Skip to content

Commit db9516f

Browse files
molotkov-andmolotkov-and
authored
Merge 320cb0b into b765769 
2 parents b765769 + 320cb0b commit db9516f

File tree

10 files changed

+33
-10
lines changed

10 files changed

+33
-10
lines changed

‎ydb/core/kqp/session_actor/kqp_query_state.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,7 @@ std::unique_ptr<NSchemeCache::TSchemeCacheNavigate> TKqpQueryState::BuildSchemeC
260260
}
261261

262262
bool TKqpQueryState::IsAccessDenied(const NSchemeCache::TSchemeCacheNavigate& response, TString& message) {
263-
auto rights = NACLib::EAccessRights::ReadAttributes | NACLib::EAccessRights::WriteAttributes;
263+
auto rights = NACLib::EAccessRights::AccessTopicOffset;
264264
// don't build message string on success path
265265
bool denied = std::any_of(response.ResultSet.begin(), response.ResultSet.end(), [&] (auto& result) {
266266
return result.SecurityObject && !result.SecurityObject->CheckAccess(rights, *UserToken);

‎ydb/core/testlib/test_pq_client.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -879,8 +879,9 @@ class TFlatMsgBusPQClient : public NFlatTests::TFlatMsgBusClient {
879879

880880
void GrantConsumerAccess(const TString& oldName, const TString& subj) {
881881
NACLib::TDiffACL acl;
882-
acl.AddAccess(NACLib::EAccessType::Allow, NACLib::ReadAttributes, subj);
883-
acl.AddAccess(NACLib::EAccessType::Allow, NACLib::WriteAttributes, subj);
882+
// acl.AddAccess(NACLib::EAccessType::Allow, NACLib::ReadAttributes, subj);
883+
// acl.AddAccess(NACLib::EAccessType::Allow, NACLib::WriteAttributes, subj);
884+
acl.AddAccess(NACLib::EAccessType::Allow, NACLib::AccessTopicOffset, subj);
884885
auto name = NPersQueue::ConvertOldConsumerName(oldName);
885886
auto pos = name.rfind("/");
886887
Y_ABORT_UNLESS(pos != TString::npos);

‎ydb/core/viewer/browse.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,9 @@ class TBrowse : public TActorBootstrapped<TBrowse> {
189189
if ((ar & NACLib::EAccessRights::AlterSchema) != 0) {
190190
pbAce.AddAccessRights("AlterSchema");
191191
}
192+
if ((ar & NACLib::EAccessRights::AccessTopicOffset) != 0) {
193+
pbAce.AddAccessRights("AccessTopicOffset");
194+
}
192195
pbAce.SetSubject(ace.GetSID());
193196
auto inht = ace.GetInheritanceType();
194197
if ((inht & NACLib::EInheritanceType::InheritObject) != 0) {
@@ -591,6 +594,9 @@ class TBrowseTabletsCommon : public TActorBootstrapped<TBrowseTabletsCommon> {
591594
if (ar == NACLib::EAccessRights::GenericFullLegacy) {
592595
pbAce.SetAccessRule("FullLegacy");
593596
}
597+
if ((ar & NACLib::EAccessRights::AccessTopicOffset) != 0) {
598+
pbAce.AddAccessRights("AccessTopicOffset");
599+
}
594600
pbAce.SetSubject(ace.GetSID());
595601
auto inht = ace.GetInheritanceType();
596602
if ((inht & NACLib::EInheritanceType::InheritObject) != 0) {

‎ydb/core/viewer/json_acl.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,8 @@ class TJsonACL : public TViewerPipeClient<TJsonACL> {
125125
{NACLib::EAccessRights::ReadStream, "ReadStream"},
126126
{NACLib::EAccessRights::WriteStream, "WriteStream"},
127127
{NACLib::EAccessRights::ReadTopic, "ReadTopic"},
128-
{NACLib::EAccessRights::WriteTopic, "WriteTopic"}
128+
{NACLib::EAccessRights::WriteTopic, "WriteTopic"},
129+
// {NACLib::EAccessRights::AccessTopicOffset, "AccessTopicOffset"}
129130
};
130131
auto ar = ace.GetAccessRight();
131132
int shift = 0;

‎ydb/core/ydb_convert/ydb_convert.cpp

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -799,6 +799,7 @@ const TString YDB_GRANULAR_CREATE_QUEUE = "ydb.granular.create_queue";
799799
const TString YDB_GRANULAR_REMOVE_SCHEMA = "ydb.granular.remove_schema";
800800
const TString YDB_GRANULAR_DESCRIBE_SCHEMA = "ydb.granular.describe_schema";
801801
const TString YDB_GRANULAR_ALTER_SCHEMA = "ydb.granular.alter_schema";
802+
const TString YDB_GRANULAR_ACCESS_TOPIC_OFFSET = "ydb.granular.access_topic_offset";
802803

803804
const TString& GetAclName(const TString& name) {
804805
static const THashMap<TString, TString> GranularNamesMap_ = {
@@ -845,7 +846,8 @@ const THashMap<TString, TACLAttrs> AccessMap_ = {
845846
{ YDB_GRANULAR_CREATE_QUEUE, EAccessRights::CreateQueue },
846847
{ YDB_GRANULAR_REMOVE_SCHEMA, EAccessRights::RemoveSchema },
847848
{ YDB_GRANULAR_DESCRIBE_SCHEMA, EAccessRights::DescribeSchema },
848-
{ YDB_GRANULAR_ALTER_SCHEMA, EAccessRights::AlterSchema }
849+
{ YDB_GRANULAR_ALTER_SCHEMA, EAccessRights::AlterSchema },
850+
{ YDB_GRANULAR_ACCESS_TOPIC_OFFSET, EAccessRights::AccessTopicOffset },
849851

850852
};
851853

‎ydb/core/ydb_convert/ydb_convert_ut.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1148,6 +1148,10 @@ Y_UNIT_TEST(SimpleConvertGood) {
11481148
aclAttr = ConvertYdbPermissionNameToACLAttrs("ydb.granular.alter_schema");
11491149
UNIT_ASSERT_EQUAL(aclAttr.AccessMask, EAccessRights::AlterSchema);
11501150
UNIT_ASSERT_EQUAL(aclAttr.InheritanceType, EInheritanceType::InheritObject | EInheritanceType::InheritContainer);
1151+
1152+
aclAttr = ConvertYdbPermissionNameToACLAttrs("ydb.granular.access_topic_offset");
1153+
UNIT_ASSERT_EQUAL(aclAttr.AccessMask, EAccessRights::AccessTopicOffset);
1154+
UNIT_ASSERT_EQUAL(aclAttr.InheritanceType, EInheritanceType::InheritObject | EInheritanceType::InheritContainer);
11511155
}
11521156

11531157
Y_UNIT_TEST(TestEqualGranularAndDeprecatedAcl) {

‎ydb/library/aclib/aclib.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -489,6 +489,8 @@ TString TACL::ToString(const NACLibProto::TACE& ace) {
489489
rights.emplace_back("WUA");
490490
if (ar & EAccessRights::ConnectDatabase)
491491
rights.emplace_back("ConnDB");
492+
if (ar & EAccessRights::AccessTopicOffset)
493+
rights.emplace_back("ATO");
492494
str << '(';
493495
for (auto jt = rights.begin(); jt != rights.end(); ++jt) {
494496
if (jt != rights.begin()) {
@@ -577,6 +579,8 @@ ui32 TACL::SpecialRightsFromString(const TString& string) {
577579
result |= EAccessRights::GrantAccessRights;
578580
if (r == "ConnDB")
579581
result |= EAccessRights::ConnectDatabase;
582+
if (r == "ATO")
583+
result |= EAccessRights::AccessTopicOffset;
580584
}
581585
return result;
582586
}
@@ -792,6 +796,8 @@ TString AccessRightsToString(ui32 accessRights) {
792796
rights.emplace_back("WriteUserAttributes");
793797
if (accessRights & EAccessRights::ConnectDatabase)
794798
rights.emplace_back("ConnectDatabase");
799+
if (accessRights & EAccessRights::AccessTopicOffset)
800+
rights.emplace_back("AccessTopicOffset");
795801
TString result;
796802
for (auto it = rights.begin(); it != rights.end(); ++it) {
797803
if (it != rights.begin()) {

‎ydb/library/aclib/aclib.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,10 @@ enum EAccessRights : ui32 { // bitmask
4040
WriteStream = 0x00020000, // writing streams
4141
ReadTopic = 0x00040000, // reading topics
4242
WriteTopic = 0x00080000, // writing topics
43+
AccessTopicOffset = 0x00100000, // use topic offset
4344

4445
GenericList = ReadAttributes | DescribeSchema,
45-
GenericRead = SelectRow | GenericList,
46+
GenericRead = SelectRow | AccessTopicOffset | GenericList,
4647
GenericWrite = UpdateRow | EraseRow | WriteAttributes | CreateDirectory | CreateTable | CreateQueue | RemoveSchema | AlterSchema | WriteUserAttributes,
4748
GenericUseLegacy = GenericRead | GenericWrite | GrantAccessRights,
4849
GenericUse = GenericUseLegacy | ConnectDatabase,

‎ydb/services/persqueue_v1/actors/read_init_auth_actor.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,8 @@ void TReadInitAndAuthActor::HandleClientSchemeCacheResponse(
238238
return;
239239
}
240240

241-
NACLib::EAccessRights rights = (NACLib::EAccessRights)(NACLib::EAccessRights::ReadAttributes + NACLib::EAccessRights::WriteAttributes);
241+
auto rights = NACLib::EAccessRights::AccessTopicOffset;
242+
// NACLib::EAccessRights rights = (NACLib::EAccessRights)(NACLib::EAccessRights::ReadAttributes + NACLib::EAccessRights::WriteAttributes);
242243
if (
243244
!CheckACLPermissionsForNavigate(entry.SecurityObject, path, rights, "No ReadAsConsumer permissions", ctx)
244245
) {

‎ydb/services/persqueue_v1/ut/topic_service_ut.cpp

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,9 @@ class TUpdateOffsetsInTransactionFixture : public NUnitTest::TBaseFixture {
156156

157157
NACLib::TDiffACL acl;
158158
acl.AddAccess(NACLib::EAccessType::Allow, NACLib::DescribeSchema, AUTH_TOKEN);
159-
acl.AddAccess(NACLib::EAccessType::Allow, NACLib::ReadAttributes, AUTH_TOKEN);
160-
acl.AddAccess(NACLib::EAccessType::Allow, NACLib::WriteAttributes, AUTH_TOKEN);
159+
// acl.AddAccess(NACLib::EAccessType::Allow, NACLib::ReadAttributes, AUTH_TOKEN);
160+
// acl.AddAccess(NACLib::EAccessType::Allow, NACLib::WriteAttributes, AUTH_TOKEN);
161+
acl.AddAccess(NACLib::EAccessType::Allow, NACLib::AccessTopicOffset, AUTH_TOKEN);
161162
server->AnnoyingClient->ModifyACL(TOPIC_PARENT, VALID_TOPIC_NAME, acl.SerializeAsString());
162163

163164
auto driverCfg = NYdb::TDriverConfig()
@@ -328,7 +329,7 @@ Y_UNIT_TEST_F(AccessRights, TUpdateOffsetsInTransactionFixture) {
328329
UNIT_ASSERT_VALUES_EQUAL(response.operation().status(), Ydb::StatusIds::SUCCESS);
329330

330331
NACLib::TDiffACL acl;
331-
acl.RemoveAccess(NACLib::EAccessType::Allow, NACLib::ReadAttributes, AUTH_TOKEN);
332+
acl.RemoveAccess(NACLib::EAccessType::Allow, NACLib::AccessTopicOffset, AUTH_TOKEN);
332333
server->AnnoyingClient->ModifyACL(TOPIC_PARENT, VALID_TOPIC_NAME, acl.SerializeAsString());
333334

334335
response = Call_UpdateOffsetsInTransaction({

0 commit comments

Comments
 (0)