bug: 调整NodeSearch接口权限校验 TencentBlueKing#1356 (TencentBlueKing#1369)

src/backend/common/common-query/query-mongo/src/main/kotlin/com/tencent/bkrepo/common/query/builder/MongoQueryInterpreter.kt

@@ -120,7 +120,7 @@ open class MongoQueryInterpreter {
     }
 
     open fun initContext(queryModel: QueryModel, mongoQuery: Query): QueryContext {
-        return QueryContext(queryModel, mongoQuery, this)
+        return QueryContext(queryModel, false, mongoQuery, this)
     }
 
     fun addRuleInterceptor(interceptor: QueryRuleInterceptor) {

src/backend/common/common-query/query-mongo/src/main/kotlin/com/tencent/bkrepo/common/query/interceptor/QueryContext.kt

@@ -37,6 +37,10 @@ import org.springframework.data.mongodb.core.query.Query
 
 open class QueryContext(
     open var queryModel: QueryModel,
+    /**
+     * 是否已经检查过权限，用于interpreter执行完后判断是否需要校验权限，避免多次校验影响性能
+     */
+    open var permissionChecked: Boolean,
     open val mongoQuery: Query,
     open val interpreter: MongoQueryInterpreter
 )

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/common/CommonQueryContext.kt

@@ -43,9 +43,10 @@ import org.springframework.data.mongodb.core.query.Query
 
 open class CommonQueryContext(
     override var queryModel: QueryModel,
+    override var permissionChecked: Boolean,
     override val mongoQuery: Query,
     override val interpreter: MongoQueryInterpreter
-) : QueryContext(queryModel, mongoQuery, interpreter) {
+) : QueryContext(queryModel, permissionChecked, mongoQuery, interpreter) {
 
     private var projectId: String? = null
     var repoList: List<RepositoryInfo>? = null

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/common/CommonQueryInterpreter.kt

@@ -0,0 +1,47 @@
+/*
+ * Tencent is pleased to support the open source community by making BK-CI 蓝鲸持续集成平台 available.
+ *
+ * Copyright (C) 2023 THL A29 Limited, a Tencent company.  All rights reserved.
+ *
+ * BK-CI 蓝鲸持续集成平台 is licensed under the MIT license.
+ *
+ * A copy of the MIT License is included in this file.
+ *
+ *
+ * Terms of the MIT License:
+ * ---------------------------------------------------
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+ * documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial portions of
+ * the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+ * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+ * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+package com.tencent.bkrepo.repository.search.common
+
+import com.tencent.bkrepo.auth.pojo.enums.PermissionAction
+import com.tencent.bkrepo.common.query.builder.MongoQueryInterpreter
+import com.tencent.bkrepo.common.query.interceptor.QueryContext
+import com.tencent.bkrepo.common.query.model.QueryModel
+import com.tencent.bkrepo.common.security.manager.PermissionManager
+
+open class CommonQueryInterpreter(
+    private val permissionManager: PermissionManager,
+) : MongoQueryInterpreter() {
+    override fun interpret(queryModel: QueryModel): QueryContext {
+        val context = super.interpret(queryModel) as CommonQueryContext
+        if (!context.permissionChecked) {
+            permissionManager.checkProjectPermission(PermissionAction.READ, context.findProjectId())
+            context.permissionChecked = true
+        }
+        return context
+    }
+}

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/common/RepoNameRuleInterceptor.kt

@@ -81,6 +81,7 @@ class RepoNameRuleInterceptor(
                 }
                 else -> throw IllegalArgumentException("RepoName only support EQ IN and NIN operation type.")
             }.toFixed()
+            context.permissionChecked = true
             return context.interpreter.resolveRule(queryRule, context)
         }
     }

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/node/NodeQueryContext.kt

@@ -38,6 +38,7 @@ import org.springframework.data.mongodb.core.query.Query
 
 class NodeQueryContext(
     override var queryModel: QueryModel,
+    override var permissionChecked: Boolean = false,
     override val mongoQuery: Query,
     override val interpreter: MongoQueryInterpreter
-) : CommonQueryContext(queryModel, mongoQuery, interpreter)
+) : CommonQueryContext(queryModel, permissionChecked, mongoQuery, interpreter)

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/node/NodeQueryInterpreter.kt

@@ -31,28 +31,28 @@
 
 package com.tencent.bkrepo.repository.search.node
 
-import com.tencent.bkrepo.common.query.builder.MongoQueryInterpreter
 import com.tencent.bkrepo.common.query.interceptor.QueryContext
 import com.tencent.bkrepo.common.query.model.QueryModel
 import com.tencent.bkrepo.common.security.manager.PermissionManager
+import com.tencent.bkrepo.repository.search.common.CommonQueryInterpreter
 import com.tencent.bkrepo.repository.search.common.LocalDatetimeRuleInterceptor
 import com.tencent.bkrepo.repository.search.common.MetadataRuleInterceptor
 import com.tencent.bkrepo.repository.search.common.RepoNameRuleInterceptor
 import com.tencent.bkrepo.repository.search.common.RepoTypeRuleInterceptor
 import com.tencent.bkrepo.repository.search.common.SelectFieldInterceptor
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.context.annotation.Lazy
 import org.springframework.data.mongodb.core.query.Query
 import org.springframework.stereotype.Component
 import javax.annotation.PostConstruct
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.context.annotation.Lazy
 
 @Component
 class NodeQueryInterpreter @Autowired @Lazy constructor(
     private val permissionManager: PermissionManager,
     private val repoNameRuleInterceptor: RepoNameRuleInterceptor,
     private val repoTypeRuleInterceptor: RepoTypeRuleInterceptor,
     private val localDatetimeRuleInterceptor: LocalDatetimeRuleInterceptor
-) : MongoQueryInterpreter() {
+) : CommonQueryInterpreter(permissionManager) {
 
     @PostConstruct
     fun init() {
@@ -65,6 +65,6 @@ class NodeQueryInterpreter @Autowired @Lazy constructor(
     }
 
     override fun initContext(queryModel: QueryModel, mongoQuery: Query): QueryContext {
-        return NodeQueryContext(queryModel, mongoQuery, this)
+        return NodeQueryContext(queryModel, false, mongoQuery, this)
     }
 }

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/packages/PackageQueryContext.kt

@@ -38,6 +38,7 @@ import org.springframework.data.mongodb.core.query.Query
 
 class PackageQueryContext(
     override var queryModel: QueryModel,
+    override var permissionChecked: Boolean = false,
     override val mongoQuery: Query,
     override val interpreter: MongoQueryInterpreter
-) : CommonQueryContext(queryModel, mongoQuery, interpreter)
+) : CommonQueryContext(queryModel, permissionChecked, mongoQuery, interpreter)

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/packages/PackageSearchInterpreter.kt

@@ -31,9 +31,10 @@
 
 package com.tencent.bkrepo.repository.search.packages
 
-import com.tencent.bkrepo.common.query.builder.MongoQueryInterpreter
 import com.tencent.bkrepo.common.query.interceptor.QueryContext
 import com.tencent.bkrepo.common.query.model.QueryModel
+import com.tencent.bkrepo.common.security.manager.PermissionManager
+import com.tencent.bkrepo.repository.search.common.CommonQueryInterpreter
 import com.tencent.bkrepo.repository.search.common.LocalDatetimeRuleInterceptor
 import com.tencent.bkrepo.repository.search.common.MetadataRuleInterceptor
 import com.tencent.bkrepo.repository.search.common.ModelValidateInterceptor
@@ -46,10 +47,11 @@ import javax.annotation.PostConstruct
 
 @Component
 class PackageSearchInterpreter(
+    private val permissionManager: PermissionManager,
     private val repoNameRuleInterceptor: RepoNameRuleInterceptor,
     private val repoTypeRuleInterceptor: RepoTypeRuleInterceptor,
     private val localDatetimeRuleInterceptor: LocalDatetimeRuleInterceptor
-) : MongoQueryInterpreter() {
+) : CommonQueryInterpreter(permissionManager) {
 
     @PostConstruct
     fun init() {
@@ -62,6 +64,6 @@ class PackageSearchInterpreter(
     }
 
     override fun initContext(queryModel: QueryModel, mongoQuery: Query): QueryContext {
-        return PackageQueryContext(queryModel, mongoQuery, this)
+        return PackageQueryContext(queryModel, false, mongoQuery, this)
     }
 }

src/backend/repository/biz-repository/src/main/kotlin/com/tencent/bkrepo/repository/search/software/packages/SoftwarePackageSearchInterpreter.kt

@@ -60,6 +60,6 @@ class SoftwarePackageSearchInterpreter(
     }
 
     override fun initContext(queryModel: QueryModel, mongoQuery: Query): QueryContext {
-        return PackageQueryContext(queryModel, mongoQuery, this)
+        return PackageQueryContext(queryModel, false, mongoQuery, this)
     }
 }