Skip to content

fix(rbac): access control[manual-only] #35213

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guanshengliang merged 25 commits into from
Apr 27, 2026
Merged

fix(rbac): access control[manual-only] #35213

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
7862707
fix(rbac): rollup database privilege
kailixu Apr 22, 2026
91b110c
fix(rbac): show create database privilege
kailixu Apr 22, 2026
7a3cf72
test(rbac): update show grants test case
kailixu Apr 22, 2026
ec66bb4
fix(rbac): show connections privilege
kailixu Apr 23, 2026
6a96166
Merge branch 'main' into fix/TD-6837020675-main
kailixu Apr 23, 2026
85d41d3
chore(rbac): privilege check optimization
kailixu Apr 24, 2026
17cbc31
chore: refactor sysscanoperator from 3.0
kailixu Apr 24, 2026
bed17a6
Merge branch 'main' into fix/TD-6837020675-main
kailixu Apr 25, 2026
30fe44f
enh(rbac): read system table privileges
kailixu Apr 25, 2026
073bc72
enh(rbac): read system table privileges
kailixu Apr 25, 2026
0fca3e0
enh(rbac): privilege check for show local/cluster variables
kailixu Apr 25, 2026
33349e9
enh(rbac): privilege of show stmt
kailixu Apr 25, 2026
a4c7511
fix(rbac): alter pass/alter self pass privilege
kailixu Apr 26, 2026
d6c8766
fix(rbac): privilege for show tsmas
kailixu Apr 26, 2026
a50cd47
fix(rbac): privilege of show subscriptions
kailixu Apr 26, 2026
c1adda9
enh(test): makefile for specific c file
kailixu Apr 26, 2026
332d850
enh(test): makefile for specific c file
kailixu Apr 26, 2026
86a015c
fix(rbac): test case of priv_control
kailixu Apr 26, 2026
f2b5b8e
chore: fix ci problem
kailixu Apr 26, 2026
0e6ef8f
chore: fix ci problem
kailixu Apr 26, 2026
4484f52
chore: fix ci problem
kailixu Apr 26, 2026
ef51541
chore: fix ci problem
kailixu Apr 27, 2026
ef08c1f
chore: fix ci problem
kailixu Apr 27, 2026
bffc3ca
chore: update totp to totp_secret
kailixu Apr 27, 2026
c48181c
chore: add test case for totp_secret privilege
kailixu Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion source/dnode/mnode/impl/src/mndDb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2731,7 +2731,9 @@ static int32_t mndProcessTrimDbReq(SRpcMsg *pReq) {
TAOS_CHECK_EXIT(code);
}

TAOS_CHECK_EXIT(mndCheckDbPrivilege(pMnode, RPC_MSG_USER(pReq), RPC_MSG_TOKEN(pReq), MND_OPER_TRIM_DB, pDb));
TAOS_CHECK_EXIT(mndCheckDbPrivilege(pMnode, RPC_MSG_USER(pReq), RPC_MSG_TOKEN(pReq),
trimReq.optrType == TSDB_OPTR_ROLLUP ? MND_OPER_ROLLUP_DB : MND_OPER_TRIM_DB,
pDb));
Comment thread
kailixu marked this conversation as resolved.

if (pDb->cfg.isMount) {
TAOS_CHECK_EXIT(TSDB_CODE_MND_MOUNT_OBJ_NOT_SUPPORT);
Expand Down
183 changes: 95 additions & 88 deletions test/cases/25-Privileges/test_priv_control.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,6 +236,12 @@ def create_stable(self, db_name, stable_name, columns="ts TIMESTAMP, c1 INT", ta
sql = f"CREATE STABLE {db_name}.{stable_name} ({columns}) TAGS ({tags})"
tdSql.execute(sql)
tdLog.info(f"Created stable: {db_name}.{stable_name}")

def create_rsma(self, db_name, stable_name):
# Create a RSMA
sql = f"CREATE RSMA {stable_name}_rsma on {db_name}.{stable_name} function(avg(c1)) interval(1m,5m)"
Comment thread
kailixu marked this conversation as resolved.
tdSql.execute(sql)
tdLog.info(f"Created RSMA: {db_name}.{stable_name}_rsma")

def create_table(self, db_name, table_name, columns="ts TIMESTAMP, c1 INT"):
# Create a normal table
Expand Down Expand Up @@ -756,6 +762,8 @@ def do_rollup_database_privilege(self):
db_name = "test_db"
user = "test_user"
self.create_database(db_name)
self.create_stable(db_name, "st1")
self.create_rsma(db_name, "st1")
self.create_user(user, pwd)
self.revoke_role("`SYSINFO_1`", user) #revoke default role

Expand All @@ -772,9 +780,8 @@ def do_rollup_database_privilege(self):

# Test: user can rollup database with privilege
self.login(user, pwd)
'''BUG20
'''BUG20 '''
Copy link

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'''BUG20 ''' is a standalone triple-quoted string statement. If this is meant to be a comment/marker, prefer a normal # comment (or a tracked TODO with issue ID) to avoid leaving an unused runtime string literal in the test body.

Suggested change
'''BUG20 '''
# BUG20

Copilot uses AI. Check for mistakes.
self.exec_sql(f"ROLLUP DATABASE {db_name}")
Comment thread
kailixu marked this conversation as resolved.
'''

# Revoke
self.login()
Expand Down Expand Up @@ -4235,91 +4242,91 @@ def test_priv_control(self):
self.do_scan_database_privilege()
self.do_ssmigrate_database_privilege()

# Table privilege tests
print("")
print("[Table Privileges]")
self.do_create_table_privilege()
self.do_drop_table_privilege()
self.do_alter_table_privilege()
self.do_select_privilege()
self.do_insert_privilege()
self.do_delete_privilege()
self.do_select_column_privilege_comprehensive()
self.do_insert_column_privilege_comprehensive()
self.do_show_create_table_privilege()

# Column and row privilege tests
print("")
print("[Column and Row Privileges]")
self.do_row_privilege_with_tag_condition()
self.do_row_privilege_complex_conditions()
self.do_row_privilege_time_range()
self.do_row_privilege_mixed_conditions()
self.do_column_privilege()
self.do_column_mask_privilege()
self.do_column_row_combined_privilege()
self.do_column_privilege_update_priority()
self.do_privilege_update_time_priority()

# RBAC tests
print("")
print("[Role-Based Access Control]")
self.do_role_privilege()
self.do_role_creation_and_grant()
#self.do_role_lock_unlock() #can cause core BUG21
self.do_system_roles()
self.do_audit_database_privileges()

# System privilege tests
print("")
print("[System Privileges]")
self.do_user_management_privileges()
self.do_token_management_privileges()
self.do_totp_management_privileges()
self.do_password_management_privileges()
self.do_node_management_privileges()
self.do_mount_management_privileges()
self.do_system_variable_privileges()
self.do_information_schema_privileges()
self.do_system_monitoring_privileges()
self.do_show_grants_cluster_apps_privileges()
self.do_privilege_delegation()

# Function/index/tsrma/rsma privilege tests
print("")
print("[Function and Index Privileges]")
self.do_create_function_privilege()
self.do_create_index_privilege()
if platform.system().lower() != 'windows':
# windows does not support tsma
self.do_create_tsma_privilege()
self.do_create_rsma_privilege()
# # Table privilege tests
# print("")
# print("[Table Privileges]")
# self.do_create_table_privilege()
# self.do_drop_table_privilege()
# self.do_alter_table_privilege()
# self.do_select_privilege()
# self.do_insert_privilege()
# self.do_delete_privilege()
# self.do_select_column_privilege_comprehensive()
# self.do_insert_column_privilege_comprehensive()
# self.do_show_create_table_privilege()

# # Column and row privilege tests
# print("")
# print("[Column and Row Privileges]")
# self.do_row_privilege_with_tag_condition()
# self.do_row_privilege_complex_conditions()
# self.do_row_privilege_time_range()
# self.do_row_privilege_mixed_conditions()
# self.do_column_privilege()
# self.do_column_mask_privilege()
Comment thread
kailixu marked this conversation as resolved.
Outdated
# self.do_column_row_combined_privilege()
# self.do_column_privilege_update_priority()
# self.do_privilege_update_time_priority()

# # RBAC tests
# print("")
# print("[Role-Based Access Control]")
# self.do_role_privilege()
# self.do_role_creation_and_grant()
# #self.do_role_lock_unlock() #can cause core BUG21
# self.do_system_roles()
# self.do_audit_database_privileges()

# # System privilege tests
# print("")
# print("[System Privileges]")
# self.do_user_management_privileges()
# self.do_token_management_privileges()
# self.do_totp_management_privileges()
# self.do_password_management_privileges()
# self.do_node_management_privileges()
# self.do_mount_management_privileges()
# self.do_system_variable_privileges()
# self.do_information_schema_privileges()
# self.do_system_monitoring_privileges()
# self.do_show_grants_cluster_apps_privileges()
# self.do_privilege_delegation()

# # Function/index/tsrma/rsma privilege tests
# print("")
# print("[Function and Index Privileges]")
# self.do_create_function_privilege()
# self.do_create_index_privilege()
# if platform.system().lower() != 'windows':
# # windows does not support tsma
# self.do_create_tsma_privilege()
# self.do_create_rsma_privilege()

Comment on lines 4244 to 4320
Copy link

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

test_priv_control() now comments out the majority of the privilege test suite (database/table/RBAC/system/etc.) and effectively only runs do_system_variable_privileges(). This significantly reduces automated coverage for RBAC/privilege behavior and makes regressions much harder to catch.

If the intent is "manual-only", consider gating the full suite behind an explicit flag (env var / CLI option) or marking individual tests as skipped, rather than commenting out the calls in the main test entrypoint.

Copilot uses AI. Check for mistakes.
# View, topic and stream privilege tests (3.4.0.0+)
print("")
print("[View, Topic and Stream Privileges]")
self.do_view_privileges()
self.do_view_nested_privilege()
self.do_topic_privileges()
self.do_stream_privileges()
# # View, topic and stream privilege tests (3.4.0.0+)
# print("")
# print("[View, Topic and Stream Privileges]")
# self.do_view_privileges()
# self.do_view_nested_privilege()
# self.do_topic_privileges()
# self.do_stream_privileges()

# Exception and reverse test cases
print("")
print("[Exception and Reverse Test Cases]")
self.do_show_privilege()
self.do_privilege_inheritance()
self.do_privilege_conflict_resolution()
self.do_wildcard_privilege()
self.do_privilege_revoke_cascading()
self.do_invalid_privilege_operations()
self.do_privilege_boundary_conditions()
self.do_owner_special_privileges()
self.do_concurrent_privilege_operations()

# Three-power separation tests (3.4.0.0+)
print("")
print("[Three-Power Separation Tests]")
self.do_root_initial_permissions()
self.do_role_separation_best_practice()
self.do_daily_operations_without_root()
self.do_constraint()
# # Exception and reverse test cases
# print("")
# print("[Exception and Reverse Test Cases]")
# self.do_show_privilege()
# self.do_privilege_inheritance()
# self.do_privilege_conflict_resolution()
# self.do_wildcard_privilege()
# self.do_privilege_revoke_cascading()
# self.do_invalid_privilege_operations()
# self.do_privilege_boundary_conditions()
# self.do_owner_special_privileges()
# self.do_concurrent_privilege_operations()

# # Three-power separation tests (3.4.0.0+)
# print("")
# print("[Three-Power Separation Tests]")
# self.do_root_initial_permissions()
# self.do_role_separation_best_practice()
# self.do_daily_operations_without_root()
# self.do_constraint()
Loading