Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add STARTS_WITH policy condition to allow for URN-wildcard-based policies #11441

Merged
merged 5 commits into from
Sep 20, 2024
Merged

Add STARTS_WITH policy condition to allow for URN-wildcard-based policies #11441

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3fd7fde
introduce STARTS_WITH condition to allow for wildcard-based policies
hrichert Sep 19, 2024
f21c863
revert .env changes
hrichert Sep 19, 2024
429d6ca
indicate starts_with for resource urns using *
hrichert Sep 20, 2024
e321983
Merge branch 'master' into feature/starts_with_policy_condition
hrichert Sep 20, 2024
f7d691c
ran checkstyle lint
hrichert Sep 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions datahub-graphql-core/src/main/resources/entity.graphql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9157,6 +9157,10 @@ enum PolicyMatchCondition {
Whether the field matches the value
"""
EQUALS
"""
Whether the field value starts with the value
"""
STARTS_WITH
}

"""
Expand Down
19 changes: 16 additions & 3 deletions datahub-web-react/src/app/permissions/policy/PolicyDetailsModal.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,14 @@ import { Link } from 'react-router-dom';
import { Button, Divider, Modal, Tag, Typography } from 'antd';
import styled from 'styled-components';
import { useEntityRegistry } from '../../useEntityRegistry';
import { Maybe, Policy, PolicyState, PolicyType } from '../../../types.generated';
import { Maybe, Policy, PolicyMatchCondition, PolicyState, PolicyType } from '../../../types.generated';
import { useAppConfig } from '../../useAppConfig';
import { convertLegacyResourceFilter, getFieldValues, mapResourceTypeToDisplayName } from './policyUtils';
import {
convertLegacyResourceFilter,
getFieldValues,
getFieldCondition,
mapResourceTypeToDisplayName,
} from './policyUtils';
import AvatarsGroup from '../AvatarsGroup';

type PrivilegeOptionType = {
Expand Down Expand Up @@ -70,6 +75,7 @@ export default function PolicyDetailsModal({ policy, open, onClose, privileges }
const resourceTypes = getFieldValues(resources?.filter, 'TYPE') || [];
const dataPlatformInstances = getFieldValues(resources?.filter, 'DATA_PLATFORM_INSTANCE') || [];
const resourceEntities = getFieldValues(resources?.filter, 'URN') || [];
const resourceFilterCondition = getFieldCondition(resources?.filter, 'URN') || PolicyMatchCondition.Equals;
const domains = getFieldValues(resources?.filter, 'DOMAIN') || [];

const {
Expand Down Expand Up @@ -104,6 +110,10 @@ export default function PolicyDetailsModal({ policy, open, onClose, privileges }
);
};

const getWildcardUrnTag = (criterionValue) => {
return <Typography.Text>{criterionValue.value}*</Typography.Text>;
};

const resourceOwnersField = (actors) => {
if (!actors?.resourceOwners) {
return <PoliciesTag>No</PoliciesTag>;
Expand Down Expand Up @@ -166,7 +176,10 @@ export default function PolicyDetailsModal({ policy, open, onClose, privileges }
return (
// eslint-disable-next-line react/no-array-index-key
<PoliciesTag key={`resource-${value.value}-${key}`}>
{getEntityTag(value)}
{resourceFilterCondition &&
resourceFilterCondition === PolicyMatchCondition.StartsWith
? getWildcardUrnTag(value)
: getEntityTag(value)}
</PoliciesTag>
);
})) || <PoliciesTag>All</PoliciesTag>}
Expand Down
4 changes: 4 additions & 0 deletions datahub-web-react/src/app/permissions/policy/policyUtils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,10 @@ export const getFieldValues = (filter: Maybe<PolicyMatchFilter> | undefined, res
return filter?.criteria?.find((criterion) => criterion.field === resourceFieldType)?.values || [];
};

export const getFieldCondition = (filter: Maybe<PolicyMatchFilter> | undefined, resourceFieldType: string) => {
return filter?.criteria?.find((criterion) => criterion.field === resourceFieldType)?.condition || null;
};

export const getFieldValuesOfTags = (filter: Maybe<PolicyMatchFilter> | undefined, resourceFieldType: string) => {
return filter?.criteria?.find((criterion) => criterion.field === resourceFieldType)?.values || [];
};
Expand Down
5 changes: 5 additions & 0 deletions metadata-models/src/main/pegasus/com/linkedin/policy/PolicyMatchCondition.pdl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,9 @@ enum PolicyMatchCondition {
* Whether the field matches the value
*/
EQUALS

/**
* Whether the field value starts with the value
*/
STARTS_WITH
}
12 changes: 8 additions & 4 deletions metadata-service/auth-impl/src/main/java/com/datahub/authorization/PolicyEngine.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,11 +252,15 @@ private boolean checkCriterion(

private boolean checkCondition(
Set<String> fieldValues, String filterValue, PolicyMatchCondition condition) {
if (condition == PolicyMatchCondition.EQUALS) {
return fieldValues.contains(filterValue);
switch (condition) {
case EQUALS:
return fieldValues.contains(filterValue);
case STARTS_WITH:
return fieldValues.stream().anyMatch(v -> v.startsWith(filterValue));
default:
log.error("Unsupported condition {}", condition);
return false;
}
log.error("Unsupported condition {}", condition);
return false;
}

/**
Expand Down
90 changes: 87 additions & 3 deletions metadata-service/auth-impl/src/test/java/com/datahub/authorization/PolicyEngineTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,7 @@
import com.linkedin.entity.client.EntityClient;
import com.linkedin.identity.RoleMembership;
import com.linkedin.metadata.Constants;
import com.linkedin.policy.DataHubActorFilter;
import com.linkedin.policy.DataHubPolicyInfo;
import com.linkedin.policy.DataHubResourceFilter;
import com.linkedin.policy.*;
import io.datahubproject.metadata.context.OperationContext;
import io.datahubproject.test.metadata.context.TestOperationContexts;
import java.net.URISyntaxException;
Expand Down Expand Up @@ -1043,6 +1041,92 @@ public void testEvaluatePolicyResourceFilterSpecificResourceNoMatch() throws Exc
verify(_entityClient, times(0)).batchGetV2(any(), any(), any(), any());
}

@Test
public void testEvaluatePolicyResourceFilterResourceUrnStartsWithMatch() throws Exception {
final DataHubPolicyInfo dataHubPolicyInfo = new DataHubPolicyInfo();
dataHubPolicyInfo.setType(METADATA_POLICY_TYPE);
dataHubPolicyInfo.setState(ACTIVE_POLICY_STATE);
dataHubPolicyInfo.setPrivileges(new StringArray("EDIT_ENTITY_TAGS"));
dataHubPolicyInfo.setDisplayName("My Test Display");
dataHubPolicyInfo.setDescription("My test display!");
dataHubPolicyInfo.setEditable(true);

final DataHubActorFilter actorFilter = new DataHubActorFilter();
actorFilter.setResourceOwners(true);
actorFilter.setAllUsers(true);
actorFilter.setAllGroups(true);
dataHubPolicyInfo.setActors(actorFilter);

final DataHubResourceFilter resourceFilter = new DataHubResourceFilter();
PolicyMatchCriterion policyMatchCriterion =
FilterUtils.newCriterion(
EntityFieldType.URN,
Collections.singletonList("urn:li:dataset:te"),
PolicyMatchCondition.STARTS_WITH);

resourceFilter.setFilter(
new PolicyMatchFilter()
.setCriteria(
new PolicyMatchCriterionArray(Collections.singleton(policyMatchCriterion))));
dataHubPolicyInfo.setResources(resourceFilter);

ResolvedEntitySpec resourceSpec = buildEntityResolvers("dataset", RESOURCE_URN);
PolicyEngine.PolicyEvaluationResult result =
_policyEngine.evaluatePolicy(
systemOperationContext,
dataHubPolicyInfo,
resolvedAuthorizedUserSpec,
"EDIT_ENTITY_TAGS",
Optional.of(resourceSpec));
assertTrue(result.isGranted());

// Verify no network calls
verify(_entityClient, times(0)).batchGetV2(any(), any(), any(), any());
}

@Test
public void testEvaluatePolicyResourceFilterResourceUrnStartsWithNoMatch() throws Exception {
final DataHubPolicyInfo dataHubPolicyInfo = new DataHubPolicyInfo();
dataHubPolicyInfo.setType(METADATA_POLICY_TYPE);
dataHubPolicyInfo.setState(ACTIVE_POLICY_STATE);
dataHubPolicyInfo.setPrivileges(new StringArray("EDIT_ENTITY_TAGS"));
dataHubPolicyInfo.setDisplayName("My Test Display");
dataHubPolicyInfo.setDescription("My test display!");
dataHubPolicyInfo.setEditable(true);

final DataHubActorFilter actorFilter = new DataHubActorFilter();
actorFilter.setResourceOwners(true);
actorFilter.setAllUsers(true);
actorFilter.setAllGroups(true);
dataHubPolicyInfo.setActors(actorFilter);

final DataHubResourceFilter resourceFilter = new DataHubResourceFilter();
PolicyMatchCriterion policyMatchCriterion =
FilterUtils.newCriterion(
EntityFieldType.URN,
Collections.singletonList("urn:li:dataset:other"),
PolicyMatchCondition.STARTS_WITH);

resourceFilter.setFilter(
new PolicyMatchFilter()
.setCriteria(
new PolicyMatchCriterionArray(Collections.singleton(policyMatchCriterion))));
dataHubPolicyInfo.setResources(resourceFilter);

ResolvedEntitySpec resourceSpec = buildEntityResolvers("dataset", RESOURCE_URN);
PolicyEngine.PolicyEvaluationResult result =
_policyEngine.evaluatePolicy(
systemOperationContext,
dataHubPolicyInfo,
resolvedAuthorizedUserSpec,
"EDIT_ENTITY_TAGS",
Optional.of(resourceSpec));
assertFalse(result.isGranted());

// Verify no network calls
verify(_entityClient, times(0)).batchGetV2(any(), any(), any(), any());
}

@Test
public void testEvaluatePolicyResourceFilterSpecificResourceMatchDomain() throws Exception {
final DataHubPolicyInfo dataHubPolicyInfo = new DataHubPolicyInfo();
Expand Down
5 changes: 3 additions & 2 deletions metadata-service/restli-api/src/main/snapshot/com.linkedin.entity.entities.snapshot.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5478,9 +5478,10 @@
"type" : "enum",
"name" : "PolicyMatchCondition",
"doc" : "The matching condition in a filter criterion",
"symbols" : [ "EQUALS" ],
"symbols" : [ "EQUALS", "STARTS_WITH" ],
"symbolDocs" : {
"EQUALS" : "Whether the field matches the value"
"EQUALS" : "Whether the field matches the value",
"STARTS_WITH" : "Whether the field value starts with the value"
}
},
"doc" : "The condition for the criterion",
Expand Down
5 changes: 3 additions & 2 deletions metadata-service/restli-api/src/main/snapshot/com.linkedin.platform.platform.snapshot.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5472,9 +5472,10 @@
"type" : "enum",
"name" : "PolicyMatchCondition",
"doc" : "The matching condition in a filter criterion",
"symbols" : [ "EQUALS" ],
"symbols" : [ "EQUALS", "STARTS_WITH" ],
"symbolDocs" : {
"EQUALS" : "Whether the field matches the value"
"EQUALS" : "Whether the field matches the value",
"STARTS_WITH" : "Whether the field value starts with the value"
}
},
"doc" : "The condition for the criterion",
Expand Down
Loading