From af020da5347aef0853fd0a8801084c1c7b840472 Mon Sep 17 00:00:00 2001 From: actiontech-zihan Date: Wed, 8 Jul 2026 03:16:00 +0000 Subject: [PATCH] fix(sql_workbench): align ODC datasource sync with business write permission ODC workbench datasource sync called CanOpGlobal with isBusinessWrite=false, so a system admin whose business-write permission was disabled still bypassed per-project/per-datasource filtering and could see and execute SQL on all datasources. This diverged from CloudBeaver, whose connectManagement passes isBusinessWrite=true. Pass isBusinessWrite=true here as well so such an admin falls back to project/datasource-level permission filtering, keeping ODC and CloudBeaver datasource visibility consistent. --- internal/sql_workbench/service/sql_workbench_service.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/internal/sql_workbench/service/sql_workbench_service.go b/internal/sql_workbench/service/sql_workbench_service.go index 8b100566..ab2d0ecf 100644 --- a/internal/sql_workbench/service/sql_workbench_service.go +++ b/internal/sql_workbench/service/sql_workbench_service.go @@ -540,8 +540,10 @@ func (sqlWorkbenchService *SqlWorkbenchService) getUserAccessibleDBServices(ctx return nil, fmt.Errorf("failed to get active db services: %v", err) } - // 检查用户是否有全局权限 - hasGlobalOpPermission, err := sqlWorkbenchService.opPermissionVerifyUsecase.CanOpGlobal(ctx, dmsUser.UID, false) + // 检查用户是否有全局权限。工作台数据源同步属于业务写场景，需传入 isBusinessWrite=true， + // 与 CloudBeaver 的 connectManagement 保持一致：系统管理员关闭业务写权后不再放行全部数据源， + // 而是走项目/数据源级权限过滤。 + hasGlobalOpPermission, err := sqlWorkbenchService.opPermissionVerifyUsecase.CanOpGlobal(ctx, dmsUser.UID, true) if err != nil { return nil, fmt.Errorf("failed to check global op permission: %v", err) }