From 0c31399e34ce1a4d9cb0d1453b2e72f3cd6d54ba Mon Sep 17 00:00:00 2001 From: Yuriy Tseretyan Date: Tue, 19 Apr 2022 11:47:28 -0400 Subject: [PATCH] Alerting: Fix nav-links for RBAC and other (#47798) --- pkg/api/index.go | 4 ++-- pkg/services/ngalert/accesscontrol.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/api/index.go b/pkg/api/index.go index d7d8f5e133a..0d7f0412e01 100644 --- a/pkg/api/index.go +++ b/pkg/api/index.go @@ -484,7 +484,7 @@ func (hs *HTTPServer) buildAlertNavLinks(c *models.ReqContext, uaVisibleForOrg b hasAccess := ac.HasAccess(hs.AccessControl, c) var alertChildNavs []*dtos.NavLink - if hasAccess(ac.ReqSignedIn, ac.EvalAny(ac.EvalPermission(ac.ActionAlertingRuleRead), ac.EvalPermission(ac.ActionAlertingNotificationsExternalRead))) { + if hasAccess(ac.ReqSignedIn, ac.EvalAny(ac.EvalPermission(ac.ActionAlertingRuleRead), ac.EvalPermission(ac.ActionAlertingRuleExternalRead))) { alertChildNavs = append(alertChildNavs, &dtos.NavLink{ Text: "Alert rules", Id: "alert-list", Url: hs.Cfg.AppSubURL + "/alerting/list", Icon: "list-ul", }) @@ -572,7 +572,7 @@ func (hs *HTTPServer) buildCreateNavLinks(c *models.ReqContext) []*dtos.NavLink _, uaIsDisabledForOrg := hs.Cfg.UnifiedAlerting.DisabledOrgs[c.OrgId] uaVisibleForOrg := hs.Cfg.UnifiedAlerting.IsEnabled() && !uaIsDisabledForOrg - if uaVisibleForOrg { + if uaVisibleForOrg && hasAccess(ac.ReqSignedIn, ac.EvalAny(ac.EvalPermission(ac.ActionAlertingRuleCreate), ac.EvalPermission(ac.ActionAlertingRuleExternalWrite))) { children = append(children, &dtos.NavLink{ Text: "Alert rule", SubTitle: "Create an alert rule", Id: "alert", Icon: "bell", Url: hs.Cfg.AppSubURL + "/alerting/new", diff --git a/pkg/services/ngalert/accesscontrol.go b/pkg/services/ngalert/accesscontrol.go index 2689ef03dc1..6c77aff47a8 100644 --- a/pkg/services/ngalert/accesscontrol.go +++ b/pkg/services/ngalert/accesscontrol.go @@ -165,7 +165,7 @@ var ( Version: 2, Permissions: accesscontrol.ConcatPermissions(rulesEditorRole.Role.Permissions, instancesEditorRole.Role.Permissions, notificationsEditorRole.Role.Permissions), }, - Grants: []string{string(models.ROLE_EDITOR)}, + Grants: []string{string(models.ROLE_EDITOR), string(models.ROLE_ADMIN)}, } )