDBStore.java | 38 +++++++++++++++++-- 4 files changed, 38 insertions(+), 4 deletions(-) diff --git a/security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql b/security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql index 9cdae886fa5..a50014bb56e 100644 --- a/security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql +++ b/security-admin/db/sqlanywhere/patches/079-add-def_text-to-x_service_def.sql @@ -17,3 +17,4 @@ IF NOT EXISTS(select * from SYS.SYSCOLUMNS where tname = 'x_service_def' and cna ALTER TABLE dbo.x_service_def ADD def_text text DEFAULT NULL NULL; END IF; GO +exit diff --git a/security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql b/security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql index 6b15584728e..51e9063b458 100644 --- a/security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql +++ b/security-admin/db/sqlserver/patches/079-add-def_text-to-x_service_def.sql @@ -19,3 +19,4 @@ BEGIN ALTER TABLE [dbo].[x_service_def] ADD [def_text] [nvarchar](max) DEFAULT NULL NULL; END GO +exit diff --git a/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java b/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java index ef95be6a590..3edaf67787f 100644 --- a/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java +++ b/security-admin/src/main/java/org/apache/ranger/service/RangerServiceDefServiceBase.java @@ -634,7 +634,7 @@ private boolean applyDefText(V serviceDef, String defText) { } private void loadChildTables(V serviceDef, T xServiceDef) { - Long serviceDefId = xServiceDef.getId(); + Long serviceDefId = xServiceDef.getId(); List xConfigs = daoMgr.getXXServiceConfigDef().findByServiceDefId(serviceDefId); if (!stringUtil.isEmpty(xConfigs)) { diff --git a/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java b/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java index 5a36e7f297e..1eec9735690 100644 --- a/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java +++ b/security-admin/src/test/java/org/apache/ranger/biz/TestServiceDBStore.java @@ -116,6 +116,7 @@ import org.apache.ranger.plugin.model.RangerService; import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef; +import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerContextEnricherDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumDef; import org.apache.ranger.plugin.model.RangerServiceDef.RangerPolicyConditionDef; @@ -284,7 +285,11 @@ public void test11createServiceDef() throws Exception { List xResourceDefs = new ArrayList<>(); xResourceDefs.add(xResourceDef); - RangerServiceDef serviceDef = new RangerServiceDef(); + RangerServiceDef serviceDef = new RangerServiceDef(); + List constraintDefs = Collections.singletonList(constraintDef()); + + serviceDef.setConstraintDefs(constraintDefs); + Mockito.when(serviceDefService.create(serviceDef)).thenReturn(serviceDef); Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xServiceDefDao); @@ -323,6 +328,8 @@ public void test11createServiceDef() throws Exception { Assertions.assertEquals(dbServiceDef.getResources(), serviceDef.getResources()); Mockito.verify(serviceDefService).getPopulatedViewObject(xServiceDef); Mockito.verify(serviceDefService).create(serviceDef); + Mockito.verify(serviceDefService).buildDefText(xServiceDef, constraintDefs); + Mockito.verify(xServiceDefDao).update(xServiceDef); Mockito.verify(daoMgr).getXXServiceConfigDef(); Mockito.verify(daoMgr).getXXEnumDef(); Mockito.verify(daoMgr).getXXAccessTypeDef(); @@ -342,8 +349,11 @@ public void test12updateServiceDef() throws Exception { XXDataMaskTypeDefDao xDataMaskDefDao = Mockito.mock(XXDataMaskTypeDefDao.class); XXServiceDao xServiceDao = Mockito.mock(XXServiceDao.class); - RangerServiceDef rangerServiceDef = rangerServiceDef(); - Long serviceDefId = rangerServiceDef.getId(); + RangerServiceDef rangerServiceDef = rangerServiceDef(); + Long serviceDefId = rangerServiceDef.getId(); + List constraintDefs = Collections.singletonList(constraintDef()); + + rangerServiceDef.setConstraintDefs(constraintDefs); List svcConfDefList = new ArrayList<>(); XXServiceConfigDef serviceConfigDefObj = new XXServiceConfigDef(); @@ -444,6 +454,9 @@ public void test12updateServiceDef() throws Exception { Assertions.assertEquals(dbServiceDef.getConfigs(), rangerServiceDef.getConfigs()); Assertions.assertEquals(dbServiceDef.getVersion(), rangerServiceDef.getVersion()); Assertions.assertEquals(dbServiceDef.getResources(), rangerServiceDef.getResources()); + // update() returns a different object, so this checks the request's constraintDefs were kept + Mockito.verify(serviceDefService).buildDefText(xServiceDef, constraintDefs); + Mockito.verify(xServiceDefDao).update(xServiceDef); } @Test @@ -6961,6 +6974,25 @@ private RangerServiceDef rangerServiceDef() { return rangerServiceDef; } + private RangerConstraintDef constraintDef() { + RangerServiceDef.RangerConstraintParamDef approver = new RangerServiceDef.RangerConstraintParamDef(); + + approver.setItemId(1L); + approver.setName("approver"); + approver.setType("group"); + approver.setMandatory(true); + + RangerConstraintDef constraintDef = new RangerConstraintDef(); + + constraintDef.setItemId(1L); + constraintDef.setName("requireApproval"); + constraintDef.setResources(Collections.singletonList("tool")); + constraintDef.setAccessTypes(Collections.singletonList("execute")); + constraintDef.setParameters(Collections.singletonList(approver)); + + return constraintDef; + } + private RangerService rangerService() { Map configs = new HashMap<>(); configs.put("username", "servicemgr");