IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-18 17:15:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

Move SignedInUser to user service and RoleType and Roles to org (#53445)

Browse Source 
* Move SignedInUser to user service and RoleType and Roles to org

* Use go naming convention for roles

* Fix some imports and leftovers

* Fix ldap debug test

* Fix lint

* Fix lint 2

* Fix lint 3

* Fix type and not needed conversion

* Clean up messages in api tests

* Clean up api tests 2
This commit is contained in:
idafurjes
2022-08-10 11:56:48 +02:00
committed by GitHub
parent 46004037e2
commit 6afad51761
278 changed files with 1758 additions and 1543 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/annotation.go
+2 -1
View File
@@ -13,6 +13,7 @@ import (
"github.com/grafana/grafana/pkg/services/annotations"
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
"github.com/grafana/grafana/pkg/services/user"
)
// Update the item so that EpochEnd >= Epoch
@@ -255,7 +256,7 @@ func (r *SQLAnnotationRepo) Find(ctx context.Context, query *annotations.ItemQue
return items, err
}
func getAccessControlFilter(user *models.SignedInUser) (string, []interface{}, error) {
func getAccessControlFilter(user *user.SignedInUser) (string, []interface{}, error) {
if user == nil || user.Permissions[user.OrgId] == nil {
return "", nil, errors.New("missing permissions")
}
pkg/services/sqlstore/annotation_test.go
+3 -2
View File
@@ -6,6 +6,7 @@ import (
"testing"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -26,7 +27,7 @@ func TestIntegrationAnnotations(t *testing.T) {
sql := sqlstore.InitTestDB(t)
repo := sqlstore.NewSQLAnnotationRepo(sql)
testUser := &models.SignedInUser{
testUser := &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{
1: {
@@ -436,7 +437,7 @@ func TestIntegrationAnnotationListingWithRBAC(t *testing.T) {
err = repo.Save(organizationAnnotation)
require.NoError(t, err)
user := &models.SignedInUser{
user := &user.SignedInUser{
UserId: 1,
OrgId: 1,
}
pkg/services/sqlstore/migrations/accesscontrol/managed_permission_migrator.go
+2 -2
View File
@@ -13,8 +13,8 @@ import (
"time"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
"golang.org/x/text/cases"
"golang.org/x/text/language"
@@ -80,7 +80,7 @@ func (sp *managedPermissionMigrator) Exec(sess *xorm.Session, mg *migrator.Migra
// Add parent roles + permissions to the map as "true" -- need to be inserted
basicRoleName := ParseRoleFromName(roleName)
for _, parent := range models.RoleType(basicRoleName).Parents() {
for _, parent := range org.RoleType(basicRoleName).Parents() {
parentManagedRoleName := "managed:builtins:" + strings.ToLower(string(parent)) + ":permissions"
if _, ok := permissionMap[p.OrgID][parentManagedRoleName]; !ok {
pkg/services/sqlstore/migrations/accesscontrol/team_membership.go
+2 -1
View File
@@ -9,6 +9,7 @@ import (
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
)
@@ -209,7 +210,7 @@ func (p *teamPermissionMigrator) generateAssociatedPermissions(teamMemberships [
// only admins or editors (when editorsCanAdmin option is enabled)
// can access team administration endpoints
if m.Permission == models.PERMISSION_ADMIN {
if userRolesByOrg[m.OrgId][m.UserId] == string(models.ROLE_VIEWER) || (userRolesByOrg[m.OrgId][m.UserId] == string(models.ROLE_EDITOR) && !p.editorsCanAdmin) {
if userRolesByOrg[m.OrgId][m.UserId] == string(org.RoleViewer) || (userRolesByOrg[m.OrgId][m.UserId] == string(org.RoleEditor) && !p.editorsCanAdmin) {
m.Permission = 0
if _, err := p.sess.Cols("permission").Where("org_id=? and team_id=? and user_id=?", m.OrgId, m.TeamId, m.UserId).Update(m); err != nil {
pkg/services/sqlstore/migrations/accesscontrol/test/ac_test.go
+6 -5
View File
@@ -11,6 +11,7 @@ import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrations"
acmig "github.com/grafana/grafana/pkg/services/sqlstore/migrations/accesscontrol"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
@@ -276,35 +277,35 @@ func setupTeams(t *testing.T, x *xorm.Engine) {
{
OrgId: 1,
UserId: 1,
Role: models.ROLE_VIEWER,
Role: org.RoleViewer,
Created: now,
Updated: now,
},
{
OrgId: 1,
UserId: 2,
Role: models.ROLE_VIEWER,
Role: org.RoleViewer,
Created: now,
Updated: now,
},
{
OrgId: 1,
UserId: 3,
Role: models.ROLE_EDITOR,
Role: org.RoleEditor,
Created: now,
Updated: now,
},
{
OrgId: 1,
UserId: 4,
Role: models.ROLE_ADMIN,
Role: org.RoleAdmin,
Created: now,
Updated: now,
},
{
OrgId: 2,
UserId: 5,
Role: models.ROLE_EDITOR,
Role: org.RoleEditor,
Created: now,
Updated: now,
},
pkg/services/sqlstore/migrations/ualert/permissions.go
+4 -4
View File
@@ -19,13 +19,13 @@ import (
type roleType string
const (
ROLE_VIEWER roleType = "Viewer"
ROLE_EDITOR roleType = "Editor"
ROLE_ADMIN roleType = "Admin"
RoleViewer roleType = "Viewer"
RoleEditor roleType = "Editor"
RoleAdmin roleType = "Admin"
)
func (r roleType) IsValid() bool {
return r == ROLE_VIEWER || r == ROLE_ADMIN || r == ROLE_EDITOR
return r == RoleViewer || r == RoleAdmin || r == RoleEditor
}
type permissionType int
pkg/services/sqlstore/mockstore/mockstore.go
+1 -1
View File
@@ -39,7 +39,7 @@ type SQLStoreMock struct {
ExpectedDataSourcesAccessStats []*models.DataSourceAccessStats
ExpectedNotifierUsageStats []*models.NotifierUsageStats
ExpectedPersistedDashboards models.HitList
ExpectedSignedInUser *models.SignedInUser
ExpectedSignedInUser *user.SignedInUser
ExpectedUserStars map[int64]bool
ExpectedLoginAttempts int64
pkg/services/sqlstore/org.go
+10 -9
View File
@@ -7,6 +7,7 @@ import (
"github.com/grafana/grafana/pkg/events"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/org"
"xorm.io/xorm"
)
@@ -103,7 +104,7 @@ func isOrgNameTaken(name string, existingId int64, sess *DBSession) (bool, error
}
func (ss *SQLStore) createOrg(ctx context.Context, name string, userID int64, engine *xorm.Engine) (models.Org, error) {
org := models.Org{
orga := models.Org{
Name: name,
Created: time.Now(),
Updated: time.Now(),
@@ -115,14 +116,14 @@ func (ss *SQLStore) createOrg(ctx context.Context, name string, userID int64, en
return models.ErrOrgNameTaken
}
if _, err := sess.Insert(&org); err != nil {
if _, err := sess.Insert(&orga); err != nil {
return err
}
user := models.OrgUser{
OrgId: org.Id,
OrgId: orga.Id,
UserId: userID,
Role: models.ROLE_ADMIN,
Role: org.RoleAdmin,
Created: time.Now(),
Updated: time.Now(),
}
@@ -130,17 +131,17 @@ func (ss *SQLStore) createOrg(ctx context.Context, name string, userID int64, en
_, err := sess.Insert(&user)
sess.publishAfterCommit(&events.OrgCreated{
Timestamp: org.Created,
Id: org.Id,
Name: org.Name,
Timestamp: orga.Created,
Id: orga.Id,
Name: orga.Name,
})
return err
}, 0); err != nil {
return org, err
return orga, err
}
return org, nil
return orga, nil
}
// CreateOrgWithMember creates an organization with a certain name and a certain user as member.
pkg/services/sqlstore/org_test.go
+13 -12
View File
@@ -13,6 +13,7 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
dashver "github.com/grafana/grafana/pkg/services/dashboardversion"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/util"
)
@@ -23,7 +24,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
}
t.Run("Testing Account DB Access", func(t *testing.T) {
sqlStore := InitTestDB(t)
testUser := &models.SignedInUser{
testUser := &user.SignedInUser{
Permissions: map[int64]map[string][]string{
1: {accesscontrol.ActionOrgUsersRead: []string{accesscontrol.ScopeUsersAll}},
},
@@ -175,7 +176,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
})
t.Run("Can search users", func(t *testing.T) {
query := models.SearchUsersQuery{Query: "", SignedInUser: &models.SignedInUser{
query := models.SearchUsersQuery{Query: "", SignedInUser: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{
1: {accesscontrol.ActionUsersRead: {accesscontrol.ScopeGlobalUsersAll}},
@@ -193,7 +194,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
cmd := models.AddOrgUserCommand{
OrgId: ac1.OrgID,
UserId: ac2.ID,
Role: models.ROLE_VIEWER,
Role: org.RoleViewer,
}
err := sqlStore.AddOrgUser(context.Background(), &cmd)
@@ -202,13 +203,13 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
})
t.Run("Can update org user role", func(t *testing.T) {
updateCmd := models.UpdateOrgUserCommand{OrgId: ac1.OrgID, UserId: ac2.ID, Role: models.ROLE_ADMIN}
updateCmd := models.UpdateOrgUserCommand{OrgId: ac1.OrgID, UserId: ac2.ID, Role: org.RoleAdmin}
err = sqlStore.UpdateOrgUser(context.Background(), &updateCmd)
require.NoError(t, err)
orgUsersQuery := models.GetOrgUsersQuery{
OrgId: ac1.OrgID,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: ac1.OrgID,
Permissions: map[int64]map[string][]string{ac1.OrgID: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}}},
},
@@ -216,7 +217,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
err = sqlStore.GetOrgUsers(context.Background(), &orgUsersQuery)
require.NoError(t, err)
require.EqualValues(t, orgUsersQuery.Result[1].Role, models.ROLE_ADMIN)
require.EqualValues(t, orgUsersQuery.Result[1].Role, org.RoleAdmin)
})
t.Run("Can get logged in user projection", func(t *testing.T) {
@@ -244,7 +245,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
t.Run("Can get organization users", func(t *testing.T) {
query := models.GetOrgUsersQuery{
OrgId: ac1.OrgID,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: ac1.OrgID,
Permissions: map[int64]map[string][]string{ac1.OrgID: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}}},
},
@@ -260,7 +261,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
query := models.GetOrgUsersQuery{
OrgId: ac1.OrgID,
Query: "ac1",
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: ac1.OrgID,
Permissions: map[int64]map[string][]string{ac1.OrgID: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}}},
},
@@ -277,7 +278,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
OrgId: ac1.OrgID,
Query: "ac",
Limit: 1,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: ac1.OrgID,
Permissions: map[int64]map[string][]string{ac1.OrgID: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}}},
},
@@ -341,7 +342,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
})
t.Run("Cannot update role so no one is admin user", func(t *testing.T) {
cmd := models.UpdateOrgUserCommand{OrgId: ac1.OrgID, UserId: ac1.ID, Role: models.ROLE_VIEWER}
cmd := models.UpdateOrgUserCommand{OrgId: ac1.OrgID, UserId: ac1.ID, Role: org.RoleViewer}
err := sqlStore.UpdateOrgUser(context.Background(), &cmd)
require.Equal(t, err, models.ErrLastOrgAdmin)
})
@@ -354,7 +355,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
orgUserCmd := models.AddOrgUserCommand{
OrgId: ac1.OrgID,
UserId: ac3.ID,
Role: models.ROLE_VIEWER,
Role: org.RoleViewer,
}
err = sqlStore.AddOrgUser(context.Background(), &orgUserCmd)
@@ -362,7 +363,7 @@ func TestIntegrationAccountDataAccess(t *testing.T) {
query := models.GetOrgUsersQuery{
OrgId: ac1.OrgID,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: ac1.OrgID,
Permissions: map[int64]map[string][]string{ac1.OrgID: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}}},
},
pkg/services/sqlstore/org_users_test.go
+7 -7
View File
@@ -26,7 +26,7 @@ func TestSQLStore_GetOrgUsers(t *testing.T) {
desc: "should return all users",
query: &models.GetOrgUsersQuery{
OrgId: 1,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionOrgUsersRead: {ac.ScopeUsersAll}}},
},
@@ -37,7 +37,7 @@ func TestSQLStore_GetOrgUsers(t *testing.T) {
desc: "should return no users",
query: &models.GetOrgUsersQuery{
OrgId: 1,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionOrgUsersRead: {""}}},
},
@@ -48,7 +48,7 @@ func TestSQLStore_GetOrgUsers(t *testing.T) {
desc: "should return some users",
query: &models.GetOrgUsersQuery{
OrgId: 1,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionOrgUsersRead: {
"users:id:1",
@@ -95,7 +95,7 @@ func TestSQLStore_SearchOrgUsers(t *testing.T) {
desc: "should return all users",
query: &models.SearchOrgUsersQuery{
OrgID: 1,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionOrgUsersRead: {ac.ScopeUsersAll}}},
},
@@ -106,7 +106,7 @@ func TestSQLStore_SearchOrgUsers(t *testing.T) {
desc: "should return no users",
query: &models.SearchOrgUsersQuery{
OrgID: 1,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionOrgUsersRead: {""}}},
},
@@ -117,7 +117,7 @@ func TestSQLStore_SearchOrgUsers(t *testing.T) {
desc: "should return some users",
query: &models.SearchOrgUsersQuery{
OrgID: 1,
User: &models.SignedInUser{
User: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionOrgUsersRead: {
"users:id:1",
@@ -271,7 +271,7 @@ func seedOrgUsers(t *testing.T, store *SQLStore, numUsers int) {
}
}
func hasWildcardScope(user *models.SignedInUser, action string) bool {
func hasWildcardScope(user *user.SignedInUser, action string) bool {
for _, scope := range user.Permissions[user.OrgId][action] {
if strings.HasSuffix(scope, ":*") {
return true
pkg/services/sqlstore/permissions/dashboard.go
+8 -6
View File
@@ -6,12 +6,14 @@ import (
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
"github.com/grafana/grafana/pkg/services/user"
)
type DashboardPermissionFilter struct {
OrgRole models.RoleType
OrgRole org.RoleType
Dialect migrator.Dialect
UserId int64
OrgId int64
@@ -19,13 +21,13 @@ type DashboardPermissionFilter struct {
}
func (d DashboardPermissionFilter) Where() (string, []interface{}) {
if d.OrgRole == models.ROLE_ADMIN {
if d.OrgRole == org.RoleAdmin {
return "", nil
}
okRoles := []interface{}{d.OrgRole}
if d.OrgRole == models.ROLE_EDITOR {
okRoles = append(okRoles, models.ROLE_VIEWER)
if d.OrgRole == org.RoleEditor {
okRoles = append(okRoles, org.RoleViewer)
}
falseStr := d.Dialect.BooleanStr(false)
@@ -78,13 +80,13 @@ func (d DashboardPermissionFilter) Where() (string, []interface{}) {
}
type AccessControlDashboardPermissionFilter struct {
User *models.SignedInUser
User *user.SignedInUser
dashboardActions []string
folderActions []string
}
// NewAccessControlDashboardPermissionFilter creates a new AccessControlDashboardPermissionFilter that is configured with specific actions calculated based on the models.PermissionType and query type
func NewAccessControlDashboardPermissionFilter(user *models.SignedInUser, permissionLevel models.PermissionType, queryType string) AccessControlDashboardPermissionFilter {
func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissionLevel models.PermissionType, queryType string) AccessControlDashboardPermissionFilter {
needEdit := permissionLevel > models.PERMISSION_VIEW
folderActions := []string{dashboards.ActionFoldersRead}
var dashboardActions []string
pkg/services/sqlstore/permissions/dashboard_test.go
+3 -2
View File
@@ -11,6 +11,7 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/util"
)
@@ -89,7 +90,7 @@ func TestNewAccessControlDashboardPermissionFilter(t *testing.T) {
for _, testCase := range testCases {
t.Run(fmt.Sprintf("query type %s, permissions %s", testCase.queryType, testCase.permission), func(t *testing.T) {
filters := NewAccessControlDashboardPermissionFilter(&models.SignedInUser{}, testCase.permission, testCase.queryType)
filters := NewAccessControlDashboardPermissionFilter(&user.SignedInUser{}, testCase.permission, testCase.queryType)
require.Equal(t, testCase.expectedDashboardActions, filters.dashboardActions)
require.Equal(t, testCase.expectedFolderActions, filters.folderActions)
@@ -133,7 +134,7 @@ func TestAccessControlDashboardPermissionFilter_Where(t *testing.T) {
for _, testCase := range testCases {
t.Run(testCase.title, func(t *testing.T) {
filter := AccessControlDashboardPermissionFilter{
User: &models.SignedInUser{Permissions: map[int64]map[string][]string{}},
User: &user.SignedInUser{Permissions: map[int64]map[string][]string{}},
dashboardActions: testCase.dashboardActions,
folderActions: testCase.folderActions,
}
pkg/services/sqlstore/searchstore/search_test.go
+8 -6
View File
@@ -11,9 +11,11 @@ import (
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/util"
)
@@ -23,10 +25,10 @@ const (
)
func TestBuilder_EqualResults_Basic(t *testing.T) {
user := &models.SignedInUser{
user := &user.SignedInUser{
UserId: 1,
OrgId: 1,
OrgRole: models.ROLE_EDITOR,
OrgRole: org.RoleEditor,
}
db := setupTestEnvironment(t)
@@ -65,10 +67,10 @@ func TestBuilder_EqualResults_Basic(t *testing.T) {
}
func TestBuilder_Pagination(t *testing.T) {
user := &models.SignedInUser{
user := &user.SignedInUser{
UserId: 1,
OrgId: 1,
OrgRole: models.ROLE_VIEWER,
OrgRole: org.RoleViewer,
}
db := setupTestEnvironment(t)
@@ -111,10 +113,10 @@ func TestBuilder_Pagination(t *testing.T) {
}
func TestBuilder_Permissions(t *testing.T) {
user := &models.SignedInUser{
user := &user.SignedInUser{
UserId: 1,
OrgId: 1,
OrgRole: models.ROLE_VIEWER,
OrgRole: org.RoleViewer,
}
db := setupTestEnvironment(t)
pkg/services/sqlstore/sqlbuilder.go
+2 -1
View File
@@ -6,6 +6,7 @@ import (
"github.com/grafana/grafana/pkg/models"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/setting"
)
@@ -39,7 +40,7 @@ func (sb *SQLBuilder) AddParams(params ...interface{}) {
sb.params = append(sb.params, params...)
}
func (sb *SQLBuilder) WriteDashboardPermissionFilter(user *models.SignedInUser, permission models.PermissionType) {
func (sb *SQLBuilder) WriteDashboardPermissionFilter(user *user.SignedInUser, permission models.PermissionType) {
var (
sql string
params []interface{}
pkg/services/sqlstore/sqlbuilder_test.go
+18 -17
View File
@@ -9,6 +9,7 @@ import (
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -52,29 +53,29 @@ func TestIntegrationSQLBuilder(t *testing.T) {
t.Run("role ACL", func(t *testing.T) {
test(t,
DashboardProps{},
&DashboardPermission{Role: models.ROLE_VIEWER, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: models.ROLE_VIEWER, RequiredPermission: models.PERMISSION_VIEW},
&DashboardPermission{Role: org.RoleViewer, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: org.RoleViewer, RequiredPermission: models.PERMISSION_VIEW},
shouldFind,
)
test(t,
DashboardProps{},
&DashboardPermission{Role: models.ROLE_VIEWER, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: models.ROLE_VIEWER, RequiredPermission: models.PERMISSION_EDIT},
&DashboardPermission{Role: org.RoleViewer, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: org.RoleViewer, RequiredPermission: models.PERMISSION_EDIT},
shouldNotFind,
)
test(t,
DashboardProps{},
&DashboardPermission{Role: models.ROLE_EDITOR, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: models.ROLE_VIEWER, RequiredPermission: models.PERMISSION_VIEW},
&DashboardPermission{Role: org.RoleEditor, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: org.RoleViewer, RequiredPermission: models.PERMISSION_VIEW},
shouldNotFind,
)
test(t,
DashboardProps{},
&DashboardPermission{Role: models.ROLE_EDITOR, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: models.ROLE_VIEWER, RequiredPermission: models.PERMISSION_VIEW},
&DashboardPermission{Role: org.RoleEditor, Permission: models.PERMISSION_VIEW},
Search{UsersOrgRole: org.RoleViewer, RequiredPermission: models.PERMISSION_VIEW},
shouldNotFind,
)
})
@@ -113,28 +114,28 @@ func TestIntegrationSQLBuilder(t *testing.T) {
test(t,
DashboardProps{},
nil,
Search{OrgId: -1, UsersOrgRole: models.ROLE_VIEWER, RequiredPermission: models.PERMISSION_VIEW},
Search{OrgId: -1, UsersOrgRole: org.RoleViewer, RequiredPermission: models.PERMISSION_VIEW},
shouldNotFind,
)
test(t,
DashboardProps{OrgId: -1},
nil,
Search{OrgId: -1, UsersOrgRole: models.ROLE_VIEWER, RequiredPermission: models.PERMISSION_VIEW},
Search{OrgId: -1, UsersOrgRole: org.RoleViewer, RequiredPermission: models.PERMISSION_VIEW},
shouldFind,
)
test(t,
DashboardProps{OrgId: -1},
nil,
Search{OrgId: -1, UsersOrgRole: models.ROLE_EDITOR, RequiredPermission: models.PERMISSION_EDIT},
Search{OrgId: -1, UsersOrgRole: org.RoleEditor, RequiredPermission: models.PERMISSION_EDIT},
shouldFind,
)
test(t,
DashboardProps{OrgId: -1},
nil,
Search{OrgId: -1, UsersOrgRole: models.ROLE_VIEWER, RequiredPermission: models.PERMISSION_EDIT},
Search{OrgId: -1, UsersOrgRole: org.RoleViewer, RequiredPermission: models.PERMISSION_EDIT},
shouldNotFind,
)
})
@@ -151,12 +152,12 @@ type DashboardProps struct {
type DashboardPermission struct {
User bool
Team bool
Role models.RoleType
Role org.RoleType
Permission models.PermissionType
}
type Search struct {
UsersOrgRole models.RoleType
UsersOrgRole org.RoleType
UserFromACL bool
RequiredPermission models.PermissionType
OrgId int64
@@ -205,7 +206,7 @@ func createDummyUser(t *testing.T, sqlStore *SQLStore) *user.User {
EmailVerified: true,
IsAdmin: false,
SkipOrgSetup: false,
DefaultOrgRole: string(models.ROLE_VIEWER),
DefaultOrgRole: string(org.RoleViewer),
}
user, err := sqlStore.CreateUser(context.Background(), createUserCmd)
require.NoError(t, err)
@@ -306,7 +307,7 @@ func getDashboards(t *testing.T, sqlStore *SQLStore, search Search, aclUserID in
}()
builder := NewSqlBuilder(sqlStore.Cfg)
signedInUser := &models.SignedInUser{
signedInUser := &user.SignedInUser{
UserId: 9999999999,
}
@@ -319,7 +320,7 @@ func getDashboards(t *testing.T, sqlStore *SQLStore, search Search, aclUserID in
if len(string(search.UsersOrgRole)) > 0 {
signedInUser.OrgRole = search.UsersOrgRole
} else {
signedInUser.OrgRole = models.ROLE_VIEWER
signedInUser.OrgRole = org.RoleViewer
}
if search.UserFromACL {
signedInUser.UserId = aclUserID
pkg/services/sqlstore/stats.go
+8 -7
View File
@@ -6,6 +6,7 @@ import (
"time"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
)
@@ -147,7 +148,7 @@ func viewersPermissionsCounterSQL(statName string, isFolder bool, permission mod
FROM ` + dialect.Quote("dashboard_acl") + ` AS acl
INNER JOIN ` + dialect.Quote("dashboard") + ` AS d
ON d.id = acl.dashboard_id
WHERE acl.role = '` + string(models.ROLE_VIEWER) + `'
WHERE acl.role = '` + string(org.RoleViewer) + `'
AND d.is_folder = ` + dialect.BooleanStr(isFolder) + `
AND acl.permission = ` + strconv.FormatInt(int64(permission), 10) + `
) AS ` + statName + `, `
@@ -305,11 +306,11 @@ GROUP BY active, daily_active, role;`
memo := memoUserStats{memoized: time.Now()}
for _, role := range bitmap {
roletype := models.ROLE_VIEWER
roletype := org.RoleViewer
if role.Bitrole&0b100 != 0 {
roletype = models.ROLE_ADMIN
roletype = org.RoleAdmin
} else if role.Bitrole&0b10 != 0 {
roletype = models.ROLE_EDITOR
roletype = org.RoleEditor
}
memo.total = addToStats(memo.total, roletype, role.Count)
@@ -326,13 +327,13 @@ GROUP BY active, daily_active, role;`
})
}
func addToStats(base models.UserStats, role models.RoleType, count int64) models.UserStats {
func addToStats(base models.UserStats, role org.RoleType, count int64) models.UserStats {
base.Users += count
switch role {
case models.ROLE_ADMIN:
case org.RoleAdmin:
base.Admins += count
case models.ROLE_EDITOR:
case org.RoleEditor:
base.Editors += count
default:
base.Viewers += count
pkg/services/sqlstore/stats_test.go
+9 -8
View File
@@ -6,6 +6,7 @@ import (
"testing"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -82,22 +83,22 @@ func populateDB(t *testing.T, sqlStore *SQLStore) {
getOrgByIdQuery := &models.GetOrgByIdQuery{Id: users[0].OrgID}
err := sqlStore.GetOrgById(context.Background(), getOrgByIdQuery)
require.NoError(t, err)
org := getOrgByIdQuery.Result
orga := getOrgByIdQuery.Result
// add 2nd user as editor
cmd := &models.AddOrgUserCommand{
OrgId: org.Id,
OrgId: orga.Id,
UserId: users[1].ID,
Role: models.ROLE_EDITOR,
Role: org.RoleEditor,
}
err = sqlStore.AddOrgUser(context.Background(), cmd)
require.NoError(t, err)
// add 3rd user as viewer
cmd = &models.AddOrgUserCommand{
OrgId: org.Id,
OrgId: orga.Id,
UserId: users[2].ID,
Role: models.ROLE_VIEWER,
Role: org.RoleViewer,
}
err = sqlStore.AddOrgUser(context.Background(), cmd)
require.NoError(t, err)
@@ -106,13 +107,13 @@ func populateDB(t *testing.T, sqlStore *SQLStore) {
getOrgByIdQuery = &models.GetOrgByIdQuery{Id: users[1].OrgID}
err = sqlStore.GetOrgById(context.Background(), getOrgByIdQuery)
require.NoError(t, err)
org = getOrgByIdQuery.Result
orga = getOrgByIdQuery.Result
// add 1st user as admin
cmd = &models.AddOrgUserCommand{
OrgId: org.Id,
OrgId: orga.Id,
UserId: users[0].ID,
Role: models.ROLE_ADMIN,
Role: org.RoleAdmin,
}
err = sqlStore.AddOrgUser(context.Background(), cmd)
require.NoError(t, err)
pkg/services/sqlstore/team.go
+2 -1
View File
@@ -9,6 +9,7 @@ import (
"github.com/grafana/grafana/pkg/models"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/user"
)
type TeamStore interface {
@@ -22,7 +23,7 @@ type TeamStore interface {
GetUserTeamMemberships(ctx context.Context, orgID, userID int64, external bool) ([]*models.TeamMemberDTO, error)
}
func getFilteredUsers(signedInUser *models.SignedInUser, hiddenUsers map[string]struct{}) []string {
func getFilteredUsers(signedInUser *user.SignedInUser, hiddenUsers map[string]struct{}) []string {
filteredUsers := make([]string, 0, len(hiddenUsers))
if signedInUser == nil || signedInUser.IsGrafanaAdmin {
return filteredUsers
pkg/services/sqlstore/team_test.go
+11 -11
View File
@@ -20,7 +20,7 @@ func TestIntegrationTeamCommandsAndQueries(t *testing.T) {
}
t.Run("Testing Team commands & queries", func(t *testing.T) {
sqlStore := InitTestDB(t)
testUser := &models.SignedInUser{
testUser := &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{
1: {
@@ -226,7 +226,7 @@ func TestIntegrationTeamCommandsAndQueries(t *testing.T) {
query := &models.GetTeamsByUserQuery{
OrgId: testOrgID,
UserId: userIds[0],
SignedInUser: &models.SignedInUser{
SignedInUser: &user.SignedInUser{
OrgId: testOrgID,
Permissions: map[int64]map[string][]string{testOrgID: {ac.ActionOrgUsersRead: {ac.ScopeUsersAll}, ac.ActionTeamsRead: {ac.ScopeTeamsAll}}},
},
@@ -319,12 +319,12 @@ func TestIntegrationTeamCommandsAndQueries(t *testing.T) {
err = sqlStore.AddTeamMember(userIds[1], testOrgID, groupId, false, models.PERMISSION_ADMIN)
require.NoError(t, err)
query := &models.IsAdminOfTeamsQuery{SignedInUser: &models.SignedInUser{OrgId: testOrgID, UserId: userIds[0]}}
query := &models.IsAdminOfTeamsQuery{SignedInUser: &user.SignedInUser{OrgId: testOrgID, UserId: userIds[0]}}
err = sqlStore.IsAdminOfTeams(context.Background(), query)
require.NoError(t, err)
require.False(t, query.Result)
query = &models.IsAdminOfTeamsQuery{SignedInUser: &models.SignedInUser{OrgId: testOrgID, UserId: userIds[1]}}
query = &models.IsAdminOfTeamsQuery{SignedInUser: &user.SignedInUser{OrgId: testOrgID, UserId: userIds[1]}}
err = sqlStore.IsAdminOfTeams(context.Background(), query)
require.NoError(t, err)
require.True(t, query.Result)
@@ -333,7 +333,7 @@ func TestIntegrationTeamCommandsAndQueries(t *testing.T) {
t.Run("Should not return hidden users in team member count", func(t *testing.T) {
sqlStore = InitTestDB(t)
setup()
signedInUser := &models.SignedInUser{
signedInUser := &user.SignedInUser{
Login: "loginuser0",
OrgId: testOrgID,
Permissions: map[int64]map[string][]string{
@@ -423,7 +423,7 @@ func TestIntegrationSQLStore_SearchTeams(t *testing.T) {
desc: "should return all teams",
query: &models.SearchTeamsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{
SignedInUser: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionTeamsRead: {ac.ScopeTeamsAll}}},
},
@@ -434,7 +434,7 @@ func TestIntegrationSQLStore_SearchTeams(t *testing.T) {
desc: "should return no teams",
query: &models.SearchTeamsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{
SignedInUser: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionTeamsRead: {""}}},
},
@@ -445,7 +445,7 @@ func TestIntegrationSQLStore_SearchTeams(t *testing.T) {
desc: "should return some teams",
query: &models.SearchTeamsQuery{
OrgId: 1,
SignedInUser: &models.SignedInUser{
SignedInUser: &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {ac.ActionTeamsRead: {
"teams:id:1",
@@ -533,7 +533,7 @@ func TestIntegrationSQLStore_GetTeamMembers_ACFilter(t *testing.T) {
desc: "should return all team members",
query: &models.GetTeamMembersQuery{
OrgId: testOrgID,
SignedInUser: &models.SignedInUser{
SignedInUser: &user.SignedInUser{
OrgId: testOrgID,
Permissions: map[int64]map[string][]string{testOrgID: {ac.ActionOrgUsersRead: {ac.ScopeUsersAll}}},
},
@@ -544,7 +544,7 @@ func TestIntegrationSQLStore_GetTeamMembers_ACFilter(t *testing.T) {
desc: "should return no team members",
query: &models.GetTeamMembersQuery{
OrgId: testOrgID,
SignedInUser: &models.SignedInUser{
SignedInUser: &user.SignedInUser{
OrgId: testOrgID,
Permissions: map[int64]map[string][]string{testOrgID: {ac.ActionOrgUsersRead: {""}}},
},
@@ -556,7 +556,7 @@ func TestIntegrationSQLStore_GetTeamMembers_ACFilter(t *testing.T) {
desc: "should return some team members",
query: &models.GetTeamMembersQuery{
OrgId: testOrgID,
SignedInUser: &models.SignedInUser{
SignedInUser: &user.SignedInUser{
OrgId: testOrgID,
Permissions: map[int64]map[string][]string{testOrgID: {ac.ActionOrgUsersRead: {
ac.Scope("users", "id", fmt.Sprintf("%d", userIds[0])),
pkg/services/sqlstore/user.go
+8 -7
View File
@@ -11,6 +11,7 @@ import (
"github.com/grafana/grafana/pkg/events"
"github.com/grafana/grafana/pkg/models"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/util"
)
@@ -157,16 +158,16 @@ func (ss *SQLStore) createUser(ctx context.Context, sess *DBSession, args user.C
orgUser := models.OrgUser{
OrgId: orgID,
UserId: usr.ID,
Role: models.ROLE_ADMIN,
Role: org.RoleAdmin,
Created: time.Now(),
Updated: time.Now(),
}
if ss.Cfg.AutoAssignOrg && !usr.IsAdmin {
if len(args.DefaultOrgRole) > 0 {
orgUser.Role = models.RoleType(args.DefaultOrgRole)
orgUser.Role = org.RoleType(args.DefaultOrgRole)
} else {
orgUser.Role = models.RoleType(ss.Cfg.AutoAssignOrgRole)
orgUser.Role = org.RoleType(ss.Cfg.AutoAssignOrgRole)
}
}
@@ -475,7 +476,7 @@ func newSignedInUserCacheKey(orgID, userID int64) string {
func (ss *SQLStore) GetSignedInUserWithCacheCtx(ctx context.Context, query *models.GetSignedInUserQuery) error {
cacheKey := newSignedInUserCacheKey(query.OrgId, query.UserId)
if cached, found := ss.CacheService.Get(cacheKey); found {
cachedUser := cached.(models.SignedInUser)
cachedUser := cached.(user.SignedInUser)
query.Result = &cachedUser
return nil
}
@@ -536,7 +537,7 @@ func (ss *SQLStore) GetSignedInUser(ctx context.Context, query *models.GetSigned
}
}
var usr models.SignedInUser
var usr user.SignedInUser
has, err := sess.Get(&usr)
if err != nil {
return err
@@ -554,7 +555,7 @@ func (ss *SQLStore) GetSignedInUser(ctx context.Context, query *models.GetSigned
}
// tempUser is used to retrieve the teams for the signed in user for internal use.
tempUser := &models.SignedInUser{
tempUser := &user.SignedInUser{
OrgId: usr.OrgId,
Permissions: map[int64]map[string][]string{
usr.OrgId: {
@@ -847,7 +848,7 @@ func (ss *SQLStore) SetUserHelpFlag(ctx context.Context, cmd *models.SetUserHelp
return ss.WithTransactionalDbSession(ctx, func(sess *DBSession) error {
user := user.User{
ID: cmd.UserId,
HelpFlags1: user.HelpFlags1(cmd.HelpFlags1),
HelpFlags1: cmd.HelpFlags1,
Updated: time.Now(),
}
pkg/services/sqlstore/user_test.go
+5 -4
View File
@@ -6,6 +6,7 @@ import (
"testing"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/assert"
@@ -84,7 +85,7 @@ func TestIntegrationUserDataAccess(t *testing.T) {
t.Skip("skipping integration test")
}
ss := InitTestDB(t)
usr := &models.SignedInUser{
usr := &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {"users:read": {"global.users:*"}}},
}
@@ -352,7 +353,7 @@ func TestIntegrationUserDataAccess(t *testing.T) {
})
err = ss.AddOrgUser(context.Background(), &models.AddOrgUserCommand{
LoginOrEmail: users[1].Login, Role: models.ROLE_VIEWER,
LoginOrEmail: users[1].Login, Role: org.RoleViewer,
OrgId: users[0].OrgID, UserId: users[1].ID,
})
require.Nil(t, err)
@@ -391,7 +392,7 @@ func TestIntegrationUserDataAccess(t *testing.T) {
}
})
err = ss.AddOrgUser(context.Background(), &models.AddOrgUserCommand{
LoginOrEmail: users[1].Login, Role: models.ROLE_VIEWER,
LoginOrEmail: users[1].Login, Role: org.RoleViewer,
OrgId: users[0].OrgID, UserId: users[1].ID,
})
require.Nil(t, err)
@@ -464,7 +465,7 @@ func TestIntegrationUserDataAccess(t *testing.T) {
}
})
testUser := &models.SignedInUser{
testUser := &user.SignedInUser{
OrgId: 1,
Permissions: map[int64]map[string][]string{1: {"users:read": {"global.users:id:1", "global.users:id:3"}}},
}