IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

RBAC: add folder UID scope resolver (#62695)

Browse Source 
* add folder uid scope resolver

* undo guardian change, move it to a separate PR

* fix test + linting
This commit is contained in:
Ieva 2023-02-07 16:27:20 +00:00 committed by GitHub
parent 1cfd3f81fb
commit 078639abcd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 29 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/services/dashboards/accesscontrol.go
View File

@ -96,6 +96,28 @@ func NewFolderIDScopeResolver(db Store, folderDB folder.FolderStore, folderSvc f
})
}
// NewFolderUIDScopeResolver provides an ScopeAttributeResolver that is able to convert a scope prefixed with "folders:uid:"
// into uid based scopes for folder and its parents
func NewFolderUIDScopeResolver(db Store, folderDB folder.FolderStore, folderSvc folder.Service) (string, ac.ScopeAttributeResolver) {
prefix := ScopeFoldersProvider.GetResourceScopeUID("")
return prefix, ac.ScopeAttributeResolverFunc(func(ctx context.Context, orgID int64, scope string) ([]string, error) {
if !strings.HasPrefix(scope, prefix) {
return nil, ac.ErrInvalidScope
}
uid, err := ac.ParseScopeUID(scope)
if err != nil {
return nil, err
}
inheritedScopes, err := GetInheritedScopes(ctx, orgID, uid, folderSvc)
if err != nil {
return nil, err
}
return append(inheritedScopes, ScopeFoldersProvider.GetResourceScopeUID(uid)), nil
})
}
// NewDashboardIDScopeResolver provides an ScopeAttributeResolver that is able to convert a scope prefixed with "dashboards:id:"
// into uid based scopes for both dashboard and folder
func NewDashboardIDScopeResolver(db Store, folderDB folder.FolderStore, folderSvc folder.Service) (string, ac.ScopeAttributeResolver) {

11
pkg/services/folder/folderimpl/folder.go
View File

@ -48,7 +48,7 @@ func ProvideService(
features featuremgmt.FeatureToggles,
) folder.Service {
store := ProvideStore(db, cfg, features)
svr := &Service{
srv := &Service{
cfg: cfg,
log: log.New("folder-service"),
dashboardStore: dashboardStore,
@ -59,12 +59,13 @@ func ProvideService(
bus: bus,
}
if features.IsEnabled(featuremgmt.FlagNestedFolders) {
svr.DBMigration(db)
srv.DBMigration(db)
}
ac.RegisterScopeAttributeResolver(dashboards.NewFolderNameScopeResolver(dashboardStore, folderStore, svr))
ac.RegisterScopeAttributeResolver(dashboards.NewFolderIDScopeResolver(dashboardStore, folderStore, svr))
return svr
ac.RegisterScopeAttributeResolver(dashboards.NewFolderNameScopeResolver(dashboardStore, folderStore, srv))
ac.RegisterScopeAttributeResolver(dashboards.NewFolderIDScopeResolver(dashboardStore, folderStore, srv))
ac.RegisterScopeAttributeResolver(dashboards.NewFolderUIDScopeResolver(dashboardStore, folderStore, srv))
return srv
}
func (s *Service) DBMigration(db db.DB) {

2
pkg/services/folder/folderimpl/folder_test.go
View File

@ -40,7 +40,7 @@ func TestIntegrationProvideFolderService(t *testing.T) {
ac := acmock.New()
ProvideService(ac, bus.ProvideBus(tracing.InitializeTracerForTest()), cfg, nil, nil, nil, &featuremgmt.FeatureManager{})
require.Len(t, ac.Calls.RegisterAttributeScopeResolver, 2)
require.Len(t, ac.Calls.RegisterAttributeScopeResolver, 3)
})
}