azkaban-aplcache

Adding an Ajax call endpoint to check if user has WRITE access …

2/27/2019 3:14:44 AM

to the project or not (#2131)

In this PR changes are done to add an AJAX endpoint which will provide the information if the user have WRITE access to a given project. This API will be useful for **TuneIn** which is a part of **Dr.Elephant**. Currently, TuneIn show many details like suggested parameters for the job, algorithm etc on the job page and the user would be able to modify these parameters. But since these properties are used by Azkaban(one of the supported Workflow managers by Dr.Elephant), so the user must be authorized to change these properties. For this purpose, Dr.Elephant will call this API with **session_id**(provided by Azkaban after successful authentication) and **project_name** as query params.

This API will have Azkaban user session_id and the project name as query params and as a result a Boolean value will be returned determining if the user whose session_id was passed as query param have WRITE access to the project which was also passed as a query param. So to know if some user have Write permission in the respective project the client calling the API must have the user's session_id. In this manner, this API cannot be used by any client to expose other Azkaban users' access to a project.

There are some other existing APIs like `getPermission` and `fetchprojectusers` which provide users and their permissions in a project, but these APIs doesn't provide information about `user who is not owner/user of project but is a part of group which has WRITE or greater permissions` in the project, so eventually this user will also be able to WRITE in the project but we won't be able to determine with these mentioned APIs.

ShubhamGupta29

Commit: ce8191b

Tree: 3b07043

Parents: 41dd197

Changes

azkaban-web-server/src/main/java/azkaban/webapp/servlet/ProjectManagerServlet.java 7(+7 -0)

Details

azkaban-web-server/src/main/java/azkaban/webapp/servlet/ProjectManagerServlet.java 7(+7 -0)

diff --git a/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ProjectManagerServlet.java b/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ProjectManagerServlet.java
index 6008397..7d8336b 100644
--- a/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ProjectManagerServlet.java
+++ b/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ProjectManagerServlet.java
@@ -304,6 +304,8 @@ public class ProjectManagerServlet extends LoginAbstractAzkabanServlet {
         if (handleAjaxPermission(project, user, Type.WRITE, ret)) {
           ajaxSetJobOverrideProperty(project, ret, req, user);
         }
+      } else if (ajaxName.equals("checkForWritePermission")) {
+        ajaxCheckForWritePermission(project, user, ret);
       } else {
         ret.put("error", "Cannot execute command " + ajaxName);
       }
@@ -1091,6 +1093,11 @@ public class ProjectManagerServlet extends LoginAbstractAzkabanServlet {
     ret.put("proxyUsers", proxyUsers);
   }
 
+  private void ajaxCheckForWritePermission(final Project project, final User user,
+      final HashMap<String, Object> ret) {
+    ret.put("hasWritePermission", hasPermission(project, user, Type.WRITE));
+  }
+
   private void handleProjectLogsPage(final HttpServletRequest req,
       final HttpServletResponse resp, final Session session) throws ServletException,
       IOException {