feat: privilege-apply CE stubs, controllers and permission point

api/dms/service/v1/privilege_apply_workflow.go

@@ -0,0 +1,176 @@
+package v1
+
+import (
+	privilegeApplyBiz "github.com/actiontech/dms/internal/privilege_apply/biz"
+	base "github.com/actiontech/dms/pkg/dms-common/api/base/v1"
+)
+
+// swagger:parameters GetPrivilegeApplyAssignees
+type GetPrivilegeApplyAssigneesReq struct {
+	// project id
+	// Required: true
+	// in: path
+	ProjectUid string `param:"project_uid" json:"project_uid" validate:"required"`
+	// datasource uid
+	// Required: true
+	// in: query
+	DBServiceUid string `query:"db_service_uid" json:"db_service_uid" validate:"required"`
+}
+
+// swagger:model GetPrivilegeApplyAssigneesReply
+type GetPrivilegeApplyAssigneesReply struct {
+	Data *GetPrivilegeApplyAssigneesReplyData `json:"data"`
+	base.GenericResp
+}
+
+// swagger:model GetPrivilegeApplyAssigneesReplyData
+type GetPrivilegeApplyAssigneesReplyData struct {
+	HasAssignee bool           `json:"has_assignee"`
+	Assignees   []*UidWithName `json:"assignees"`
+}
+
+// swagger:model CreatePrivilegeApplyWorkflowReq
+type CreatePrivilegeApplyWorkflowReq struct {
+	// swagger:ignore
+	ProjectUid string `param:"project_uid" json:"project_uid" validate:"required"`
+	// in: body
+	// Required: true
+	PrivilegeApplyWorkflow *CreatePrivilegeApplyWorkflow `json:"privilege_apply_workflow" validate:"required"`
+}
+
+// swagger:model CreatePrivilegeApplyWorkflow
+type CreatePrivilegeApplyWorkflow struct {
+	DBServiceUid         string                            `json:"db_service_uid" validate:"required"`
+	SourceDBAccountUid   string                            `json:"source_db_account_uid" validate:"required"`
+	RawSQL               string                            `json:"raw_sql" validate:"required"`
+	ErrorMessage         string                            `json:"error_message" validate:"required"`
+	RequestedObjects     []privilegeApplyBiz.PrivilegeObject `json:"requested_objects"`
+	RequestedActions     []string                          `json:"requested_actions"`
+	ApplyReason          string                            `json:"apply_reason" validate:"required"`
+	ExpectedExpireDays   *int64                            `json:"expected_expire_days"`
+}
+
+// swagger:model CreatePrivilegeApplyWorkflowReply
+type CreatePrivilegeApplyWorkflowReply struct {
+	Data *CreatePrivilegeApplyWorkflowReplyData `json:"data"`
+	base.GenericResp
+}
+
+// swagger:model CreatePrivilegeApplyWorkflowReplyData
+type CreatePrivilegeApplyWorkflowReplyData struct {
+	WorkflowID string `json:"workflow_id"`
+}
+
+// swagger:parameters GetPrivilegeApplyWorkflow
+type GetPrivilegeApplyWorkflowReq struct {
+	// project id
+	// Required: true
+	// in: path
+	ProjectUid string `param:"project_uid" json:"project_uid" validate:"required"`
+	// in: path
+	// Required: true
+	WorkflowID string `param:"workflow_id" json:"workflow_id" validate:"required"`
+}
+
+// swagger:model GetPrivilegeApplyWorkflowReply
+type GetPrivilegeApplyWorkflowReply struct {
+	Data *PrivilegeApplyWorkflowDetail `json:"data"`
+	base.GenericResp
+}
+
+// swagger:model PrivilegeApplyWorkflowDetail
+type PrivilegeApplyWorkflowDetail struct {
+	WorkflowID           string                            `json:"workflow_id"`
+	ApprovalStatus       privilegeApplyBiz.PrivilegeApplyWorkflowApprovalStatus `json:"approval_status"`
+	ReissueStatus        privilegeApplyBiz.PrivilegeApplyReissueStatus `json:"reissue_status"`
+	ApplyReason          string                            `json:"apply_reason"`
+	DBServiceUid         string                            `json:"db_service_uid"`
+	DBServiceName        string                            `json:"db_service_name"`
+	SourceDBAccountUid   string                            `json:"source_db_account_uid"`
+	SourceDBAccountName  string                            `json:"source_db_account_name"`
+	ApplicantUid         string                            `json:"applicant_uid"`
+	ApplicantName        string                            `json:"applicant_name"`
+	RawSQL               string                            `json:"raw_sql"`
+	ErrorMessage         string                            `json:"error_message"`
+	RequestedObjects     []privilegeApplyBiz.PrivilegeObject `json:"requested_objects"`
+	RequestedActions     []string                          `json:"requested_actions"`
+	ApprovedObjects      []privilegeApplyBiz.PrivilegeObject `json:"approved_objects"`
+	ApprovedActions      []string                          `json:"approved_actions"`
+	ExpectedExpireDays   *int64                            `json:"expected_expire_days"`
+	RejectReason         string                            `json:"reject_reason"`
+	ReissueError         string                            `json:"reissue_error"`
+	TargetDBAccountUid   string                            `json:"target_db_account_uid"`
+	TargetDBAccountName  string                            `json:"target_db_account_name"`
+	CreatedAt            string                            `json:"created_at" example:"2024-01-15T10:30:00Z"`
+	CurrentAssignees     []*UidWithName                    `json:"current_assignees"`
+	ImpactPreview        *privilegeApplyBiz.PrivilegeApplyImpactPreview `json:"impact_preview"`
+}
+
+// swagger:parameters ListPrivilegeApplyWorkflows
+type ListPrivilegeApplyWorkflowsReq struct {
+	ProjectUid string `param:"project_uid" json:"project_uid" validate:"required"`
+	PageSize   uint32 `query:"page_size" json:"page_size" validate:"required"`
+	PageIndex  uint32 `query:"page_index" json:"page_index"`
+	FilterByTab string `query:"filter_by_tab" json:"filter_by_tab" validate:"required,oneof=pending handled"`
+	FilterByDBServiceUid string `query:"filter_by_db_service_uid" json:"filter_by_db_service_uid"`
+}
+
+// swagger:model ListPrivilegeApplyWorkflowsReply
+type ListPrivilegeApplyWorkflowsReply struct {
+	Data  []*PrivilegeApplyWorkflowListItem `json:"data"`
+	Total int64                             `json:"total_nums"`
+	base.GenericResp
+}
+
+// swagger:model PrivilegeApplyWorkflowListItem
+type PrivilegeApplyWorkflowListItem struct {
+	WorkflowID          string `json:"workflow_id"`
+	ApplicantUid        string `json:"applicant_uid"`
+	ApplicantName       string `json:"applicant_name"`
+	DBServiceUid        string `json:"db_service_uid"`
+	DBServiceName       string `json:"db_service_name"`
+	SourceDBAccountName string `json:"source_db_account_name"`
+	ApplyReason         string `json:"apply_reason"`
+	CreatedAt           string `json:"created_at"`
+	ApprovalStatus      privilegeApplyBiz.PrivilegeApplyWorkflowApprovalStatus `json:"approval_status"`
+	ReissueStatus       privilegeApplyBiz.PrivilegeApplyReissueStatus `json:"reissue_status"`
+	CurrentAssignees    []*UidWithName `json:"current_assignees"`
+}
+
+// swagger:parameters ApprovePrivilegeApplyWorkflow
+type ApprovePrivilegeApplyWorkflowReq struct {
+	ProjectUid string `param:"project_uid" json:"project_uid" validate:"required"`
+	WorkflowID string `param:"workflow_id" json:"workflow_id" validate:"required"`
+	ApprovePrivilegeApplyWorkflow *ApprovePrivilegeApplyWorkflow `json:"approve_privilege_apply_workflow"`
+}
+
+type ApprovePrivilegeApplyWorkflow struct {
+	ApproveReason       string `json:"approve_reason"`
+	ApprovedPermissions *privilegeApplyBiz.ApprovedPermissions `json:"approved_permissions"`
+	ExpectedExpireDays  *int64 `json:"expected_expire_days"`
+}
+
+type ApprovePrivilegeApplyWorkflowReply struct {
+	base.GenericResp
+}
+
+// swagger:parameters RejectPrivilegeApplyWorkflow
+type RejectPrivilegeApplyWorkflowReq struct {
+	ProjectUid   string `param:"project_uid" json:"project_uid" validate:"required"`
+	WorkflowID   string `param:"workflow_id" json:"workflow_id" validate:"required"`
+	RejectReason string `json:"reject_reason" validate:"required"`
+}
+
+type RejectPrivilegeApplyWorkflowReply struct {
+	base.GenericResp
+}
+
+// swagger:parameters RetryReissuePrivilegeApplyWorkflow
+type RetryReissuePrivilegeApplyWorkflowReq struct {
+	ProjectUid string `param:"project_uid" json:"project_uid" validate:"required"`
+	WorkflowID string `param:"workflow_id" json:"workflow_id" validate:"required"`
+}
+
+type RetryReissuePrivilegeApplyWorkflowReply struct {
+	base.GenericResp
+}

internal/apiserver/service/privilege_apply_controller.go

@@ -0,0 +1,186 @@
+package service
+
+import (
+	aV1 "github.com/actiontech/dms/api/dms/service/v1"
+	apiError "github.com/actiontech/dms/internal/apiserver/pkg/error"
+	"github.com/actiontech/dms/pkg/dms-common/api/jwt"
+	"github.com/labstack/echo/v4"
+)
+
+// swagger:operation GET /v1/dms/projects/{project_uid}/privilege-apply-workflows/assignees PrivilegeApply GetPrivilegeApplyAssignees
+//
+// 预检提权申请审批人。
+//
+// ---
+// parameters:
+//   - name: project_uid
+//     in: path
+//     required: true
+//     type: string
+//   - name: db_service_uid
+//     in: query
+//     required: true
+//     type: string
+//
+// responses:
+//   '200':
+//     description: Get privilege apply assignees successfully
+//     schema:
+//       "$ref": "#/definitions/GetPrivilegeApplyAssigneesReply"
+//   default:
+//     description: Generic error response
+//     schema:
+//       "$ref": "#/definitions/GenericResp"
+func (ctl *DMSController) GetPrivilegeApplyAssignees(c echo.Context) error {
+	req := &aV1.GetPrivilegeApplyAssigneesReq{}
+	if err := bindAndValidateReq(c, req); err != nil {
+		return NewErrResp(c, err, apiError.BadRequestErr)
+	}
+	reply, err := ctl.DMS.GetPrivilegeApplyAssignees(c.Request().Context(), req)
+	if err != nil {
+		return NewErrResp(c, err, apiError.DMSServiceErr)
+	}
+	return NewOkRespWithReply(c, reply)
+}
+
+// swagger:operation POST /v1/dms/projects/{project_uid}/privilege-apply-workflows PrivilegeApply CreatePrivilegeApplyWorkflow
+//
+// 创建提权申请。
+//
+// ---
+// parameters:
+//   - name: project_uid
+//     in: path
+//     required: true
+//     type: string
+//   - name: privilege_apply_workflow
+//     in: body
+//     required: true
+//     schema:
+//       "$ref": "#/definitions/CreatePrivilegeApplyWorkflowReq"
+//
+// responses:
+//   '200':
+//     description: Create privilege apply workflow successfully
+//     schema:
+//       "$ref": "#/definitions/CreatePrivilegeApplyWorkflowReply"
+//   default:
+//     description: Generic error response
+//     schema:
+//       "$ref": "#/definitions/GenericResp"
+func (ctl *DMSController) CreatePrivilegeApplyWorkflow(c echo.Context) error {
+	req := &aV1.CreatePrivilegeApplyWorkflowReq{}
+	if err := bindAndValidateReq(c, req); err != nil {
+		return NewErrResp(c, err, apiError.BadRequestErr)
+	}
+	currentUserUID, err := jwt.GetUserUidStrFromContext(c)
+	if err != nil {
+		return NewErrResp(c, err, apiError.UnauthorizedErr)
+	}
+	reply, err := ctl.DMS.CreatePrivilegeApplyWorkflow(c.Request().Context(), req, currentUserUID)
+	if err != nil {
+		return NewErrResp(c, err, apiError.DMSServiceErr)
+	}
+	return NewOkRespWithReply(c, reply)
+}
+
+// swagger:operation GET /v1/dms/projects/{project_uid}/privilege-apply-workflows/{workflow_id} PrivilegeApply GetPrivilegeApplyWorkflow
+//
+// 查询提权申请详情（申请人只读）。
+//
+// ---
+// parameters:
+//   - name: project_uid
+//     in: path
+//     required: true
+//     type: string
+//   - name: workflow_id
+//     in: path
+//     required: true
+//     type: string
+//
+// responses:
+//   '200':
+//     description: Get privilege apply workflow successfully
+//     schema:
+//       "$ref": "#/definitions/GetPrivilegeApplyWorkflowReply"
+//   default:
+//     description: Generic error response
+//     schema:
+//       "$ref": "#/definitions/GenericResp"
+func (ctl *DMSController) GetPrivilegeApplyWorkflow(c echo.Context) error {
+	req := &aV1.GetPrivilegeApplyWorkflowReq{}
+	if err := bindAndValidateReq(c, req); err != nil {
+		return NewErrResp(c, err, apiError.BadRequestErr)
+	}
+	currentUserUID, err := jwt.GetUserUidStrFromContext(c)
+	if err != nil {
+		return NewErrResp(c, err, apiError.UnauthorizedErr)
+	}
+	reply, err := ctl.DMS.GetPrivilegeApplyWorkflow(c.Request().Context(), req, currentUserUID)
+	if err != nil {
+		return NewErrResp(c, err, apiError.DMSServiceErr)
+	}
+	return NewOkRespWithReply(c, reply)
+}
+
+func (ctl *DMSController) ListPrivilegeApplyWorkflows(c echo.Context) error {
+	req := &aV1.ListPrivilegeApplyWorkflowsReq{}
+	if err := bindAndValidateReq(c, req); err != nil {
+		return NewErrResp(c, err, apiError.BadRequestErr)
+	}
+	currentUserUID, err := jwt.GetUserUidStrFromContext(c)
+	if err != nil {
+		return NewErrResp(c, err, apiError.UnauthorizedErr)
+	}
+	reply, err := ctl.DMS.ListPrivilegeApplyWorkflows(c.Request().Context(), req, currentUserUID)
+	if err != nil {
+		return NewErrResp(c, err, apiError.DMSServiceErr)
+	}
+	return NewOkRespWithReply(c, reply)
+}
+
+func (ctl *DMSController) ApprovePrivilegeApplyWorkflow(c echo.Context) error {
+	req := &aV1.ApprovePrivilegeApplyWorkflowReq{}
+	if err := bindAndValidateReq(c, req); err != nil {
+		return NewErrResp(c, err, apiError.BadRequestErr)
+	}
+	currentUserUID, err := jwt.GetUserUidStrFromContext(c)
+	if err != nil {
+		return NewErrResp(c, err, apiError.UnauthorizedErr)
+	}
+	if err := ctl.DMS.ApprovePrivilegeApplyWorkflow(c.Request().Context(), req, currentUserUID); err != nil {
+		return NewErrResp(c, err, apiError.DMSServiceErr)
+	}
+	return NewOkRespWithReply(c, &aV1.ApprovePrivilegeApplyWorkflowReply{})
+}
+
+func (ctl *DMSController) RejectPrivilegeApplyWorkflow(c echo.Context) error {
+	req := &aV1.RejectPrivilegeApplyWorkflowReq{}
+	if err := bindAndValidateReq(c, req); err != nil {
+		return NewErrResp(c, err, apiError.BadRequestErr)
+	}
+	currentUserUID, err := jwt.GetUserUidStrFromContext(c)
+	if err != nil {
+		return NewErrResp(c, err, apiError.UnauthorizedErr)
+	}
+	if err := ctl.DMS.RejectPrivilegeApplyWorkflow(c.Request().Context(), req, currentUserUID); err != nil {
+		return NewErrResp(c, err, apiError.DMSServiceErr)
+	}
+	return NewOkRespWithReply(c, &aV1.RejectPrivilegeApplyWorkflowReply{})
+}
+
+func (ctl *DMSController) RetryReissuePrivilegeApplyWorkflow(c echo.Context) error {
+	req := &aV1.RetryReissuePrivilegeApplyWorkflowReq{}
+	if err := bindAndValidateReq(c, req); err != nil {
+		return NewErrResp(c, err, apiError.BadRequestErr)
+	}
+	currentUserUID, err := jwt.GetUserUidStrFromContext(c)
+	if err != nil {
+		return NewErrResp(c, err, apiError.UnauthorizedErr)
+	}
+	if err := ctl.DMS.RetryReissuePrivilegeApplyWorkflow(c.Request().Context(), req, currentUserUID); err != nil {
+		return NewErrResp(c, err, apiError.DMSServiceErr)
+	}
+	return NewOkRespWithReply(c, &aV1.RetryReissuePrivilegeApplyWorkflowReply{})
+}

internal/apiserver/service/router.go

@@ -329,6 +329,10 @@ func (s *APIServer) initRouter() error {
 				SqlWorkbenchService:   s.SqlWorkbenchController.SqlWorkbenchService,
 			}))
 
+			sqlWorkbenchV1.Use(sqlWorkbenchService.GetPrivilegeDeniedMiddleware(sqlWorkbenchService.PrivilegeDeniedMiddlewareConfig{
+				SqlWorkbenchService: s.SqlWorkbenchController.SqlWorkbenchService,
+			}))
+
 			sqlWorkbenchV1.Use(s.SqlWorkbenchController.SqlWorkbenchService.AuditMiddleware())
 			sqlWorkbenchV1.Use(middleware.ProxyWithConfig(middleware.ProxyConfig{
 				Skipper:  middleware.DefaultSkipper,

internal/dms/biz/op_permission.go

@@ -330,6 +330,13 @@ func initOpPermission() []*OpPermission {
 			Module:    DesensitizationRule,
 			Service:   v1.ServiceDMS,
 		},
+		{
+			UID:       pkgConst.UIdOfOpPermissionPrivilegeApplyAudit,
+			Name:      "提权审批",
+			RangeType: OpRangeTypeProject,
+			Module:    AccountManagement,
+			Service:   v1.ServiceDMS,
+		},
 	}
 }