IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-26 21:37:31 -05:00
Code Issues Packages Projects Releases Wiki Activity

RBAC: Add permission registry (#91247)

Browse Source 
* RBAC: Permission registry

* Populate permission registry

* Wire

* conflic_user_cmd

* Update pkg/services/accesscontrol/permreg/permreg_test.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* PR feedback

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Remove ToDo, tackle in subsequent PR

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
This commit is contained in:
Gabriel MABILLE
2024-08-02 09:32:06 +02:00
committed by GitHub
co-authored by Ieva
parent 391284bb33
commit 8988e04044
9 changed files with 478 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/acimpl/service.go
+16 -3
View File
@@ -24,6 +24,7 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol/api"
"github.com/grafana/grafana/pkg/services/accesscontrol/database"
"github.com/grafana/grafana/pkg/services/accesscontrol/migrator"
"github.com/grafana/grafana/pkg/services/accesscontrol/permreg"
"github.com/grafana/grafana/pkg/services/accesscontrol/pluginutils"
"github.com/grafana/grafana/pkg/services/authz/zanzana"
"github.com/grafana/grafana/pkg/services/dashboards"
@@ -50,9 +51,9 @@ var OSSRolesPrefixes = []string{accesscontrol.ManagedRolePrefix, accesscontrol.E
func ProvideService(
cfg *setting.Cfg, db db.ReplDB, routeRegister routing.RouteRegister, cache *localcache.CacheService,
accessControl accesscontrol.AccessControl, actionResolver accesscontrol.ActionResolver,
features featuremgmt.FeatureToggles, tracer tracing.Tracer, zclient zanzana.Client,
features featuremgmt.FeatureToggles, tracer tracing.Tracer, zclient zanzana.Client, permRegistry permreg.PermissionRegistry,
) (*Service, error) {
service := ProvideOSSService(cfg, database.ProvideService(db), actionResolver, cache, features, tracer, zclient, db.DB())
service := ProvideOSSService(cfg, database.ProvideService(db), actionResolver, cache, features, tracer, zclient, db.DB(), permRegistry)
api.NewAccessControlAPI(routeRegister, accessControl, service, features).RegisterAPIEndpoints()
if err := accesscontrol.DeclareFixedRoles(service, cfg); err != nil {
@@ -73,7 +74,7 @@ func ProvideService(
func ProvideOSSService(
cfg *setting.Cfg, store accesscontrol.Store, actionResolver accesscontrol.ActionResolver,
cache *localcache.CacheService, features featuremgmt.FeatureToggles, tracer tracing.Tracer,
zclient zanzana.Client, db db.DB,
zclient zanzana.Client, db db.DB, permRegistry permreg.PermissionRegistry,
) *Service {
s := &Service{
actionResolver: actionResolver,
@@ -85,6 +86,7 @@ func ProvideOSSService(
store: store,
tracer: tracer,
sync: migrator.NewZanzanaSynchroniser(zclient, db),
permRegistry: permRegistry,
}
return s
@@ -102,6 +104,7 @@ type Service struct {
store accesscontrol.Store
tracer tracing.Tracer
sync *migrator.ZanzanaSynchroniser
permRegistry permreg.PermissionRegistry
}
func (s *Service) GetUsageStats(_ context.Context) map[string]any {
@@ -406,6 +409,10 @@ func (s *Service) DeclareFixedRoles(registrations ...accesscontrol.RoleRegistrat
return err
}
for i := range r.Role.Permissions {
s.permRegistry.RegisterPermission(r.Role.Permissions[i].Action, r.Role.Permissions[i].Scope)
}
s.registrations.Append(r)
}
@@ -458,6 +465,12 @@ func (s *Service) DeclarePluginRoles(ctx context.Context, ID, name string, regs
return err
}
for i := range r.Role.Permissions {
// Register plugin actions and their possible scopes for permission validation
s.permRegistry.RegisterPluginScope(r.Role.Permissions[i].Scope)
s.permRegistry.RegisterPermission(r.Role.Permissions[i].Action, r.Role.Permissions[i].Scope)
}
s.log.Debug("Registering plugin role", "role", r.Role.Name)
s.registrations.Append(r)
}
pkg/services/accesscontrol/acimpl/service_test.go
+3
View File
@@ -17,6 +17,7 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
"github.com/grafana/grafana/pkg/services/accesscontrol/database"
"github.com/grafana/grafana/pkg/services/accesscontrol/permreg"
"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/licensing"
@@ -42,6 +43,7 @@ func setupTestEnv(t testing.TB) *Service {
roles: accesscontrol.BuildBasicRoleDefinitions(),
tracer: tracing.InitializeTracerForTest(),
store: database.ProvideService(db.InitTestReplDB(t)),
permRegistry: permreg.ProvidePermissionRegistry(),
}
require.NoError(t, ac.RegisterFixedRoles(context.Background()))
return ac
@@ -71,6 +73,7 @@ func TestUsageMetrics(t *testing.T) {
tracing.InitializeTracerForTest(),
nil,
nil,
permreg.ProvidePermissionRegistry(),
)
assert.Equal(t, tt.expectedValue, s.GetUsageStats(context.Background())["stats.oss.accesscontrol.enabled.count"])
})