fix: force the connector and pipeline belong to same namespace

instill-ai · Jan 2, 2024 · 9c2c027 · 9c2c027
1 parent ab61222
commit 9c2c027
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 4 deletions.
diff --git a/integration-test/pipeline/const.js b/integration-test/pipeline/const.js
@@ -112,7 +112,7 @@ export const simpleRecipe = {
       },
       {
         id: "d01",
-        resource_name: `users/instill-ai/connectors/${dstCSVConnID1}`,
+        resource_name: `users/admin/connectors/${dstCSVConnID1}`,
         definition_name: "connector-definitions/airbyte-destination",
         configuration: {
           input: {
@@ -124,7 +124,7 @@ export const simpleRecipe = {
       },
       {
         id: "d02",
-        resource_name: `users/instill-ai/connectors/${dstCSVConnID2}`,
+        resource_name: `users/admin/connectors/${dstCSVConnID2}`,
         definition_name: "connector-definitions/airbyte-destination",
         configuration: {
           input: {
@@ -206,7 +206,7 @@ export const simpleRecipeDupId = {
       },
       {
         id: "d01",
-        resource_name: `users/instill-ai/connectors/${dstCSVConnID1}`,
+        resource_name: `users/admin/connectors/${dstCSVConnID1}`,
         definition_name: "connector-definitions/airbyte-destination",
         configuration: {
           input: {
@@ -218,7 +218,7 @@ export const simpleRecipeDupId = {
       },
       {
         id: "d01",
-        resource_name: `users/instill-ai/connectors/${dstCSVConnID2}`,
+        resource_name: `users/admin/connectors/${dstCSVConnID2}`,
         definition_name: "connector-definitions/airbyte-destination",
         configuration: {
           input: {

diff --git a/pkg/handler/errors.go b/pkg/handler/errors.go
@@ -9,3 +9,4 @@ var ErrFieldMask = errors.New("field mask error")
 var ErrResourceID = errors.New("resource ID error")
 var ErrSematicVersion = errors.New("not a legal version, should be the format vX.Y.Z or vX.Y.Z-identifiers")
 var ErrUpdateMask = errors.New("update mask error")
+var ErrConnectorNamespace = errors.New("can not use other's connector")
diff --git a/pkg/handler/pipeline.go b/pkg/handler/pipeline.go
@@ -269,6 +269,13 @@ func (h *PublicHandler) createNamespacePipeline(ctx context.Context, req CreateN
 	pipelineToCreate := req.GetPipeline()
 
 	pipelineToCreate.OwnerName = req.GetParent()
+	if pipelineToCreate.Recipe != nil {
+		for _, comp := range pipelineToCreate.Recipe.Components {
+			if comp.ResourceName != "" && !strings.HasPrefix(comp.ResourceName, pipelineToCreate.OwnerName+"/") {
+				return nil, ErrConnectorNamespace
+			}
+		}
+	}
 
 	pipeline, err = h.service.CreateNamespacePipeline(ctx, ns, authUser, pipelineToCreate)
 
@@ -525,6 +532,13 @@ func (h *PublicHandler) updateNamespacePipeline(ctx context.Context, req UpdateN
 		span.SetStatus(1, err.Error())
 		return nil, err
 	}
+	if pbPipelineReq.Recipe != nil {
+		for _, comp := range pbPipelineReq.Recipe.Components {
+			if comp.ResourceName != "" && !strings.HasPrefix(comp.ResourceName, pbPipelineToUpdate.OwnerName+"/") {
+				return nil, ErrConnectorNamespace
+			}
+		}
+	}
 
 	pbPipeline, err := h.service.UpdateNamespacePipelineByID(ctx, ns, authUser, id, pbPipelineToUpdate)
 	if err != nil {

diff --git a/pkg/middleware/interceptor.go b/pkg/middleware/interceptor.go
@@ -106,6 +106,7 @@ func AsGRPCError(err error) error {
 		errors.Is(err, handler.ErrFieldMask),
 		errors.Is(err, handler.ErrResourceID),
 		errors.Is(err, handler.ErrSematicVersion),
+		errors.Is(err, handler.ErrConnectorNamespace),
 		errors.Is(err, handler.ErrUpdateMask):
 
 		code = codes.InvalidArgument