-
Notifications
You must be signed in to change notification settings - Fork 505
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #9170 from fcfang123/issue-9116
feat:蓝盾权限-支持查询某单一资源的用户组人员名单 #9116
- Loading branch information
Showing
11 changed files
with
334 additions
and
76 deletions.
There are no files selected for viewing
62 changes: 62 additions & 0 deletions
62
...auth/src/main/kotlin/com/tencent/devops/auth/api/service/ServiceResourceMemberResource.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| package com.tencent.devops.auth.api.service | ||
|
|
||
| import com.tencent.devops.common.api.auth.AUTH_HEADER_DEVOPS_BK_TOKEN | ||
| import com.tencent.devops.common.api.pojo.Result | ||
| import com.tencent.devops.common.auth.api.pojo.BkAuthGroup | ||
| import com.tencent.devops.common.auth.api.pojo.BkAuthGroupAndUserList | ||
| import io.swagger.annotations.Api | ||
| import io.swagger.annotations.ApiOperation | ||
| import io.swagger.annotations.ApiParam | ||
| import javax.ws.rs.Consumes | ||
| import javax.ws.rs.GET | ||
| import javax.ws.rs.HeaderParam | ||
| import javax.ws.rs.Path | ||
| import javax.ws.rs.PathParam | ||
| import javax.ws.rs.Produces | ||
| import javax.ws.rs.QueryParam | ||
| import javax.ws.rs.core.MediaType | ||
|
|
||
| @Api(tags = ["AUTH_SERVICE_RESOURCE"], description = "权限--资源相关接口") | ||
| @Path("/open/service/auth/resource/member") | ||
| @Produces(MediaType.APPLICATION_JSON) | ||
| @Consumes(MediaType.APPLICATION_JSON) | ||
| interface ServiceResourceMemberResource { | ||
| @GET | ||
| @Path("/{projectCode}/getResourceGroupUsers") | ||
| @ApiOperation("获取特定资源下用户组成员") | ||
| fun getResourceGroupMembers( | ||
| @HeaderParam(AUTH_HEADER_DEVOPS_BK_TOKEN) | ||
| @ApiParam("认证token", required = true) | ||
| token: String, | ||
| @PathParam("projectCode") | ||
| @ApiParam("项目Code", required = true) | ||
| projectCode: String, | ||
| @QueryParam("resourceType") | ||
| @ApiParam("资源类型", required = false) | ||
| resourceType: String, | ||
| @QueryParam("resourceCode") | ||
| @ApiParam("资源code", required = false) | ||
| resourceCode: String, | ||
| @QueryParam("group") | ||
| @ApiParam("资源用户组类型", required = false) | ||
| group: BkAuthGroup? = null | ||
| ): Result<List<String>> | ||
|
|
||
| @GET | ||
| @Path("/{projectCode}/getResourceUsers") | ||
| @ApiOperation("拉取资源下所有成员，并按项目角色组分组成员信息返回") | ||
| fun getResourceGroupAndMembers( | ||
| @HeaderParam(AUTH_HEADER_DEVOPS_BK_TOKEN) | ||
| @ApiParam("认证token", required = true) | ||
| token: String, | ||
| @PathParam("projectCode") | ||
| @ApiParam("项目Code", required = true) | ||
| projectCode: String, | ||
| @QueryParam("resourceType") | ||
| @ApiParam("资源类型", required = false) | ||
| resourceType: String, | ||
| @QueryParam("resourceCode") | ||
| @ApiParam("资源code", required = false) | ||
| resourceCode: String | ||
| ): Result<List<BkAuthGroupAndUserList>> | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
135 changes: 135 additions & 0 deletions
135
...ac/src/main/kotlin/com/tencent/devops/auth/service/RbacPermissionResourceMemberService.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,135 @@ | ||
| package com.tencent.devops.auth.service | ||
|
|
||
| import com.tencent.bk.sdk.iam.constants.ManagerScopesEnum | ||
| import com.tencent.bk.sdk.iam.dto.V2PageInfoDTO | ||
| import com.tencent.bk.sdk.iam.dto.manager.V2ManagerRoleGroupInfo | ||
| import com.tencent.bk.sdk.iam.dto.manager.dto.SearchGroupDTO | ||
| import com.tencent.bk.sdk.iam.service.v2.V2ManagerService | ||
| import com.tencent.devops.auth.dao.AuthResourceGroupDao | ||
| import com.tencent.devops.auth.service.iam.PermissionResourceMemberService | ||
| import com.tencent.devops.common.auth.api.AuthResourceType | ||
| import com.tencent.devops.common.auth.api.pojo.BkAuthGroup | ||
| import com.tencent.devops.common.auth.api.pojo.BkAuthGroupAndUserList | ||
| import org.jooq.DSLContext | ||
| import org.slf4j.LoggerFactory | ||
|
|
||
| class RbacPermissionResourceMemberService constructor( | ||
| private val authResourceService: AuthResourceService, | ||
| private val iamV2ManagerService: V2ManagerService, | ||
| private val permissionGradeManagerService: PermissionGradeManagerService, | ||
| private val authResourceGroupDao: AuthResourceGroupDao, | ||
| private val dslContext: DSLContext | ||
| ) : PermissionResourceMemberService { | ||
| override fun getResourceGroupMembers( | ||
| projectCode: String, | ||
| resourceType: String, | ||
| resourceCode: String, | ||
| group: BkAuthGroup? | ||
| ): List<String> { | ||
| logger.info("[RBAC-IAM] get resource group members:$projectCode|$resourceType|$resourceCode|$group") | ||
| return when (group) { | ||
| // 新的rbac版本中，没有ci管理员组，不可以调用此接口来获取ci管理员组的成员 | ||
| BkAuthGroup.CIADMIN, BkAuthGroup.CI_MANAGER -> emptyList() | ||
| // 获取特定资源下全部成员 | ||
| null -> { | ||
| getResourceGroupAndMembers( | ||
| projectCode = projectCode, | ||
| resourceType = resourceType, | ||
| resourceCode = resourceCode | ||
| ).flatMap { it.userIdList }.distinct() | ||
| } | ||
| // 获取特定资源下特定用户组成员 | ||
| else -> { | ||
| val dbGroupInfo = authResourceGroupDao.get( | ||
| dslContext = dslContext, | ||
| projectCode = projectCode, | ||
| resourceType = resourceType, | ||
| resourceCode = resourceCode, | ||
| groupCode = group.value | ||
| ) ?: return emptyList() | ||
| val groupInfo = getResourceGroupAndMembers( | ||
| projectCode = projectCode, | ||
| resourceType = resourceType, | ||
| resourceCode = resourceCode | ||
| ).find { it.roleId == dbGroupInfo.relationId.toInt() } | ||
| groupInfo?.userIdList ?: emptyList() | ||
| } | ||
| } | ||
| } | ||
|
|
||
| override fun getResourceGroupAndMembers( | ||
| projectCode: String, | ||
| resourceType: String, | ||
| resourceCode: String | ||
| ): List<BkAuthGroupAndUserList> { | ||
| // 1、获取管理员id | ||
| val managerId = authResourceService.get( | ||
| projectCode = projectCode, | ||
| resourceType = resourceType, | ||
| resourceCode = resourceCode | ||
| ).relationId | ||
| // 2、获取分级管理员下所有的用户组 | ||
| val groupInfoList = getGroupInfoList( | ||
| resourceType = resourceType, | ||
| managerId = managerId | ||
| ) | ||
| logger.info( | ||
| "[RBAC-IAM] getResourceGroupAndMembers: projectCode = $projectCode |" + | ||
| " managerId = $managerId | groupInfoList: $groupInfoList" | ||
| ) | ||
| // 3、获取组成员 | ||
| return groupInfoList.map { getUsersUnderGroup(groupInfo = it) } | ||
| } | ||
|
|
||
| private fun getGroupInfoList( | ||
| resourceType: String, | ||
| managerId: String | ||
| ): List<V2ManagerRoleGroupInfo> { | ||
| return if (resourceType == AuthResourceType.PROJECT.value) { | ||
| val searchGroupDTO = SearchGroupDTO.builder().inherit(false).build() | ||
| permissionGradeManagerService.listGroup( | ||
| gradeManagerId = managerId, | ||
| searchGroupDTO = searchGroupDTO, | ||
| page = 1, | ||
| pageSize = 1000 | ||
| ) | ||
| } else { | ||
| val v2PageInfoDTO = V2PageInfoDTO().apply { | ||
| pageSize = 1000 | ||
| page = 1 | ||
| } | ||
| iamV2ManagerService.getSubsetManagerRoleGroup( | ||
| managerId.toInt(), | ||
| v2PageInfoDTO | ||
| ).results | ||
| } | ||
| } | ||
|
|
||
| private fun getUsersUnderGroup(groupInfo: V2ManagerRoleGroupInfo): BkAuthGroupAndUserList { | ||
| val pageInfoDTO = V2PageInfoDTO().apply { | ||
| pageSize = 1000 | ||
| page = 1 | ||
| } | ||
| val groupMemberInfoList = iamV2ManagerService.getRoleGroupMemberV2(groupInfo.id, pageInfoDTO).results | ||
| logger.info( | ||
| "[RBAC-IAM] getUsersUnderGroup ,groupId: ${groupInfo.id} | groupMemberInfoList: $groupMemberInfoList" | ||
| ) | ||
| val members = mutableListOf<String>() | ||
| groupMemberInfoList.forEach { memberInfo -> | ||
| if (memberInfo.type == ManagerScopesEnum.getType(ManagerScopesEnum.USER)) { | ||
| members.add(memberInfo.id) | ||
| } | ||
| } | ||
| return BkAuthGroupAndUserList( | ||
| displayName = groupInfo.name, | ||
| roleId = groupInfo.id, | ||
| roleName = groupInfo.name, | ||
| userIdList = members.toSet().toList(), | ||
| type = "" | ||
| ) | ||
| } | ||
|
|
||
| companion object { | ||
| private val logger = LoggerFactory.getLogger(RbacPermissionResourceMemberService::class.java) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.