feat: 【日志平台】自定义上报创建与更新支持 owners 主动授权 --story=137294541 - #12038
Conversation
yiqiwang-17
added
feat
jayjiahua
left a comment
jayjiahua
left a comment
There was a problem hiding this comment.
本轮审查发现以下两个 P1，建议修复后再合入。
| collector_config_name_en=collector_config_name_en, bk_biz_id=bkdata_biz_id | ||
| ) | ||
| # 幂等创建同样要保证 owners 拿到权限 | ||
| self._authorization_owners(existing, owners) |
There was a problem hiding this comment.
[P1] 幂等创建会绕过实例权限给已有资源授权
custom_create 入口只校验业务级 create_collection_v2；当 ignore_exists=true 命中已有英文名时，这里直接对 existing 调用 _authorization_owners。于是仅有“采集新建”权限的用户可以把自己放进 owners，获得已有采集项的 view/manage 以及关联索引集的 manage 权限，而无需持有这两个实例的管理权限。
建议在 created=False 分支通过现有 IAM 实例鉴权入口校验调用者对已有采集项及索引集的相应管理权限后再授权，并补充“create-only 用户不能认领已有资源”的回归测试。
| label=_("备注说明"), max_length=64, required=False, allow_null=True, allow_blank=True | ||
| ) | ||
| is_display = serializers.BooleanField(label=_("是否展示"), default=True, required=False) | ||
| owners = serializers.ListField( |
There was a problem hiding this comment.
[P1] 请限制 owners 数量，避免无界串行 IAM 调用
owners 的 ListField 没有 max_length；grant_creator_action_batch 又会为每个唯一用户同步调用一次 IAM，且采集项和索引集各执行一轮。当前字段可接受 1000 个唯一用户，这会展开为 2000 次串行远程授权；IAM 变慢或超时时会长期占用请求 worker。
建议按产品上限设置 max_length，并补充上限边界测试；如果确实需要大批量授权，应改为受控异步处理。
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12038 +/- ##
==========================================
+ Coverage 54.28% 62.36% +8.07%
==========================================
Files 807 935 +128
Lines 45868 68636 +22768
==========================================
+ Hits 24901 42803 +17902
- Misses 20967 25833 +4866 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
3 participants
No description provided.