Set read/write access to resource for each role

front-end/src/store/modules/user.js

@@ -20,6 +20,22 @@ import { Message } from 'element-ui'
 import { setTenant, removeTenant } from '../../utils/tenant'
 import { getUserInfo } from '@/api/users'
 
+export function hasPermissionToResource(resourceType, resourceName, permission) {
+  if (isSuperAdmin(user)) { // Super admin will have access to everything
+    return true
+  }
+  if (user.state.access.hasOwnProperty(resourceType)) {
+    if (user.state.access[resourceType].hasOwnProperty(resourceName)) {
+      return user.state.access[resourceType][resourceName] === permission
+    }
+  }
+  return false
+}
+
+export function isSuperAdmin(user) {
+  return user.state.roles.indexOf('super') != -1
+}
+
 const user = {
   state: {
     user: '',
@@ -32,6 +48,9 @@ const user = {
     roles: [],
     setting: {
       articlePlatform: []
+    },
+    access: {
+
     }
   },
 
@@ -59,7 +78,11 @@ const user = {
     },
     SET_ROLES: (state, roles) => {
       state.roles = roles
+    },
+    SET_ACCESS: (state, access) => {
+      state.access = access
     }
+
   },
 
   actions: {
@@ -93,6 +116,7 @@ const user = {
           commit('SET_ROLES', response.data.roles)
           commit('SET_NAME', 'admin')
           commit('SET_INTRODUCTION', 'Pulsar Manager')
+          commit('SET_ACCESS', response.data.access)
           resolve(response)
         })
       })
@@ -104,6 +128,7 @@ const user = {
         logout(state.token).then(() => {
           commit('SET_TOKEN', '')
           commit('SET_ROLES', [])
+          commit('SET_ACCESS', {})
           removeToken()
           removeCsrfToken()
           removeName()

front-end/src/views/management/admin/tenants/tenant.vue

@@ -33,7 +33,7 @@
             style="width: 200px;"
             @keyup.enter.native="handleFilterNamespace"/>
           <el-button type="primary" icon="el-icon-search" @click="handleFilterNamespace"/>
-          <el-button type="primary" icon="el-icon-plus" @click="handleCreateNamespace">{{ $t('namespace.newNamespace') }}</el-button>
+          <el-button v-if="hasAccess(postForm.tenant,'write')" type="primary" icon="el-icon-plus" @click="handleCreateNamespace">{{ $t('namespace.newNamespace') }}</el-button>
         </div>
         <el-row :gutter="24">
           <el-col :xs="{span: 24}" :sm="{span: 24}" :md="{span: 24}" :lg="{span: 24}" :xl="{span: 24}">
@@ -59,7 +59,7 @@
                   </router-link>
                 </template>
               </el-table-column>
-              <el-table-column :label="$t('table.actions')" align="center" class-name="small-padding fixed-width">
+              <el-table-column v-if="hasAccess(postForm.tenant,'write')" :label="$t('table.actions')" align="center" class-name="small-padding fixed-width">
                 <template slot-scope="scope">
                   <router-link :to="'/management/namespaces/' + scope.row.tenant +'/' + scope.row.namespace + '/namespace'">
                     <el-button type="primary" size="mini">{{ $t('table.edit') }}</el-button>
@@ -101,6 +101,7 @@ import {
   deleteNamespace
 } from '@/api/namespaces'
 import { validateEmpty } from '@/utils/validate'
+import { hasPermissionToResource } from '../../../../store/modules/user'
 
 const defaultForm = {
   tenant: getTenant()
@@ -243,6 +244,9 @@ export default {
         this.listNamespaces = []
         this.getNamespacesList()
       })
+    },
+    hasAccess(tenant, permission) {
+      return hasPermissionToResource('TENANTS', tenant, permission)
     }
   }
 }

front-end/src/views/management/namespaces/namespace.vue

@@ -1,3 +1,4 @@
+<!--
 <!--
 
     Licensed under the Apache License, Version 2.0 (the "License");
@@ -61,8 +62,8 @@
         <el-tabs v-model="activeBundleCluster" type="border-card" @tab-click="handleBundleTabClick">
           <el-tab-pane v-for="(item,index) in replicationClustersValue" :key="item+index" :label="item" :name="item">
             <div class="filter-container">
-              <el-button class="filter-item" style="margin-left: 10px;" type="danger" icon="el-icon-download" @click="handleUnloadAll">Unload All</el-button>
-              <el-button class="filter-item" style="margin-left: 10px;" type="danger" icon="el-icon-close" @click="hanldeClearAllBacklog">Clear All Backlog</el-button>
+              <el-button v-if="hasAccess(postForm.namespace,'write')" class="filter-item" style="margin-left: 10px;" type="danger" icon="el-icon-download" @click="handleUnloadAll">Unload All</el-button>
+              <el-button v-if="hasAccess(postForm.namespace,'write')" class="filter-item" style="margin-left: 10px;" type="danger" icon="el-icon-close" @click="hanldeClearAllBacklog">Clear All Backlog</el-button>
             </div>
             <el-table
               :key="tableKey"
@@ -76,7 +77,7 @@
                   <span>{{ scope.row.bundle }}</span>
                 </template>
               </el-table-column>
-              <el-table-column :label="$t('namespace.bundle.operation')" align="center" class-name="small-padding fixed-width">
+              <el-table-column v-if="hasAccess(postForm.namespace,'write')" :label="$t('namespace.bundle.operation')" align="center" class-name="small-padding fixed-width">
                 <template slot-scope="scope">
                   <el-button size="medium" style="margin-left: 10px;" type="danger" icon="el-icon-share" @click="handleSplitBundle(scope.row)">{{ $t('namespace.bundle.split') }}</el-button>
                   <el-button size="medium" style="margin-left: 10px;" type="danger" icon="el-icon-download" @click="handleUnloadBundle(scope.row)">{{ $t('namespace.bundle.unload') }}</el-button>
@@ -92,7 +93,7 @@
       <el-tab-pane :label="$t('tabs.topic')" name="topics">
         <el-input v-model="searchTopic" :placeholder="$t('namespace.searchTopics')" style="width: 200px;" @keyup.enter.native="handleFilterTopic"/>
         <el-button type="primary" icon="el-icon-search" @click="handleFilterTopic"/>
-        <el-button type="primary" icon="el-icon-plus" @click="handleCreateTopic">{{ $t('namespace.newTopic') }}</el-button>
+        <el-button v-if="hasAccess(postForm.namespace,'write')" type="primary" icon="el-icon-plus" @click="handleCreateTopic" >{{ $t('namespace.newTopic') }}</el-button>
         <el-row :gutter="24">
           <el-col :xs="{span: 24}" :sm="{span: 24}" :md="{span: 24}" :lg="{span: 24}" :xl="{span: 24}" style="margin-top:15px">
             <el-table
@@ -159,7 +160,7 @@
           </el-col>
         </el-row>
       </el-tab-pane>
-      <el-tab-pane :label="$t('tabs.policies')" name="policies">
+      <el-tab-pane v-if="hasAccess(postForm.namespace,'write')" :label="$t('tabs.policies')" name="policies" >
         <h4>{{ $t('namespace.policy.cluster') }}</h4>
         <hr class="split-line">
         <div class="component-item">
@@ -208,7 +209,7 @@
                 :value="item.value"
                 style="width:300px"/>
             </el-select>
-            <el-button @click.prevent="handleClose(tag)">{{ $t('namespace.policy.deleteRole') }}</el-button>
+            <el-button v-if="hasAccess(postForm.namespace,'write')" @click.prevent="handleClose(tag)">{{ $t('namespace.policy.deleteRole') }}</el-button>
           </el-tag>
           <el-form-item style="margin-top:30px">
             <el-input
@@ -756,6 +757,7 @@ import MdInput from '@/components/MDinput'
 import { validateEmpty } from '@/utils/validate'
 import { formatBytes } from '@/utils/index'
 import { numberFormatter } from '@/filters/index'
+import { hasPermissionToResource } from '../../../store/modules/user'
 
 const defaultForm = {
   tenant: '',
@@ -1663,6 +1665,9 @@ export default {
           }
         }
       })
+    },
+    hasAccess(namespace, permission) {
+      return hasPermissionToResource('NAMESPACES', namespace, permission)
     }
   }
 }

front-end/src/views/management/tenants/tenant.vue

@@ -33,7 +33,7 @@
             style="width: 200px;"
             @keyup.enter.native="handleFilterNamespace"/>
           <el-button type="primary" icon="el-icon-search" @click="handleFilterNamespace"/>
-          <el-button type="primary" icon="el-icon-plus" @click="handleCreateNamespace">{{ $t('namespace.newNamespace') }}</el-button>
+          <el-button v-if="hasAccess(postForm.tenant,'write')" type="primary" icon="el-icon-plus" @click="handleCreateNamespace">{{ $t('namespace.newNamespace') }}</el-button>
         </div>
         <el-row :gutter="24">
           <el-col :xs="{span: 24}" :sm="{span: 24}" :md="{span: 24}" :lg="{span: 24}" :xl="{span: 24}">
@@ -84,7 +84,7 @@
                   <span>{{ scope.row.storageSize }}</span>
                 </template>
               </el-table-column>
-              <el-table-column :label="$t('table.actions')" align="center" class-name="small-padding fixed-width">
+              <el-table-column v-if="hasAccess(postForm.tenant,'write')" :label="$t('table.actions')" align="center" class-name="small-padding fixed-width">
                 <template slot-scope="scope">
                   <router-link :to="'/management/namespaces/' + scope.row.tenant +'/' + scope.row.namespace + '/namespace'">
                     <el-button type="primary" size="mini">{{ $t('table.edit') }}</el-button>
@@ -186,7 +186,7 @@ import {
 import { validateEmpty } from '@/utils/validate'
 import { formatBytes } from '@/utils/index'
 import { numberFormatter } from '@/filters/index'
-
+import { hasPermissionToResource } from '../../../store/modules/user'
 const defaultForm = {
   tenant: ''
 }
@@ -456,6 +456,9 @@ export default {
         this.listNamespaces = []
         this.getNamespacesList()
       })
+    },
+    hasAccess(tenant, permission) {
+      return hasPermissionToResource('TENANTS', tenant, permission)
     }
   }
 }

front-end/src/views/management/topics/partitionedTopic.vue

@@ -68,6 +68,7 @@
         </el-table>
         <h4>{{ $t('topic.subscription.subscriptions') }}</h4>
         <el-button
+          v-if="hasAccess(postForm.namespace,'write')"
           class="filter-item"
           type="success"
           style="margin-bottom: 15px"
@@ -217,7 +218,7 @@
           </el-col>
         </el-row>
       </el-tab-pane>
-      <el-tab-pane label="POLICIES" name="policies">
+      <el-tab-pane v-if="hasAccess(postForm.namespace,'write')" label="POLICIES" name="policies">
         <h4>{{ $t('topic.policy.authentication') }}
           <el-tooltip :content="authorizationContent" class="item" effect="dark" placement="top">
             <i class="el-icon-info"/>
@@ -325,6 +326,7 @@ import Pagination from '@/components/Pagination' // Secondary package based on e
 import { formatBytes } from '@/utils/index'
 import { numberFormatter } from '@/filters/index'
 import { putSubscriptionOnCluster, deleteSubscriptionOnCluster } from '@/api/subscriptions'
+import { hasPermissionToResource } from '../../../store/modules/user'
 
 const defaultForm = {
   persistent: '',
@@ -798,6 +800,9 @@ export default {
       } else {
         sessionStorage.removeItem('refreshInterval')
       }
+    },
+    hasAccess(namespace, permission) {
+      return hasPermissionToResource('NAMESPACES', namespace, permission)
     }
   }
 }

front-end/src/views/management/topics/topic.vue

@@ -64,6 +64,7 @@
                 <el-table-column :label="$t('topic.data')" prop="data"/>
               </el-table>
               <el-button
+                v-if="hasAccess(postForm.namespace,'write')"
                 class="filter-item"
                 type="danger"
                 style="margin-top:15px;"
@@ -96,7 +97,7 @@
                 type="primary"
                 style="display:block;margin-top:15px;margin-left:auto;margin-right:auto;"
                 icon="el-icon-close"
-                @click="handleTerminate">
+                @click="handleTerminate" >
                 {{ $t('topic.terminate') }}
               </el-button>
               <el-button
@@ -105,7 +106,7 @@
                 style="display:block;margin-top:15px;margin-left:auto;margin-right:auto;"
                 icon="el-icon-close"
                 disabled
-                @click="handleTerminate">
+                @click="handleTerminate" >
                 {{ $t('topic.terminate') }}
               </el-button>
             </el-card>
@@ -271,6 +272,7 @@
         </el-row>
         <h4>{{ $t('topic.subscription.subscriptions') }}</h4>
         <el-button
+          v-if="hasAccess(postForm.namespace,'write')"
           class="filter-item"
           type="success"
           style="margin-bottom: 15px"
@@ -461,7 +463,7 @@
           </el-col>
         </el-row>
       </el-tab-pane>
-      <el-tab-pane :label="$t('tabs.policies')" name="policies">
+      <el-tab-pane v-if="hasAccess(postForm.namespace,'write')" :label="$t('tabs.policies')" name="policies">
         <h4>{{ $t('topic.policy.authentication') }}
           <el-tooltip :content="authorizationContent" class="item" effect="dark" placement="top">
             <i class="el-icon-info"/>
@@ -561,6 +563,7 @@ import { formatBytes } from '@/utils/index'
 import { numberFormatter } from '@/filters/index'
 import { putSubscriptionOnCluster, deleteSubscriptionOnCluster } from '@/api/subscriptions'
 import { validateSizeString } from '@/utils/validate'
+import { hasPermissionToResource } from '../../../store/modules/user'
 
 const defaultForm = {
   persistent: '',
@@ -1160,6 +1163,9 @@ export default {
         this.initTopicStats()
         this.dialogFormVisible = false
       })
+    },
+    hasAccess(namespace, permission) {
+      return hasPermissionToResource('NAMESPACES', namespace, permission)
     }
   }
 }

src/main/java/org/apache/pulsar/manager/controller/LoginController.java

@@ -20,13 +20,16 @@
 import org.apache.pulsar.manager.entity.RoleBindingRepository;
 import org.apache.pulsar.manager.entity.RoleInfoEntity;
 import org.apache.pulsar.manager.entity.RolesRepository;
+import org.apache.pulsar.manager.entity.TenantEntity;
+import org.apache.pulsar.manager.entity.TenantsRepository;
 import org.apache.pulsar.manager.entity.UserInfoEntity;
 import org.apache.pulsar.manager.entity.UsersRepository;
 import org.apache.pulsar.manager.service.JwtService;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiResponse;
 import io.swagger.annotations.ApiResponses;
+import org.apache.pulsar.manager.utils.ResourceType;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
@@ -81,6 +84,9 @@ public LoginController(JwtService jwtService) {
     @Autowired
     private RoleBindingRepository roleBindingRepository;
 
+    @Autowired
+    private TenantsRepository tenantsRepository;
+
     @ApiOperation(value = "Login pulsar manager")
     @ApiResponses({
             @ApiResponse(code = 200, message = "ok"),
@@ -112,7 +118,7 @@ public ResponseEntity<Map<String, Object>> login(
             result.put("login", "success");
             headers.add("token", token);
             headers.add("username", userAccount);
-            headers.add("tenant", userAccount);
+
             jwtService.setToken(request.getSession().getId(), token);
             List<RoleBindingEntity> roleBindingEntities = roleBindingRepository.
                     findByUserId(userInfoEntity.getUserId());
@@ -123,6 +129,10 @@ public ResponseEntity<Map<String, Object>> login(
             if (!roleIdList.isEmpty()) {
                 List<RoleInfoEntity> roleInfoEntities = rolesRepository.findAllRolesByMultiId(roleIdList);
                 for (RoleInfoEntity roleInfoEntity : roleInfoEntities) {
+                    if(roleInfoEntity.getResourceType().equals(ResourceType.TENANTS.name())){
+                        Optional<TenantEntity> tenantEntity = tenantsRepository.findByTenantId(roleInfoEntity.getResourceId());
+                        headers.add("tenant",tenantEntity.get().getTenant());
+                    }
                     if (roleInfoEntity.getFlag() == 0) {
                         // Super users can access all types
                         return new ResponseEntity<>(result, headers, HttpStatus.OK);