Skip to content

dbeaver/pro#9637 support restriction for connection #4521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HocKu7 wants to merge 2 commits into
base: devel
Choose a base branch
from
Open

dbeaver/pro#9637 support restriction for connection #4521

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c78850
dbeaver/pro#9637 support restriction for connection
HocKu7 Aug 3, 2026
3b1a6cb
dbeaver/pro#9637 support restriction for connection
HocKu7 Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/WebConnectionInfo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,11 @@ public class WebConnectionInfo {
private static final String FEATURE_PROVIDED = "provided";
private static final String FEATURE_MANAGEABLE = "manageable";

private static final String FEATURE_RESTRICT_DATA_EDIT = "restrictDataEdit";
private static final String FEATURE_RESTRICT_SCRIPT_EXECUTE = "restrictScriptExecute";
private static final String FEATURE_RESTRICT_DATA_IMPORT = "restrictDataImport";
private static final String FEATURE_RESTRICT_METADATA_EDIT = "restrictMetadataEdit";

private static final String TOOL_SESSION_MANAGER = "sessionManager";

private final WebSession session;
Expand Down Expand Up @@ -275,6 +280,18 @@ public String[] getFeatures() {
if (dataSourceContainer.isConnectionReadOnly()) {
features.add(FEATURE_READ_ONLY);
}
if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_DATA)) {
features.add(FEATURE_RESTRICT_DATA_EDIT);
}
if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EXECUTE_SCRIPTS)) {
features.add(FEATURE_RESTRICT_SCRIPT_EXECUTE);
}
if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_IMPORT_DATA)) {
features.add(FEATURE_RESTRICT_DATA_IMPORT);
}
if (!dataSourceContainer.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_METADATA)) {
features.add(FEATURE_RESTRICT_METADATA_EDIT);
}
if (dataSourceContainer.isProvided()) {
features.add(FEATURE_PROVIDED);
}
Expand Down
8 changes: 8 additions & 0 deletions .../io.cloudbeaver.server/src/io/cloudbeaver/service/navigator/impl/WebServiceNavigator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,6 +461,7 @@ public String renameNode(
return node.getNodeUri();
}
if (node instanceof DBNDatabaseNode dbNode) {
checkMetadataEditPermission(dbNode);
return renameDatabaseObject(
session,
dbNode,
Expand Down Expand Up @@ -546,6 +547,7 @@ public int deleteNodes(
}
checkProjectEditAccess(node, session);
if (node instanceof DBNDatabaseNode) {
checkMetadataEditPermission((DBNDatabaseNode) node);
DBSObject object = ((DBNDatabaseNode) node).getObject();
DBEObjectMaker objectDeleter = DBWorkbench.getPlatform().getEditorsRegistry().getObjectManager(
object.getClass(), DBEObjectMaker.class);
Expand Down Expand Up @@ -602,6 +604,12 @@ public int deleteNodes(
}
}

private void checkMetadataEditPermission(@NotNull DBNDatabaseNode node) throws DBException {
if (!node.getDataSourceContainer().hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_METADATA)) {
throw new DBWebException("Structure edit is restricted for this connection");
}
}

private void checkProjectEditAccess(@NotNull DBNNode node, @NotNull WebSession session) throws DBException {
var project = node.getOwnerProject();
if (!(project instanceof BaseWebProjectImpl bwp) || !hasNodeEditPermission(session, node, bwp.getRMProject())) {
Expand Down
18 changes: 14 additions & 4 deletions server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,7 @@
import org.jkiss.code.Nullable;
import org.jkiss.dbeaver.DBException;
import org.jkiss.dbeaver.Log;
import org.jkiss.dbeaver.model.DBPDataKind;
import org.jkiss.dbeaver.model.DBPDataSource;
import org.jkiss.dbeaver.model.DBPDataSourceContainer;
import org.jkiss.dbeaver.model.DBUtils;
import org.jkiss.dbeaver.model.*;
import org.jkiss.dbeaver.model.data.DBDAttributeBinding;
import org.jkiss.dbeaver.model.exec.DBCException;
import org.jkiss.dbeaver.model.exec.DBCLogicalOperator;
Expand Down Expand Up @@ -509,6 +506,7 @@
@Nullable List<WebSQLResultsRow> addedRows,
@Nullable WebDataFormat dataFormat
) throws DBException {
checkDataEditPermission(contextInfo);
WebSQLExecuteInfo[] result = new WebSQLExecuteInfo[1];

DBExecUtils.tryExecuteRecover(
Expand All @@ -521,9 +519,16 @@
return result[0];
}

private void checkDataEditPermission(@NotNull WebSQLContextInfo contextInfo) throws DBWebException {
if (!contextInfo.getProcessor().getConnection().getDataSourceContainer()
.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EDIT_DATA)) {
throw new DBWebException("Data edit is restricted for this connection");
}
}

@FunctionalInterface
private interface ThrowableFunction<T, R> {
R apply(T obj) throws DBException;

Check warning on line 531 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Reference type 'T' is missing a nullability annotation.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java:531:17: warning: Reference type 'T' is missing a nullability annotation. (sh.adelessfox.checkstyle.checks.NullabilityAnnotationsCheck)

Check warning on line 531 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Reference type 'R' is missing a nullability annotation.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java:531:9: warning: Reference type 'R' is missing a nullability annotation. (sh.adelessfox.checkstyle.checks.NullabilityAnnotationsCheck)
}

@Override
Expand Down Expand Up @@ -572,7 +577,8 @@
}

@Override
public String updateResultsDataBatchScript(@NotNull WebSQLContextInfo contextInfo, @NotNull String resultsId, @Nullable List<WebSQLResultsRow> updatedRows, @Nullable List<WebSQLResultsRow> deletedRows, @Nullable List<WebSQLResultsRow> addedRows, WebDataFormat dataFormat) throws DBWebException {

Check warning on line 580 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Reference type 'WebDataFormat' is missing a nullability annotation.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java:580:251: warning: Reference type 'WebDataFormat' is missing a nullability annotation. (sh.adelessfox.checkstyle.checks.NullabilityAnnotationsCheck)

Check warning on line 580 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Reference type 'String' is missing a nullability annotation.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java:580:12: warning: Reference type 'String' is missing a nullability annotation. (sh.adelessfox.checkstyle.checks.NullabilityAnnotationsCheck)

Check warning on line 580 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Line is longer than 140 characters (found 299).

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/impl/WebServiceSQL.java:580:0: warning: Line is longer than 140 characters (found 299). (com.puppycrawl.tools.checkstyle.checks.sizes.LineLengthCheck)
checkDataEditPermission(contextInfo);
try {
return contextInfo.getProcessor().generateResultsDataUpdateScript(
contextInfo.getProcessor().getWebSession().getProgressMonitor(),
Expand All @@ -599,6 +605,10 @@
if (DBWorkbench.isDistributed() && !webSession.hasPermission(DBWConstants.PERMISSION_SQL_EXECUTE_QUERY)) {
throw new DBWebException("Permission denied");
}
if (!contextInfo.getProcessor().getConnection().getDataSourceContainer()
.hasModifyPermission(DBPDataSourcePermission.PERMISSION_EXECUTE_SCRIPTS)) {
throw new DBWebException("Script execution is restricted for this connection");
}
return WebSQLUtils.createAsyncTaskExecuteSqlQuery(
webSession,
contextInfo,
Expand Down
5 changes: 5 additions & 0 deletions ...e.data.transfer/src/io/cloudbeaver/service/data/transfer/impl/WebServiceDataTransfer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
import org.jkiss.code.Nullable;
import org.jkiss.dbeaver.DBException;
import org.jkiss.dbeaver.Log;
import org.jkiss.dbeaver.model.DBPDataSourcePermission;
import org.jkiss.dbeaver.model.data.json.JSONUtils;
import org.jkiss.dbeaver.model.preferences.DBPPropertyDescriptor;
import org.jkiss.dbeaver.model.runtime.DBRProgressMonitor;
Expand Down Expand Up @@ -245,6 +246,10 @@ public WebAsyncTaskInfo asyncImportDataContainer(
if (!validateImportPermission(webSession)) {
throw new DBWebException("Permission denied. Data import is not allowed for this user");
}
if (!sqlContext.getProcessor().getConnection().getDataSourceContainer()
.hasModifyPermission(DBPDataSourcePermission.PERMISSION_IMPORT_DATA)) {
throw new DBWebException("Data import is restricted for this connection");
}
DataTransferProcessorDescriptor processor = DataTransferRegistry.getInstance().getProcessor(parameters.getProcessorId());
if (processor == null) {
throw new DBWebException("Wrong data processor '" + parameters.getProcessorId() + "'");
Expand Down
Loading