IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Bump provisioning to admin-only in lieu of dedicated RBAC permissions (#50366)

Browse Source
This commit is contained in:
Alexander Weaver 2022-06-07 17:26:48 -05:00 committed by GitHub
parent 0cde283505
commit 28a47b56d2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/services/ngalert/api/authorization.go
View File

@ -186,7 +186,7 @@ func (api *API) authorize(method, path string) web.Handler {
http.MethodGet + "/api/v1/provisioning/mute-timings", http.MethodGet + "/api/v1/provisioning/mute-timings",
http.MethodGet + "/api/v1/provisioning/mute-timings/{name}", http.MethodGet + "/api/v1/provisioning/mute-timings/{name}",
http.MethodGet + "/api/v1/provisioning/alert-rules/{UID}": http.MethodGet + "/api/v1/provisioning/alert-rules/{UID}":
return middleware.ReqSignedIn return middleware.ReqOrgAdmin
case http.MethodPut + "/api/v1/provisioning/policies", case http.MethodPut + "/api/v1/provisioning/policies",
http.MethodPost + "/api/v1/provisioning/contact-points", http.MethodPost + "/api/v1/provisioning/contact-points",
@ -201,7 +201,7 @@ func (api *API) authorize(method, path string) web.Handler {
http.MethodPut + "/api/v1/provisioning/alert-rules/{UID}", http.MethodPut + "/api/v1/provisioning/alert-rules/{UID}",
http.MethodDelete + "/api/v1/provisioning/alert-rules/{UID}", http.MethodDelete + "/api/v1/provisioning/alert-rules/{UID}",
http.MethodPut + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}": http.MethodPut + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}":
return middleware.ReqEditorRole return middleware.ReqOrgAdmin
} }
if eval != nil { if eval != nil {

40
pkg/tests/api/alerting/api_provisioning_test.go
View File

@ -64,24 +64,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode) require.Equal(t, 401, resp.StatusCode)
}) })
t.Run("viewer GET should succeed", func(t *testing.T) { t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "") req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("editor GET should succeed", func(t *testing.T) { t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "") req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("admin GET should succeed", func(t *testing.T) { t.Run("admin GET should succeed", func(t *testing.T) {
@ -114,14 +114,14 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 403, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("editor PUT should succeed", func(t *testing.T) { t.Run("editor PUT should 403", func(t *testing.T) {
req := createTestRequest("PUT", url, "editor", body) req := createTestRequest("PUT", url, "editor", body)
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 202, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("admin PUT should succeed", func(t *testing.T) { t.Run("admin PUT should succeed", func(t *testing.T) {
@ -157,24 +157,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode) require.Equal(t, 401, resp.StatusCode)
}) })
t.Run("viewer GET should succeed", func(t *testing.T) { t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "") req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("editor GET should succeed", func(t *testing.T) { t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "") req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("admin GET should succeed", func(t *testing.T) { t.Run("admin GET should succeed", func(t *testing.T) {
@ -207,14 +207,14 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 403, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("editor POST should succeed", func(t *testing.T) { t.Run("editor POST should 403", func(t *testing.T) {
req := createTestRequest("POST", url, "editor", body) req := createTestRequest("POST", url, "editor", body)
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 202, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("admin POST should succeed", func(t *testing.T) { t.Run("admin POST should succeed", func(t *testing.T) {
@ -241,24 +241,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode) require.Equal(t, 401, resp.StatusCode)
}) })
t.Run("viewer GET should succeed", func(t *testing.T) { t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "") req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("editor GET should succeed", func(t *testing.T) { t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "") req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("admin GET should succeed", func(t *testing.T) { t.Run("admin GET should succeed", func(t *testing.T) {
@ -285,24 +285,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode) require.Equal(t, 401, resp.StatusCode)
}) })
t.Run("viewer GET should succeed", func(t *testing.T) { t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "") req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("editor GET should succeed", func(t *testing.T) { t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "") req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req) resp, err := http.DefaultClient.Do(req)
require.NoError(t, err) require.NoError(t, err)
require.NoError(t, resp.Body.Close()) require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode) require.Equal(t, 403, resp.StatusCode)
}) })
t.Run("admin GET should succeed", func(t *testing.T) { t.Run("admin GET should succeed", func(t *testing.T) {