From 5290f3e8e59b81e095bc2807fe688a087b560c48 Mon Sep 17 00:00:00 2001 From: shaoting-huang Date: Wed, 18 Dec 2024 16:38:45 +0800 Subject: [PATCH] rbac revoke check with meta Signed-off-by: shaoting-huang --- internal/rootcoord/root_coord.go | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/internal/rootcoord/root_coord.go b/internal/rootcoord/root_coord.go index de102201be154..f7ae2933f4fb0 100644 --- a/internal/rootcoord/root_coord.go +++ b/internal/rootcoord/root_coord.go @@ -31,6 +31,7 @@ import ( clientv3 "go.etcd.io/etcd/client/v3" "go.uber.org/atomic" "go.uber.org/zap" + "google.golang.org/protobuf/proto" "github.com/milvus-io/milvus-proto/go-api/v2/commonpb" "github.com/milvus-io/milvus-proto/go-api/v2/milvuspb" @@ -2741,6 +2742,25 @@ func (c *Core) OperatePrivilege(ctx context.Context, in *milvuspb.OperatePrivile if err != nil { return nil, err } + // if there is same grant in the other privilege groups, the grant should not be removed from the cache + if in.Type == milvuspb.OperatePrivilegeType_Revoke { + metaGrants, err := c.meta.SelectGrant(util.DefaultTenant, &milvuspb.GrantEntity{ + Role: in.Entity.Role, + DbName: in.Entity.DbName, + }) + if err != nil { + return nil, err + } + metaExpandGrants, err := c.expandPrivilegeGroups(metaGrants, groups) + if err != nil { + return nil, err + } + expandGrants = lo.Filter(expandGrants, func(g1 *milvuspb.GrantEntity, _ int) bool { + return !lo.ContainsBy(metaExpandGrants, func(g2 *milvuspb.GrantEntity) bool { + return proto.Equal(g1, g2) + }) + }) + } if err := c.proxyClientManager.RefreshPolicyInfoCache(ctx, &proxypb.RefreshPolicyInfoCacheRequest{ OpType: opType, OpKey: funcutil.PolicyForPrivileges(expandGrants),