Skip to content

Commit 64659d9

Browse files
HearyShenHearyShen
committed
fix: fix the authBuiltinManagement R/W auth issue
1 parent 1a3defa commit 64659d9

File tree

2 files changed

+33
-29
lines changed

2 files changed

+33
-29
lines changed

‎backend/modules/evaluation/application/evaluator_app.go‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,7 @@ func (e *EvaluatorHandlerImpl) UpdateEvaluator(ctx context.Context, request *eva
344344
}
345345
// 如果是builtin分支，补充管理空间校验
346346
if request.GetBuiltin() {
347-
if err := e.authBuiltinManagement(ctx, request.GetWorkspaceID(), spaceTypeBuiltin); err != nil {
347+
if err := e.authBuiltinManagement(ctx, request.GetWorkspaceID(), spaceTypeBuiltin, true); err != nil {
348348
return nil, err
349349
}
350350
}
@@ -583,7 +583,7 @@ func (e *EvaluatorHandlerImpl) GetEvaluatorVersion(ctx context.Context, request
583583
}
584584
// 鉴权
585585
if request.GetBuiltin() {
586-
err = e.authBuiltinManagement(ctx, evaluatorDO.SpaceID, spaceTypeBuiltin)
586+
err = e.authBuiltinManagement(ctx, evaluatorDO.SpaceID, spaceTypeBuiltin, false)
587587
if err != nil {
588588
return nil, err
589589
}
@@ -1473,7 +1473,7 @@ func (e *EvaluatorHandlerImpl) CreateEvaluatorTemplate(ctx context.Context, requ
14731473
}
14741474

14751475
// 校验评估器模板管理权限
1476-
err = e.authBuiltinManagement(ctx, request.GetEvaluatorTemplate().GetWorkspaceID(), spaceTypeTemplate)
1476+
err = e.authBuiltinManagement(ctx, request.GetEvaluatorTemplate().GetWorkspaceID(), spaceTypeTemplate, true)
14771477
if err != nil {
14781478
return nil, err
14791479
}
@@ -1518,7 +1518,7 @@ func (e *EvaluatorHandlerImpl) UpdateEvaluatorTemplate(ctx context.Context, requ
15181518
}
15191519

15201520
// 校验评估器模板管理权限
1521-
err = e.authBuiltinManagement(ctx, request.GetEvaluatorTemplate().GetWorkspaceID(), spaceTypeTemplate)
1521+
err = e.authBuiltinManagement(ctx, request.GetEvaluatorTemplate().GetWorkspaceID(), spaceTypeTemplate, true)
15221522
if err != nil {
15231523
return nil, err
15241524
}
@@ -1574,7 +1574,7 @@ func (e *EvaluatorHandlerImpl) DeleteEvaluatorTemplate(ctx context.Context, requ
15741574
}
15751575

15761576
// 校验评估器模板管理权限
1577-
err = e.authBuiltinManagement(ctx, templateDO.Template.SpaceID, spaceTypeTemplate)
1577+
err = e.authBuiltinManagement(ctx, templateDO.Template.SpaceID, spaceTypeTemplate, true)
15781578
if err != nil {
15791579
return nil, err
15801580
}
@@ -1637,7 +1637,7 @@ func (e *EvaluatorHandlerImpl) UpdateBuiltinEvaluatorTags(ctx context.Context, r
16371637
return nil, errorx.NewByCode(errno.EvaluatorNotExistCode)
16381638
}
16391639
// 校验是否在builtin管理空间
1640-
if err := e.authBuiltinManagement(ctx, request.GetWorkspaceID(), spaceTypeBuiltin); err != nil {
1640+
if err := e.authBuiltinManagement(ctx, request.GetWorkspaceID(), spaceTypeBuiltin, true); err != nil {
16411641
return nil, err
16421642
}
16431643

@@ -1670,7 +1670,19 @@ const (
16701670
)
16711671

16721672
// validate 校验评估器管理权限
1673-
func (e *EvaluatorHandlerImpl) authBuiltinManagement(ctx context.Context, workspaceID int64, spaceType SpaceType) error {
1673+
func (e *EvaluatorHandlerImpl) authBuiltinManagement(ctx context.Context, workspaceID int64, spaceType SpaceType, authWrite bool) error {
1674+
if authWrite {
1675+
// 鉴权
1676+
err := e.auth.Authorization(ctx, &rpc.AuthorizationParam{
1677+
ObjectID: strconv.FormatInt(workspaceID, 10),
1678+
SpaceID: workspaceID,
1679+
ActionObjects: []*rpc.ActionObject{{Action: gptr.Of("listLoopEvaluator"), EntityType: gptr.Of(rpc.AuthEntityType_Space)}}, // listLoopEvaluator为暂时复用的权限点
1680+
})
1681+
if err != nil {
1682+
return err
1683+
}
1684+
}
1685+
16741686
var allowedSpaceIDs []string
16751687
switch spaceType {
16761688
case spaceTypeBuiltin:
@@ -1694,15 +1706,5 @@ func (e *EvaluatorHandlerImpl) authBuiltinManagement(ctx context.Context, worksp
16941706
}
16951707
}
16961708

1697-
// 鉴权
1698-
err := e.auth.Authorization(ctx, &rpc.AuthorizationParam{
1699-
ObjectID: strconv.FormatInt(workspaceID, 10),
1700-
SpaceID: workspaceID,
1701-
ActionObjects: []*rpc.ActionObject{{Action: gptr.Of("listLoopEvaluator"), EntityType: gptr.Of(rpc.AuthEntityType_Space)}},
1702-
})
1703-
if err != nil {
1704-
return err
1705-
}
1706-
17071709
return errorx.NewByCode(errno.CommonInvalidParamCode, errorx.WithExtraMsg("workspace_id not in allowed evaluator template spaces"))
17081710
}

‎backend/modules/evaluation/application/evaluator_app_test.go‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2791,7 +2791,7 @@ func TestEvaluatorHandlerImpl_GetTemplateV2(t *testing.T) {
27912791
{
27922792
name: "success - normal request",
27932793
req: &evaluatorservice.GetTemplateV2Request{
2794-
EvaluatorTemplateID: templateID,
2794+
EvaluatorTemplateID: gptr.Of(templateID),
27952795
},
27962796
mockSetup: func() {
27972797
mockTemplateService.EXPECT().
@@ -2811,7 +2811,7 @@ func TestEvaluatorHandlerImpl_GetTemplateV2(t *testing.T) {
28112811
{
28122812
name: "success - template not found",
28132813
req: &evaluatorservice.GetTemplateV2Request{
2814-
EvaluatorTemplateID: templateID,
2814+
EvaluatorTemplateID: gptr.Of(templateID),
28152815
},
28162816
mockSetup: func() {
28172817
mockTemplateService.EXPECT().
@@ -2826,7 +2826,7 @@ func TestEvaluatorHandlerImpl_GetTemplateV2(t *testing.T) {
28262826
{
28272827
name: "error - service failure",
28282828
req: &evaluatorservice.GetTemplateV2Request{
2829-
EvaluatorTemplateID: templateID,
2829+
EvaluatorTemplateID: gptr.Of(templateID),
28302830
},
28312831
mockSetup: func() {
28322832
mockTemplateService.EXPECT().
@@ -3706,6 +3706,7 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37063706
name string
37073707
workspaceID int64
37083708
spaceType SpaceType
3709+
authWrite bool
37093710
mockSetup func()
37103711
wantErr bool
37113712
wantErrCode int32
@@ -3714,6 +3715,7 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37143715
name: "success - workspace in allowed list for builtin",
37153716
workspaceID: 123,
37163717
spaceType: spaceTypeBuiltin,
3718+
authWrite: false,
37173719
mockSetup: func() {
37183720
mockConfiger.EXPECT().
37193721
GetBuiltinEvaluatorSpaceConf(gomock.Any()).
@@ -3725,6 +3727,7 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37253727
name: "success - workspace in allowed list for template",
37263728
workspaceID: 456,
37273729
spaceType: spaceTypeTemplate,
3730+
authWrite: false,
37283731
mockSetup: func() {
37293732
mockConfiger.EXPECT().
37303733
GetEvaluatorTemplateSpaceConf(gomock.Any()).
@@ -3736,6 +3739,7 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37363739
name: "error - empty config for builtin",
37373740
workspaceID: 123,
37383741
spaceType: spaceTypeBuiltin,
3742+
authWrite: false,
37393743
mockSetup: func() {
37403744
mockConfiger.EXPECT().
37413745
GetBuiltinEvaluatorSpaceConf(gomock.Any()).
@@ -3748,6 +3752,7 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37483752
name: "error - empty config for template",
37493753
workspaceID: 123,
37503754
spaceType: spaceTypeTemplate,
3755+
authWrite: false,
37513756
mockSetup: func() {
37523757
mockConfiger.EXPECT().
37533758
GetEvaluatorTemplateSpaceConf(gomock.Any()).
@@ -3760,14 +3765,14 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37603765
name: "error - workspace not in allowed list",
37613766
workspaceID: 789,
37623767
spaceType: spaceTypeBuiltin,
3768+
authWrite: true,
37633769
mockSetup: func() {
3764-
mockConfiger.EXPECT().
3765-
GetBuiltinEvaluatorSpaceConf(gomock.Any()).
3766-
Return([]string{"123", "456"})
3767-
37683770
mockAuth.EXPECT().
37693771
Authorization(gomock.Any(), gomock.Any()).
37703772
Return(nil)
3773+
mockConfiger.EXPECT().
3774+
GetBuiltinEvaluatorSpaceConf(gomock.Any()).
3775+
Return([]string{"123", "456"})
37713776
},
37723777
wantErr: true,
37733778
wantErrCode: errno.CommonInvalidParamCode,
@@ -3776,11 +3781,8 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37763781
name: "error - auth failed",
37773782
workspaceID: 789,
37783783
spaceType: spaceTypeBuiltin,
3784+
authWrite: true,
37793785
mockSetup: func() {
3780-
mockConfiger.EXPECT().
3781-
GetBuiltinEvaluatorSpaceConf(gomock.Any()).
3782-
Return([]string{"123", "456"})
3783-
37843786
mockAuth.EXPECT().
37853787
Authorization(gomock.Any(), gomock.Any()).
37863788
Return(errorx.NewByCode(errno.CommonNoPermissionCode))
@@ -3794,7 +3796,7 @@ func TestEvaluatorHandlerImpl_authBuiltinManagement(t *testing.T) {
37943796
t.Run(tt.name, func(t *testing.T) {
37953797
tt.mockSetup()
37963798

3797-
err := app.authBuiltinManagement(context.Background(), tt.workspaceID, tt.spaceType)
3799+
err := app.authBuiltinManagement(context.Background(), tt.workspaceID, tt.spaceType, tt.authWrite)
37983800

37993801
if tt.wantErr {
38003802
assert.Error(t, err)

0 commit comments

Comments
 (0)