IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-13 06:34:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

RBAC: Annotation permission migration (#78899)

Browse Source 
* add annotation permissions to dashboard managed role and add migrations for annotation permissions

* fix a bug with conditional access level definitions

* add tests

* Update pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* apply feedback

* add batching, fix tests and a typo

* add one more test

* undo unneeded change

* undo unwanted change

* only check the default basic permissions for non-OSS instances

* account for all wildcards and simplify the check a bit

* error handling and extra conditionals to avoid test failures

* fix a bug with admin permissions not appearing for folders

* fix the OSS check

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Ieva
2024-01-26 17:17:29 +00:00
committed by GitHub
co-authored by Gabriel MABILLE
parent 138079bbd8
commit 048d1e7c86
7 changed files with 547 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/accesscontrol.go
+4 -4
View File
@@ -606,7 +606,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
Group: "Annotations",
Permissions: []ac.Permission{
{Action: ac.ActionAnnotationsRead, Scope: ac.ScopeAnnotationsTypeOrganization},
{Action: ac.ActionAnnotationsRead, Scope: dashboards.ScopeDashboardsAll},
{Action: ac.ActionAnnotationsRead, Scope: dashboards.ScopeFoldersAll},
},
},
Grants: []string{string(org.RoleAdmin)},
@@ -620,11 +620,11 @@ func (hs *HTTPServer) declareFixedRoles() error {
Group: "Annotations",
Permissions: []ac.Permission{
{Action: ac.ActionAnnotationsCreate, Scope: ac.ScopeAnnotationsTypeOrganization},
{Action: ac.ActionAnnotationsCreate, Scope: dashboards.ScopeDashboardsAll},
{Action: ac.ActionAnnotationsCreate, Scope: dashboards.ScopeFoldersAll},
{Action: ac.ActionAnnotationsDelete, Scope: ac.ScopeAnnotationsTypeOrganization},
{Action: ac.ActionAnnotationsDelete, Scope: dashboards.ScopeDashboardsAll},
{Action: ac.ActionAnnotationsDelete, Scope: dashboards.ScopeFoldersAll},
{Action: ac.ActionAnnotationsWrite, Scope: ac.ScopeAnnotationsTypeOrganization},
{Action: ac.ActionAnnotationsWrite, Scope: dashboards.ScopeDashboardsAll},
{Action: ac.ActionAnnotationsWrite, Scope: dashboards.ScopeFoldersAll},
},
},
Grants: []string{string(org.RoleAdmin)},