IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

APIKeys: Add AC controls for legacy API keys (#46255)

Browse Source 
* APIKeys: Add AC controls for legacy API keys

* pluralize actions
This commit is contained in:
J Guerreiro 2022-03-04 18:01:03 +00:00 committed by GitHub
parent b47f5433d7
commit 7f1e8cee2b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 36 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
pkg/api/accesscontrol.go
View File

@ -161,6 +161,30 @@ func (hs *HTTPServer) declareFixedRoles() error {
Grants: []string{string(models.ROLE_VIEWER)}, Grants: []string{string(models.ROLE_VIEWER)},
} }
apikeyWriterRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Version: 1,
Name: "fixed:apikeys:writer",
DisplayName: "APIKeys writer",
Description: "Gives access to add and delete api keys.",
Group: "API Keys",
Permissions: []ac.Permission{
{
Action: ac.ActionAPIKeyCreate,
},
{
Action: ac.ActionAPIKeyRead,
Scope: ac.ScopeAPIKeysAll,
},
{
Action: ac.ActionAPIKeyDelete,
Scope: ac.ScopeAPIKeysAll,
},
},
},
Grants: []string{"Admin"},
}
orgReaderRole := ac.RoleRegistration{ orgReaderRole := ac.RoleRegistration{
Role: ac.RoleDTO{ Role: ac.RoleDTO{
Version: 5, Version: 5,
@ -366,7 +390,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
datasourcesCompatibilityReaderRole, orgReaderRole, orgWriterRole, datasourcesCompatibilityReaderRole, orgReaderRole, orgWriterRole,
orgMaintainerRole, teamsCreatorRole, teamsWriterRole, datasourcesExplorerRole, annotationsReaderRole, orgMaintainerRole, teamsCreatorRole, teamsWriterRole, datasourcesExplorerRole, annotationsReaderRole,
dashboardsCreatorRole, dashboardsReaderRole, dashboardsWriterRole, dashboardsCreatorRole, dashboardsReaderRole, dashboardsWriterRole,
foldersCreatorRole, foldersReaderRole, foldersWriterRole, foldersCreatorRole, foldersReaderRole, foldersWriterRole, apikeyWriterRole,
) )
} }

7
pkg/api/api.go
View File

@ -260,9 +260,10 @@ func (hs *HTTPServer) registerRoutes() {
// auth api keys // auth api keys
apiRoute.Group("/auth/keys", func(keysRoute routing.RouteRegister) { apiRoute.Group("/auth/keys", func(keysRoute routing.RouteRegister) {
keysRoute.Get("/", routing.Wrap(hs.GetAPIKeys)) apikeyIDScope := ac.Scope("apikeys", "id", ac.Parameter(":id"))
keysRoute.Post("/", quota("api_key"), routing.Wrap(hs.AddAPIKey)) keysRoute.Get("/", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyRead, ac.ScopeAPIKeysAll)), routing.Wrap(hs.GetAPIKeys))
keysRoute.Delete("/:id", routing.Wrap(hs.DeleteAPIKey)) keysRoute.Post("/", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyCreate)), quota("api_key"), routing.Wrap(hs.AddAPIKey))
keysRoute.Delete("/:id", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyDelete, apikeyIDScope)), routing.Wrap(hs.DeleteAPIKey))
}, reqOrgAdmin) }, reqOrgAdmin)
// Preferences // Preferences

7
pkg/services/accesscontrol/models.go
View File

@ -250,6 +250,10 @@ const (
GlobalOrgID = 0 GlobalOrgID = 0
// Permission actions // Permission actions
ActionAPIKeyRead = "apikeys:read"
ActionAPIKeyCreate = "apikeys:create"
ActionAPIKeyDelete = "apikeys:delete"
// Users actions // Users actions
ActionUsersRead = "users:read" ActionUsersRead = "users:read"
ActionUsersWrite = "users:write" ActionUsersWrite = "users:write"
@ -299,6 +303,9 @@ const (
// Global Scopes // Global Scopes
ScopeGlobalUsersAll = "global:users:*" ScopeGlobalUsersAll = "global:users:*"
// APIKeys scope
ScopeAPIKeysAll = "apikeys:*"
// Users scope // Users scope
ScopeUsersAll = "users:*" ScopeUsersAll = "users:*"