Merge pull request #3078 from actiontech/fix_save_audit_plan

fix: permission for save audit plan

Author: LordofAvernus

sqle/api/controller/v1/instance_audit_plan.go

@@ -650,7 +650,7 @@ func GetInstanceAuditPlanOverview(c echo.Context) error {
 		return controller.JSONBaseErrorReq(c, err)
 	}
 	// check current user instance audit plan permission
-	detail, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID, v1.OpPermissionTypeViewOtherAuditPlan)
+	detail, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID)
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}
@@ -901,7 +901,7 @@ func GetInstanceAuditPlanSQLs(c echo.Context) error {
 		return controller.JSONBaseErrorReq(c, err)
 	}
 	// check current user instance audit plan permission
-	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID, v1.OpPermissionTypeViewOtherAuditPlan)
+	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID)
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}
@@ -1000,7 +1000,7 @@ func GetInstanceAuditPlanSQLMeta(c echo.Context) error {
 		return controller.JSONBaseErrorReq(c, err)
 	}
 	// check current user instance audit plan permission
-	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID, v1.OpPermissionTypeViewOtherAuditPlan)
+	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID)
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}
@@ -1100,7 +1100,7 @@ func GetInstanceAuditPlanSQLData(c echo.Context) error {
 		return controller.JSONBaseErrorReq(c, err)
 	}
 	// check current user instance audit plan permission
-	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID, v1.OpPermissionTypeViewOtherAuditPlan)
+	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID)
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}
@@ -1166,7 +1166,7 @@ func GetInstanceAuditPlanSQLExport(c echo.Context) error {
 		return controller.JSONBaseErrorReq(c, err)
 	}
 	// check current user instance audit plan permission
-	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID, v1.OpPermissionTypeViewOtherAuditPlan)
+	_, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID)
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}
@@ -1262,7 +1262,7 @@ func GetAuditPlanSqlAnalysisData(c echo.Context) error {
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}
-	detail, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, insAuditPlanID, v1.OpPermissionTypeViewOtherAuditPlan)
+	detail, exist, err := GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, insAuditPlanID)
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}

sqle/api/controller/v1/project_permission.go

@@ -299,7 +299,7 @@ func GetAuditPlanIfCurrentUserCanOp(c echo.Context, projectId, auditPlanName str
 	return ap, false, errors.NewUserNotPermissionError(dmsV1.GetOperationTypeDesc(opType))
 }
 
-func GetInstanceAuditPlanIfCurrentUserCanView(c echo.Context, projectId, instanceAuditPlanID string, opType dmsV1.OpPermissionType) (*model.InstanceAuditPlan, bool, error) {
+func GetInstanceAuditPlanIfCurrentUserCanView(c echo.Context, projectId, instanceAuditPlanID string) (*model.InstanceAuditPlan, bool, error) {
 	storage := model.GetStorage()
 
 	ap, exist, err := storage.GetInstanceAuditPlanDetail(instanceAuditPlanID)
@@ -329,8 +329,8 @@ func GetInstanceAuditPlanIfCurrentUserCanView(c echo.Context, projectId, instanc
 			return ap, true, nil
 		}
 	}
-
-	if opType != "" {
+	opTypes := []dmsV1.OpPermissionType{dmsV1.OpPermissionTypeViewOtherAuditPlan, dmsV1.OpPermissionTypeSaveAuditPlan}
+	for _, opType := range opTypes {
 		dbServiceReq := &dmsV2.ListDBServiceReq{
 			ProjectUid: projectId,
 		}
@@ -344,7 +344,7 @@ func GetInstanceAuditPlanIfCurrentUserCanView(c echo.Context, projectId, instanc
 			}
 		}
 	}
-	return ap, false, errors.NewUserNotPermissionError(dmsV1.GetOperationTypeDesc(opType))
+	return ap, false, errors.NewUserNotPermissionError(dmsV1.GetOperationTypeDesc(dmsV1.OpPermissionTypeViewOtherAuditPlan))
 }
 
 func GetInstanceAuditPlanIfCurrentUserCanOp(c echo.Context, projectId, instanceAuditPlanID string, opType dmsV1.OpPermissionType) (*model.InstanceAuditPlan, bool, error) {

sqle/api/controller/v2/instance_audit_plan.go

@@ -248,7 +248,8 @@ func GetInstanceAuditPlans(c echo.Context) error {
 		"offset":                             offset,
 	}
 	if !up.CanViewProject() {
-		accessibleInstanceId := up.GetInstancesByOP(dmsCommonV1.OpPermissionTypeViewOtherAuditPlan)
+		// 如果有配置SQL管控权限，那么可以查看自己创建的或者该权限对应数据源的
+		accessibleInstanceId := up.GetInstancesByOP(dmsCommonV1.OpPermissionTypeViewOtherAuditPlan, dmsCommonV1.OpPermissionTypeSaveAuditPlan)
 		if len(accessibleInstanceId) > 0 {
 			data["accessible_instances_id"] = fmt.Sprintf("\"%s\"", strings.Join(accessibleInstanceId, "\",\""))
 		}
@@ -381,7 +382,7 @@ func GetInstanceAuditPlanDetail(c echo.Context) error {
 		return controller.JSONBaseErrorReq(c, err)
 	}
 	// check current user instance audit plan permission
-	detail, exist, err := v1.GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID, dmsCommonV1.OpPermissionTypeViewOtherAuditPlan)
+	detail, exist, err := v1.GetInstanceAuditPlanIfCurrentUserCanView(c, projectUID, instanceAuditPlanID)
 	if err != nil {
 		return controller.JSONBaseErrorReq(c, err)
 	}