feat: user authz (#3941)

* feat: change user table to match mysql

* feat: support user authz

* fix: cean up created users

hybridse/include/node/node_enum.h

@@ -98,6 +98,8 @@ enum SqlNodeType {
  kColumnSchema,
  kCreateUserStmt,
  kAlterUserStmt,
+ kGrantStmt,
+ kRevokeStmt,
  kCallStmt,
  kSqlNodeTypeLast, // debug type
  kVariadicUdfDef,
@@ -347,6 +349,8 @@ enum PlanType {
  kPlanTypeShow,
  kPlanTypeCreateUser,
  kPlanTypeAlterUser,
+ kPlanTypeGrant,
+ kPlanTypeRevoke,
  kPlanTypeCallStmt,
  kUnknowPlan = -1,
 };

hybridse/include/node/plan_node.h

@@ -739,6 +739,67 @@ class CreateUserPlanNode : public LeafPlanNode {
  const std::shared_ptr<OptionsMap> options_;
 };
 
+class GrantPlanNode : public LeafPlanNode {
+ public:
+ explicit GrantPlanNode(std::optional<std::string> target_type, std::string database, std::string target,
+ std::vector<std::string> privileges, bool is_all_privileges,
+ std::vector<std::string> grantees, bool with_grant_option)
+ : LeafPlanNode(kPlanTypeGrant),
+ target_type_(target_type),
+ database_(database),
+ target_(target),
+ privileges_(privileges),
+ is_all_privileges_(is_all_privileges),
+ grantees_(grantees),
+ with_grant_option_(with_grant_option) {}
+ ~GrantPlanNode() = default;
+ const std::vector<std::string> Privileges() const { return privileges_; }
+ const std::vector<std::string> Grantees() const { return grantees_; }
+ const std::string Database() const { return database_; }
+ const std::string Target() const { return target_; }
+ const std::optional<std::string> TargetType() const { return target_type_; }
+ const bool IsAllPrivileges() const { return is_all_privileges_; }
+ const bool WithGrantOption() const { return with_grant_option_; }
+
+ private:
+ std::optional<std::string> target_type_;
+ std::string database_;
+ std::string target_;
+ std::vector<std::string> privileges_;
+ bool is_all_privileges_;
+ std::vector<std::string> grantees_;
+ bool with_grant_option_;
+};
+
+class RevokePlanNode : public LeafPlanNode {
+ public:
+ explicit RevokePlanNode(std::optional<std::string> target_type, std::string database, std::string target,
+ std::vector<std::string> privileges, bool is_all_privileges,
+ std::vector<std::string> grantees)
+ : LeafPlanNode(kPlanTypeRevoke),
+ target_type_(target_type),
+ database_(database),
+ target_(target),
+ privileges_(privileges),
+ is_all_privileges_(is_all_privileges),
+ grantees_(grantees) {}
+ ~RevokePlanNode() = default;
+ const std::vector<std::string> Privileges() const { return privileges_; }
+ const std::vector<std::string> Grantees() const { return grantees_; }
+ const std::string Database() const { return database_; }
+ const std::string Target() const { return target_; }
+ const std::optional<std::string> TargetType() const { return target_type_; }
+ const bool IsAllPrivileges() const { return is_all_privileges_; }
+
+ private:
+ std::optional<std::string> target_type_;
+ std::string database_;
+ std::string target_;
+ std::vector<std::string> privileges_;
+ bool is_all_privileges_;
+ std::vector<std::string> grantees_;
+};
+
 class AlterUserPlanNode : public LeafPlanNode {
  public:
  explicit AlterUserPlanNode(const std::string& name, bool if_exists, std::shared_ptr<OptionsMap> options)

hybridse/include/node/sql_node.h

@@ -2421,6 +2421,64 @@ class AlterUserNode : public SqlNode {
  const std::shared_ptr<OptionsMap> options_;
 };
 
+class GrantNode : public SqlNode {
+ public:
+ explicit GrantNode(std::optional<std::string> target_type, std::string database, std::string target,
+ std::vector<std::string> privileges, bool is_all_privileges, std::vector<std::string> grantees,
+ bool with_grant_option)
+ : SqlNode(kGrantStmt, 0, 0),
+ target_type_(target_type),
+ database_(database),
+ target_(target),
+ privileges_(privileges),
+ is_all_privileges_(is_all_privileges),
+ grantees_(grantees),
+ with_grant_option_(with_grant_option) {}
+ const std::vector<std::string> Privileges() const { return privileges_; }
+ const std::vector<std::string> Grantees() const { return grantees_; }
+ const std::string Database() const { return database_; }
+ const std::string Target() const { return target_; }
+ const std::optional<std::string> TargetType() const { return target_type_; }
+ const bool IsAllPrivileges() const { return is_all_privileges_; }
+ const bool WithGrantOption() const { return with_grant_option_; }
+
+ private:
+ std::optional<std::string> target_type_;
+ std::string database_;
+ std::string target_;
+ std::vector<std::string> privileges_;
+ bool is_all_privileges_;
+ std::vector<std::string> grantees_;
+ bool with_grant_option_;
+};
+
+class RevokeNode : public SqlNode {
+ public:
+ explicit RevokeNode(std::optional<std::string> target_type, std::string database, std::string target,
+ std::vector<std::string> privileges, bool is_all_privileges, std::vector<std::string> grantees)
+ : SqlNode(kRevokeStmt, 0, 0),
+ target_type_(target_type),
+ database_(database),
+ target_(target),
+ privileges_(privileges),
+ is_all_privileges_(is_all_privileges),
+ grantees_(grantees) {}
+ const std::vector<std::string> Privileges() const { return privileges_; }
+ const std::vector<std::string> Grantees() const { return grantees_; }
+ const std::string Database() const { return database_; }
+ const std::string Target() const { return target_; }
+ const std::optional<std::string> TargetType() const { return target_type_; }
+ const bool IsAllPrivileges() const { return is_all_privileges_; }
+
+ private:
+ std::optional<std::string> target_type_;
+ std::string database_;
+ std::string target_;
+ std::vector<std::string> privileges_;
+ bool is_all_privileges_;
+ std::vector<std::string> grantees_;
+};
+
 class ExplainNode : public SqlNode {
  public:
  explicit ExplainNode(const QueryNode *query, node::ExplainType explain_type)

hybridse/src/plan/planner.cc

@@ -768,6 +768,22 @@ base::Status SimplePlanner::CreatePlanTree(const NodePointVector &parser_trees,
  plan_trees.push_back(create_user_plan_node);
  break;
  }
+ case ::hybridse::node::kGrantStmt: {
+ auto node = dynamic_cast<node::GrantNode *>(parser_tree);
+ auto grant_plan_node = node_manager_->MakeNode<node::GrantPlanNode>(
+ node->TargetType(), node->Database(), node->Target(), node->Privileges(), node->IsAllPrivileges(),
+ node->Grantees(), node->WithGrantOption());
+ plan_trees.push_back(grant_plan_node);
+ break;
+ }
+ case ::hybridse::node::kRevokeStmt: {
+ auto node = dynamic_cast<node::RevokeNode *>(parser_tree);
+ auto revoke_plan_node = node_manager_->MakeNode<node::RevokePlanNode>(
+ node->TargetType(), node->Database(), node->Target(), node->Privileges(), node->IsAllPrivileges(),
+ node->Grantees());
+ plan_trees.push_back(revoke_plan_node);
+ break;
+ }
  case ::hybridse::node::kAlterUserStmt: {
  auto node = dynamic_cast<node::AlterUserNode *>(parser_tree);
  auto alter_user_plan_node = node_manager_->MakeNode<node::AlterUserPlanNode>(node->Name(),

hybridse/src/planv2/ast_node_converter.cc

@@ -24,6 +24,7 @@
 #include "absl/strings/ascii.h"
 #include "absl/strings/match.h"
 #include "absl/types/span.h"
+#include "ast_node_converter.h"
 #include "base/fe_status.h"
 #include "node/sql_node.h"
 #include "udf/udf.h"
@@ -725,6 +726,20 @@ base::Status ConvertStatement(const zetasql::ASTStatement* statement, node::Node
  *output = create_user_node;
  break;
  }
+ case zetasql::AST_GRANT_STATEMENT: {
+ const zetasql::ASTGrantStatement* grant_stmt = statement->GetAsOrNull<zetasql::ASTGrantStatement>();
+ node::GrantNode* grant_node = nullptr;
+ CHECK_STATUS(ConvertGrantStatement(grant_stmt, node_manager, &grant_node))
+ *output = grant_node;
+ break;
+ }
+ case zetasql::AST_REVOKE_STATEMENT: {
+ const zetasql::ASTRevokeStatement* revoke_stmt = statement->GetAsOrNull<zetasql::ASTRevokeStatement>();
+ node::RevokeNode* revoke_node = nullptr;
+ CHECK_STATUS(ConvertRevokeStatement(revoke_stmt, node_manager, &revoke_node))
+ *output = revoke_node;
+ break;
+ }
  case zetasql::AST_ALTER_USER_STATEMENT: {
  const zetasql::ASTAlterUserStatement* alter_user_stmt =
  statement->GetAsOrNull<zetasql::ASTAlterUserStatement>();
@@ -2133,6 +2148,81 @@ base::Status ConvertAlterUserStatement(const zetasql::ASTAlterUserStatement* roo
  return base::Status::OK();
 }
 
+base::Status ConvertGrantStatement(const zetasql::ASTGrantStatement* root, node::NodeManager* node_manager,
+ node::GrantNode** output) {
+ CHECK_TRUE(root != nullptr, common::kSqlAstError, "not an ASTGrantStatement");
+ std::vector<std::string> target_path;
+ CHECK_STATUS(AstPathExpressionToStringList(root->target_path(), target_path));
+ std::optional<std::string> target_type = std::nullopt;
+ if (root->target_type() != nullptr) {
+ target_type = root->target_type()->GetAsString();
+ }
+
+ std::vector<std::string> privileges;
+ std::vector<std::string> grantees;
+ for (auto privilege : root->privileges()->privileges()) {
+ if (privilege == nullptr) {
+ continue;
+ }
+
+ auto privilege_action = privilege->privilege_action();
+ if (privilege_action != nullptr) {
+ privileges.push_back(privilege_action->GetAsString());
+ }
+ }
+
+ for (auto grantee : root->grantee_list()->grantee_list()) {
+ if (grantee == nullptr) {
+ continue;
+ }
+
+ std::string grantee_str;
+ CHECK_STATUS(AstStringLiteralToString(grantee, &grantee_str));
+ grantees.push_back(grantee_str);
+ }
+ *output = node_manager->MakeNode<node::GrantNode>(target_type, target_path.at(0), target_path.at(1), privileges,
+ root->privileges()->is_all_privileges(), grantees,
+ root->with_grant_option());
+ return base::Status::OK();
+}
+
+base::Status ConvertRevokeStatement(const zetasql::ASTRevokeStatement* root, node::NodeManager* node_manager,
+ node::RevokeNode** output) {
+ CHECK_TRUE(root != nullptr, common::kSqlAstError, "not an ASTRevokeStatement");
+ std::vector<std::string> target_path;
+ CHECK_STATUS(AstPathExpressionToStringList(root->target_path(), target_path));
+ std::optional<std::string> target_type = std::nullopt;
+ if (root->target_type() != nullptr) {
+ target_type = root->target_type()->GetAsString();
+ }
+
+ std::vector<std::string> privileges;
+ std::vector<std::string> grantees;
+ for (auto privilege : root->privileges()->privileges()) {
+ if (privilege == nullptr) {
+ continue;
+ }
+
+ auto privilege_action = privilege->privilege_action();
+ if (privilege_action != nullptr) {
+ privileges.push_back(privilege_action->GetAsString());
+ }
+ }
+
+ for (auto grantee : root->grantee_list()->grantee_list()) {
+ if (grantee == nullptr) {
+ continue;
+ }
+
+ std::string grantee_str;
+ CHECK_STATUS(AstStringLiteralToString(grantee, &grantee_str));
+ grantees.push_back(grantee_str);
+ }
+ *output = node_manager->MakeNode<node::RevokeNode>(target_type, target_path.at(0), target_path.at(1), privileges,
+ root->privileges()->is_all_privileges(), grantees);
+ return base::Status::OK();
+}
+
 base::Status ConvertCreateIndexStatement(const zetasql::ASTCreateIndexStatement* root, node::NodeManager* node_manager,
  node::CreateIndexNode** output) {
  CHECK_TRUE(nullptr != root, common::kSqlAstError, "not an ASTCreateIndexStatement")

hybridse/src/planv2/ast_node_converter.h

@@ -72,6 +72,12 @@ base::Status ConvertCreateUserStatement(const zetasql::ASTCreateUserStatement* r
 base::Status ConvertAlterUserStatement(const zetasql::ASTAlterUserStatement* root, node::NodeManager* node_manager,
  node::AlterUserNode** output);
 
+base::Status ConvertGrantStatement(const zetasql::ASTGrantStatement* root, node::NodeManager* node_manager,
+ node::GrantNode** output);
+
+base::Status ConvertRevokeStatement(const zetasql::ASTRevokeStatement* root, node::NodeManager* node_manager,
+ node::RevokeNode** output);
+
 base::Status ConvertQueryNode(const zetasql::ASTQuery* root, node::NodeManager* node_manager, node::QueryNode** output);
 
 base::Status ConvertQueryExpr(const zetasql::ASTQueryExpression* query_expr, node::NodeManager* node_manager,

src/auth/user_access_manager.cc

@@ -47,7 +47,7 @@ void UserAccessManager::StopSyncTask() {
 
 void UserAccessManager::SyncWithDB() {
  if (auto it_pair = user_table_iterator_factory_(::openmldb::nameserver::USER_INFO_NAME); it_pair) {
- auto new_user_map = std::make_unique<std::unordered_map<std::string, std::string>>();
+ auto new_user_map = std::make_unique<std::unordered_map<std::string, UserRecord>>();
  auto it = it_pair->first.get();
  it->SeekToFirst();
  while (it->Valid()) {
@@ -56,26 +56,55 @@ void UserAccessManager::SyncWithDB() {
  auto size = it->GetValue().size();
  codec::RowView row_view(*it_pair->second.get(), buf, size);
  std::string host, user, password;
+ std::string privilege_level_str;
  row_view.GetStrValue(0, &host);
  row_view.GetStrValue(1, &user);
  row_view.GetStrValue(2, &password);
+ row_view.GetStrValue(5, &privilege_level_str);
+ openmldb::nameserver::PrivilegeLevel privilege_level;
+ ::openmldb::nameserver::PrivilegeLevel_Parse(privilege_level_str, &privilege_level);
+ UserRecord user_record = {password, privilege_level};
  if (host == "%") {
- new_user_map->emplace(user, password);
+ new_user_map->emplace(user, user_record);
  } else {
- new_user_map->emplace(FormUserHost(user, host), password);
+ new_user_map->emplace(FormUserHost(user, host), user_record);
  }
  it->Next();
  }
  user_map_.Refresh(std::move(new_user_map));
  }
 }
 
+std::optional<std::string> UserAccessManager::GetUserPassword(const std::string& host, const std::string& user) {
+ if (auto user_record = user_map_.Get(FormUserHost(user, host)); user_record.has_value()) {
+ return user_record.value().password;
+ } else if (auto stored_password = user_map_.Get(user); stored_password.has_value()) {
+ return stored_password.value().password;
+ } else {
+ return std::nullopt;
+ }
+}
+
 bool UserAccessManager::IsAuthenticated(const std::string& host, const std::string& user, const std::string& password) {
- if (auto stored_password = user_map_.Get(FormUserHost(user, host)); stored_password.has_value()) {
- return stored_password.value() == password;
+ if (auto user_record = user_map_.Get(FormUserHost(user, host)); user_record.has_value()) {
+ return user_record.value().password == password;
  } else if (auto stored_password = user_map_.Get(user); stored_password.has_value()) {
- return stored_password.value() == password;
+ return stored_password.value().password == password;
  }
  return false;
 }
+
+::openmldb::nameserver::PrivilegeLevel UserAccessManager::GetPrivilegeLevel(const std::string& user_at_host) {
+ std::size_t at_pos = user_at_host.find('@');
+ if (at_pos != std::string::npos) {
+ std::string user = user_at_host.substr(0, at_pos);
+ std::string host = user_at_host.substr(at_pos + 1);
+ if (auto user_record = user_map_.Get(FormUserHost(user, host)); user_record.has_value()) {
+ return user_record.value().privilege_level;
+ } else if (auto stored_password = user_map_.Get(user); stored_password.has_value()) {
+ return stored_password.value().privilege_level;
+ }
+ }
+ return ::openmldb::nameserver::PrivilegeLevel::NO_PRIVILEGE;
+}
 } // namespace openmldb::auth

src/auth/user_access_manager.h

@@ -26,9 +26,15 @@
 #include <utility>
 
 #include "catalog/distribute_iterator.h"
+#include "proto/name_server.pb.h"
 #include "refreshable_map.h"
 
 namespace openmldb::auth {
+struct UserRecord {
+ std::string password;
+ ::openmldb::nameserver::PrivilegeLevel privilege_level;
+};
+
 class UserAccessManager {
  public:
  using IteratorFactory = std::function<std::optional<
@@ -39,11 +45,13 @@ class UserAccessManager {
 
  ~UserAccessManager();
  bool IsAuthenticated(const std::string& host, const std::string& username, const std::string& password);
+ ::openmldb::nameserver::PrivilegeLevel GetPrivilegeLevel(const std::string& user_at_host);
  void SyncWithDB();
+ std::optional<std::string> GetUserPassword(const std::string& host, const std::string& user);
 
  private:
  IteratorFactory user_table_iterator_factory_;
- RefreshableMap<std::string, std::string> user_map_;
+ RefreshableMap<std::string, UserRecord> user_map_;
  std::thread sync_task_thread_;
  std::promise<void> stop_promise_;
  void StartSyncTask();