IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

RBAC: Refine validation of external services permissions (#68633)

Browse Source 
* RBAC: Refine validation of external services permissions

* Forgot to log the ext-id
This commit is contained in:
Gabriel MABILLE
2023-05-17 16:28:14 +02:00
committed by GitHub
parent ee9620e4e0
commit 3ffff632be
2 changed files with 48 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/services/accesscontrol/models.go
View File

@@ -271,9 +271,23 @@ func (cmd *SaveExternalServiceRoleCommand) Validate() error {
return fmt.Errorf("invalid org id %d for global role %t", cmd.OrgID, cmd.Global)
}
// Check and deduplicate permissions
if cmd.Permissions == nil || len(cmd.Permissions) == 0 {
return errors.New("no permissions provided")
}
dedupMap := map[Permission]bool{}
dedup := make([]Permission, 0, len(cmd.Permissions))
for i := range cmd.Permissions {
if len(cmd.Permissions[i].Action) == 0 {
return fmt.Errorf("external service %v requests a permission with no Action", cmd.ExternalServiceID)
}
if dedupMap[cmd.Permissions[i]] {
continue
}
dedupMap[cmd.Permissions[i]] = true
dedup = append(dedup, cmd.Permissions[i])
}
cmd.Permissions = dedup
if cmd.ServiceAccountID <= 0 {
return fmt.Errorf("invalid service account id %d", cmd.ServiceAccountID)