tidb privilege 代码
文件路径：/privilege/privilege.go
/ Copyright 2015 PingCAP, Inc.
/
/ Licensed under the Apache License, Version 2.0 (the "License");
/ you may not use this file except in compliance with the License.
/ You may obtain a copy of the License at
/
/ http://www.apache.org/licenses/LICENSE-2.0
/
/ Unless required by applicable law or agreed to in writing, software
/ distributed under the License is distributed on an "AS IS" BASIS,
/ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/ See the License for the specific language governing permissions and
/ limitations under the License.
package privilege
import (
"crypto/tls"
"github.com/pingcap/tidb/parser/auth"
"github.com/pingcap/tidb/parser/mysql"
"github.com/pingcap/tidb/sessionctx"
"github.com/pingcap/tidb/types"
)
type keyType int
func (k keyType) String() string {
return "privilege-key"
}
/ Manager is the interface for providing privilege related operations.
type Manager interface {
/ ShowGrants shows granted privileges for user.
ShowGrants(ctx sessionctx.Context, user *auth.UserIdentity, roles []*auth.RoleIdentity) ([]string, error)
/ GetEncodedPassword shows the encoded password for user.
GetEncodedPassword(user, host string) string
/ RequestVerification verifies user privilege for the request.
/ If table is "", only check global/db scope privileges.
/ If table is not "", check global/db/table scope privileges.
/ priv should be a defined constant like CreatePriv, if pass AllPrivMask to priv,
/ this means any privilege would be OK.
RequestVerification(activeRole []*auth.RoleIdentity, db, table, column string, priv mysql.PrivilegeType) bool
/ RequestVerificationWithUser verifies specific user privilege for the request.
RequestVerificationWithUser(db, table, column string, priv mysql.PrivilegeType, user *auth.UserIdentity) bool
/ HasExplicitlyGrantedDynamicPrivilege verifies is a user has a dynamic privilege granted
/ without using the SUPER privilege as a fallback.
HasExplicitlyGrantedDynamicPrivilege(activeRoles []*auth.RoleIdentity, privName string, grantable bool) bool
/ RequestDynamicVerification verifies user privilege for a DYNAMIC privilege.
/ Dynamic privileges are only assignable globally, and have their own grantable attribute.
RequestDynamicVerification(activeRoles []*auth.RoleIdentity, privName string, grantable bool) bool
/ RequestDynamicVerificationWithUser verifies a DYNAMIC privilege for a specific user.
RequestDynamicVerificationWithUser(privName string, grantable bool, user *auth.UserIdentity) bool
/ ConnectionVerification verifies user privilege for connection.
/ Requires exact match on user name and host name.
ConnectionVerification(user *auth.UserIdentity, authUser, authHost string, auth, salt []byte, tlsState *tls.ConnectionState) error
/ GetAuthWithoutVerification uses to get auth name without verification.
/ Requires exact match on user name and host name.
GetAuthWithoutVerification(user, host string) bool
/ MatchIdentity matches an identity
MatchIdentity(user, host string, skipNameResolve bool) (string, string, bool)
/ DBIsVisible returns true is the database is visible to current user.
DBIsVisible(activeRole []*auth.RoleIdentity, db string) bool
/ UserPrivilegesTable provide data for INFORMATION_SCHEMA.USER_PRIVILEGES table.
UserPrivilegesTable(activeRoles []*auth.RoleIdentity, user, host string) [][]types.Datum
/ ActiveRoles active roles for current session.
/ The first illegal role will be returned.
ActiveRoles(ctx sessionctx.Context, roleList []*auth.RoleIdentity) (bool, string)
/ FindEdge find if there is an edge between role and user.
FindEdge(ctx sessionctx.Context, role *auth.RoleIdentity, user *auth.UserIdentity) bool
/ GetDefaultRoles returns all default roles for certain user.
GetDefaultRoles(user, host string) []*auth.RoleIdentity
/ GetAllRoles return all roles of user.
GetAllRoles(user, host string) []*auth.RoleIdentity
/ IsDynamicPrivilege returns if a privilege is in the list of privileges.
IsDynamicPrivilege(privNameInUpper string) bool
/ Get the authentication plugin for a user
GetAuthPlugin(user, host string) (string, error)
}
const key keyType = 0
/ BindPrivilegeManager binds Manager to context.
func BindPrivilegeManager(ctx sessionctx.Context, pc Manager) {
ctx.SetValue(key, pc)
}
/ GetPrivilegeManager gets Checker from context.
func GetPrivilegeManager(ctx sessionctx.Context) Manager {
if v, ok := ctx.Value(key).(Manager); ok {
return v
}
return nil
}