向量数据库 账号与权限管理

一、基本介绍

注意：说明：

注意：当前的账号权限管理功能仅适用于 Base 类数据库和集合（collection），而不涉及 AI 套件类数据库和集合视图（collectionView）。即对于 AI 类数据库和 CollectionView，仅支持使用 root 用户进行访问，并拥有完全读写权限，其他自定义用户均无法访问。

二、创建用户

创建自定义用户，需指定用户名及其对应的密码，如下以 Python 为例，说明用户名与密码的配置规则。

PythonJavaGoimport tcvectordbfrom tcvectordb.model.enum import ReadConsistency#create a database client objectclient = tcvectordb.RPCVectorDBClient(url='http://10.0.X.X:80', username='root', key='eC4bLRy2va******************************', read_consistency=ReadConsistency.EVENTUAL_CONSISTENCY, timeout=30)# 创建用户res = client.create_user(user='app_user', password='********')print(res)import com.tencent.tcvectordb.client.VectorDBClient;import com.tencent.tcvectordb.model.param.database.ConnectParam;import com.tencent.tcvectordb.model.param.entity.BaseRes;import com.tencent.tcvectordb.model.param.enums.ReadConsistencyEnum;import com.tencent.tcvectordb.model.param.user.*;import com.tencent.tcvectordb.utils.JsonUtils;// client 为 VectorDBClient() 创建的客户端对象BaseRes res = client.createUser("app_user", "********");System.out.println("create user res: code:" + res.getCode() + ", msg: " + res.getMsg());import ( "context" "log" "github.com/tencent/vectordatabase-sdk-go/tcvectordb" "github.com/tencent/vectordatabase-sdk-go/tcvectordb/api/user")var ( ctx = context.Background() database = "db-test" database1 = "db-test1" collectionName = "book-vector")err := client.CreateUser(ctx, tcvectordb.CreateUserParams{User: "app_user", Password: "**********"})if err != nil { log.Printf("create user failed, err: %+v", err.Error())}

三、给用户授权

给用户授权时，需指定用户名及权限，可以给用户批量授予多组权限；每个权限中，需要指定资源对象和允许的操作。如下以 Python 接口的参数为例，说明配置权限的具体规则。

PythonJavaGores = client.grant_to_user( user='app_user', privileges=[ { "resource": "db0.*", "actions": ["read"] }, { "resource": "db1.book-vector", "actions": ["readWrite"] }])print(res)// client 为 VectorDBClient() 创建的客户端对象BaseRes res = client.grantToUser(UserGrantParam.newBuilder() .withUser("app_user") .withPrivileges(Arrays.asList( PrivilegeParam.newBuilder().withResource("db-test.*").withActions(Arrays.asList("read")).build(), PrivilegeParam.newBuilder().withResource("db-test1.*").withActions(Arrays.asList("dbAdmin")).build(), PrivilegeParam.newBuilder().withResource("db-test.book-vector").withActions(Arrays.asList("readWrite")).build()) ).build());System.out.println("grant user permission res: code:" + res.getCode() + ", msg: " + res.getMsg());err := client.GrantToUser(ctx, tcvectordb.GrantToUserParams{ User: "app_user", Privileges: []*user.Privilege{ { Resource: database + ".*", Actions: []string{"read"}, }, { Resource: database + "." + collectionName, Actions: []string{"readWrite"}, }, { Resource: database1 + ".*", Actions: []string{"dbAdmin"}, }, }})if err != nil { log.Printf("grant to user failed, err: %+v", err.Error())}

四、查询用户权限

PythonJavaGores = client.describe_user(user='app_user')print(res)// client 为 VectorDBClient() 创建的客户端对象UserDescribeRes userDescribeRes = client.describeUser("app_user");System.out.println("describe user res: " + userDescribeRes.toString());result, err := client.DescribeUser(ctx, tcvectordb.DescribeUserParams{User: "app_user"})if err != nil { panic(err)}log.Printf("DescribeUser Result: %+v", result)

五、回收用户权限

回收用户权限，需明确指出回收权限的具体用户，列出需要回收的具体权限。

注意：说明：

PythonJavaGores = client.revoke_from_user( user='app_user', privileges={ "resource": "db0.*", "actions": ["read"] })print(res)BaseRes res = client.revokeFromUser(UserRevokeParam.newBuilder() .withUser("app_user") .withPrivilege( PrivilegeParam.newBuilder().withResource("db-test.*").withActions(Arrays.asList("read")).build() ).build());System.out.println("revoke user permission res: code:" + res.getCode() + ", msg: " + res.getMsg());err := client.RevokeFromUser(ctx, tcvectordb.RevokeFromUserParams{User: "app_user", Privileges: []*user.Privilege{ { Resource: database + ".*", Actions: []string{"read"}, }, }})if err != nil { log.Printf("create user failed, err: %+v", err.Error())}

六、修改用户密码

PythonJavaGores = client.change_password(user='app_user', password='########')print(res)// client 为 VectorDBClient() 创建的客户端对象BaseRes res = client.changePassword("app_user", "##########");System.out.println("change user password res: " + res.getCode() + " " + res.getMsg());err := client.ChangePassword(ctx, tcvectordb.ChangePasswordParams{ User: "app_user", Password: "########",})if err != nil { log.Printf("change user password err: %+v", err.Error())}

七、API 资源层级与操作权限

向量数据库提供的操作规则（read、readWrite 等）和 API 接口的对应关系，如下表所示。