IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-01-01 11:47:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

Access control: further reduce access control feature toggle checks (#48171)

Browse Source 
* reduce the usage of access control flag further by removing it from SQL store methods

* fixing tests

* fix another test

* linting

* remove AC feature toggle use from API keys

* remove unneeded function
This commit is contained in:
Ieva 2022-05-05 16:31:14 +01:00 committed by GitHub
parent fca52a1c83
commit a5672758d8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
16 changed files with 61 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
pkg/api/common_test.go
View File

@ -227,15 +227,13 @@ func (s *fakeRenderService) Init() error {
}
func setupAccessControlScenarioContext(t *testing.T, cfg *setting.Cfg, url string, permissions []*accesscontrol.Permission) (*scenarioContext, *HTTPServer) {
features := featuremgmt.WithFeatures(featuremgmt.FlagAccesscontrol)
cfg.IsFeatureToggleEnabled = features.IsEnabled
cfg.Quota.Enabled = false
store := sqlstore.InitTestDB(t)
hs := &HTTPServer{
Cfg: cfg,
Live: newTestLive(t, store),
Features: features,
Features: featuremgmt.WithFeatures(),
QuotaService: &quota.QuotaService{Cfg: cfg},
RouteRegister: routing.NewRouteRegister(),
AccessControl: accesscontrolmock.New().WithPermissions(permissions),
@ -329,39 +327,32 @@ func setupSimpleHTTPServer(features *featuremgmt.FeatureManager) *HTTPServer {
}
func setupHTTPServer(t *testing.T, useFakeAccessControl bool, enableAccessControl bool) accessControlScenarioContext {
// Use a new conf
features := featuremgmt.WithFeatures("accesscontrol", enableAccessControl)
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = features.IsEnabled
return setupHTTPServerWithCfg(t, useFakeAccessControl, enableAccessControl, cfg)
return setupHTTPServerWithCfg(t, useFakeAccessControl, enableAccessControl, setting.NewCfg())
}
func setupHTTPServerWithMockDb(t *testing.T, useFakeAccessControl bool, enableAccessControl bool) accessControlScenarioContext {
// Use a new conf
features := featuremgmt.WithFeatures("accesscontrol", enableAccessControl)
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = features.IsEnabled
db := sqlstore.InitTestDB(t)
db.Cfg = cfg
db.Cfg = setting.NewCfg()
return setupHTTPServerWithCfgDb(t, useFakeAccessControl, enableAccessControl, cfg, db, mockstore.NewSQLStoreMock())
}
func setupHTTPServerWithCfg(t *testing.T, useFakeAccessControl, enableAccessControl bool, cfg *setting.Cfg) accessControlScenarioContext {
var featureFlags []string
if enableAccessControl {
featureFlags = append(featureFlags, featuremgmt.FlagAccesscontrol)
var db *sqlstore.SQLStore
if useFakeAccessControl && enableAccessControl {
db = sqlstore.InitTestDB(t, sqlstore.InitTestDBOpt{FeatureFlags: []string{featuremgmt.FlagAccesscontrol}})
} else {
db = sqlstore.InitTestDB(t, sqlstore.InitTestDBOpt{})
}
db := sqlstore.InitTestDB(t, sqlstore.InitTestDBOpt{FeatureFlags: featureFlags})
return setupHTTPServerWithCfgDb(t, useFakeAccessControl, enableAccessControl, cfg, db, db)
}
func setupHTTPServerWithCfgDb(t *testing.T, useFakeAccessControl, enableAccessControl bool, cfg *setting.Cfg, db *sqlstore.SQLStore, store sqlstore.Store) accessControlScenarioContext {
t.Helper()
features := featuremgmt.WithFeatures("accesscontrol", enableAccessControl)
features := featuremgmt.WithFeatures(featuremgmt.FlagAccesscontrol, enableAccessControl)
cfg.IsFeatureToggleEnabled = features.IsEnabled
var acmock *accesscontrolmock.Mock

6
pkg/services/accesscontrol/accesscontrol.go
View File

@ -7,6 +7,8 @@ import (
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/registry"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/setting"
)
type Options struct {
@ -222,3 +224,7 @@ func extractPrefixes(prefix string) (string, string, bool) {
attributePrefix := rootPrefix + parts[1] + ":"
return rootPrefix, attributePrefix, true
}
func IsDisabled(cfg *setting.Cfg) bool {
return !cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol)
}

2
pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go
View File

@ -155,7 +155,7 @@ func (ac *OSSAccessControlService) GetUserBuiltInRoles(user *models.SignedInUser
builtInRoles := []string{string(user.OrgRole)}
// With built-in role simplifying, inheritance is performed upon role registration.
if !ac.features.IsEnabled(featuremgmt.FlagAccesscontrolBuiltins) {
if ac.IsDisabled() {
for _, br := range user.OrgRole.Children() {
builtInRoles = append(builtInRoles, string(br))
}

2
pkg/services/dashboards/manager/dashboard_service.go
View File

@ -447,7 +447,7 @@ func (dr *DashboardServiceImpl) GetDashboardsByPluginID(ctx context.Context, que
func (dr *DashboardServiceImpl) setDefaultPermissions(ctx context.Context, dto *m.SaveDashboardDTO, dash *models.Dashboard, provisioned bool) error {
inFolder := dash.FolderId > 0
if dr.features.IsEnabled(featuremgmt.FlagAccesscontrol) {
if !accesscontrol.IsDisabled(dr.cfg) {
var permissions []accesscontrol.SetResourcePermissionCommand
if !provisioned {
permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{

16
pkg/services/dashboards/manager/dashboard_service_integration_test.go
View File

@ -858,8 +858,10 @@ func callSaveWithResult(t *testing.T, cmd models.SaveDashboardCommand, sqlStore
dto := toSaveDashboardDto(cmd)
dashboardStore := database.ProvideDashboardStore(sqlStore)
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = featuremgmt.WithFeatures().IsEnabled
service := ProvideDashboardService(
setting.NewCfg(), dashboardStore, &dummyDashAlertExtractor{},
cfg, dashboardStore, &dummyDashAlertExtractor{},
featuremgmt.WithFeatures(), accesscontrolmock.NewPermissionsServicesMock(),
)
res, err := service.SaveDashboard(context.Background(), &dto, false)
@ -871,8 +873,10 @@ func callSaveWithResult(t *testing.T, cmd models.SaveDashboardCommand, sqlStore
func callSaveWithError(cmd models.SaveDashboardCommand, sqlStore *sqlstore.SQLStore) error {
dto := toSaveDashboardDto(cmd)
dashboardStore := database.ProvideDashboardStore(sqlStore)
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = featuremgmt.WithFeatures().IsEnabled
service := ProvideDashboardService(
setting.NewCfg(), dashboardStore, &dummyDashAlertExtractor{},
cfg, dashboardStore, &dummyDashAlertExtractor{},
featuremgmt.WithFeatures(), accesscontrolmock.NewPermissionsServicesMock(),
)
_, err := service.SaveDashboard(context.Background(), &dto, false)
@ -902,8 +906,10 @@ func saveTestDashboard(t *testing.T, title string, orgID, folderID int64, sqlSto
}
dashboardStore := database.ProvideDashboardStore(sqlStore)
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = featuremgmt.WithFeatures().IsEnabled
service := ProvideDashboardService(
setting.NewCfg(), dashboardStore, &dummyDashAlertExtractor{},
cfg, dashboardStore, &dummyDashAlertExtractor{},
featuremgmt.WithFeatures(), accesscontrolmock.NewPermissionsServicesMock(),
)
res, err := service.SaveDashboard(context.Background(), &dto, false)
@ -934,8 +940,10 @@ func saveTestFolder(t *testing.T, title string, orgID int64, sqlStore *sqlstore.
}
dashboardStore := database.ProvideDashboardStore(sqlStore)
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = featuremgmt.WithFeatures().IsEnabled
service := ProvideDashboardService(
setting.NewCfg(), dashboardStore, &dummyDashAlertExtractor{},
cfg, dashboardStore, &dummyDashAlertExtractor{},
featuremgmt.WithFeatures(), accesscontrolmock.NewPermissionsServicesMock(),
)
res, err := service.SaveDashboard(context.Background(), &dto, false)

2
pkg/services/dashboards/manager/folder_service.go
View File

@ -171,7 +171,7 @@ func (f *FolderServiceImpl) CreateFolder(ctx context.Context, user *models.Signe
}
var permissionErr error
if f.features.IsEnabled(featuremgmt.FlagAccesscontrol) {
if !accesscontrol.IsDisabled(f.cfg) {
_, permissionErr = f.permissions.SetPermissions(ctx, orgID, folder.Uid, []accesscontrol.SetResourcePermissionCommand{
{UserID: userID, Permission: models.PERMISSION_ADMIN.String()},
{BuiltinRole: string(models.ROLE_EDITOR), Permission: models.PERMISSION_EDIT.String()},

2
pkg/services/dashboards/manager/folder_service_test.go
View File

@ -31,6 +31,7 @@ func TestProvideFolderService(t *testing.T) {
store := &dashboards.FakeDashboardStore{}
cfg := setting.NewCfg()
features := featuremgmt.WithFeatures()
cfg.IsFeatureToggleEnabled = features.IsEnabled
permissionsServices := acmock.NewPermissionsServicesMock()
dashboardService := ProvideDashboardService(cfg, store, nil, features, permissionsServices)
ac := acmock.New()
@ -49,6 +50,7 @@ func TestFolderService(t *testing.T) {
store := &dashboards.FakeDashboardStore{}
cfg := setting.NewCfg()
features := featuremgmt.WithFeatures()
cfg.IsFeatureToggleEnabled = features.IsEnabled
permissionsServices := acmock.NewPermissionsServicesMock()
dashboardService := ProvideDashboardService(cfg, store, nil, features, permissionsServices)
mockStore := mockstore.NewSQLStoreMock()

21
pkg/services/libraryelements/libraryelements_test.go
View File

@ -202,9 +202,12 @@ func createDashboard(t *testing.T, sqlStore *sqlstore.SQLStore, user models.Sign
dashboardStore := database.ProvideDashboardStore(sqlStore)
dashAlertExtractor := alerting.ProvideDashAlertExtractorService(nil, nil, nil)
features := featuremgmt.WithFeatures()
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = features.IsEnabled
service := dashboardservice.ProvideDashboardService(
setting.NewCfg(), dashboardStore, dashAlertExtractor,
featuremgmt.WithFeatures(), acmock.NewPermissionsServicesMock(),
cfg, dashboardStore, dashAlertExtractor,
features, acmock.NewPermissionsServicesMock(),
)
dashboard, err := service.SaveDashboard(context.Background(), dashItem, true)
require.NoError(t, err)
@ -218,6 +221,7 @@ func createFolderWithACL(t *testing.T, sqlStore *sqlstore.SQLStore, title string
cfg := setting.NewCfg()
features := featuremgmt.WithFeatures()
cfg.IsFeatureToggleEnabled = features.IsEnabled
permissionsServices := acmock.NewPermissionsServicesMock()
dashboardStore := database.ProvideDashboardStore(sqlStore)
@ -317,17 +321,20 @@ func testScenario(t *testing.T, desc string, fn func(t *testing.T, sc scenarioCo
sqlStore := sqlstore.InitTestDB(t)
guardian.InitLegacyGuardian(sqlStore)
dashboardStore := database.ProvideDashboardStore(sqlStore)
features := featuremgmt.WithFeatures()
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = features.IsEnabled
dashboardService := dashboardservice.ProvideDashboardService(
setting.NewCfg(), dashboardStore, nil,
featuremgmt.WithFeatures(), acmock.NewPermissionsServicesMock(),
cfg, dashboardStore, nil,
features, acmock.NewPermissionsServicesMock(),
)
ac := acmock.New()
service := LibraryElementService{
Cfg: setting.NewCfg(),
Cfg: cfg,
SQLStore: sqlStore,
folderService: dashboardservice.ProvideFolderService(
setting.NewCfg(), dashboardService, dashboardStore, nil,
featuremgmt.WithFeatures(), acmock.NewPermissionsServicesMock(), ac, nil,
cfg, dashboardService, dashboardStore, nil,
features, acmock.NewPermissionsServicesMock(), ac, nil,
),
}

5
pkg/services/librarypanels/librarypanels_test.go
View File

@ -1368,8 +1368,10 @@ func createDashboard(t *testing.T, sqlStore *sqlstore.SQLStore, user *models.Sig
dashboardStore := database.ProvideDashboardStore(sqlStore)
dashAlertService := alerting.ProvideDashAlertExtractorService(nil, nil, nil)
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = featuremgmt.WithFeatures().IsEnabled
service := dashboardservice.ProvideDashboardService(
setting.NewCfg(), dashboardStore, dashAlertService,
cfg, dashboardStore, dashAlertService,
featuremgmt.WithFeatures(), acmock.NewPermissionsServicesMock(),
)
dashboard, err := service.SaveDashboard(context.Background(), dashItem, true)
@ -1383,6 +1385,7 @@ func createFolderWithACL(t *testing.T, sqlStore *sqlstore.SQLStore, title string
t.Helper()
cfg := setting.NewCfg()
cfg.IsFeatureToggleEnabled = featuremgmt.WithFeatures().IsEnabled
features := featuremgmt.WithFeatures()
permissionsServices := acmock.NewPermissionsServicesMock()
dashboardStore := database.ProvideDashboardStore(sqlStore)

3
pkg/services/serviceaccounts/database/database.go
View File

@ -11,7 +11,6 @@ import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/serviceaccounts"
"github.com/grafana/grafana/pkg/services/sqlstore"
"xorm.io/xorm"
@ -354,7 +353,7 @@ func (s *ServiceAccountsStoreImpl) SearchOrgServiceAccounts(
s.sqlStore.Dialect.Quote("user"),
s.sqlStore.Dialect.BooleanStr(true)))
if s.sqlStore.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !accesscontrol.IsDisabled(s.sqlStore.Cfg) {
acFilter, err := accesscontrol.Filter(signedInUser, "org_user.user_id", "serviceaccounts:id:", serviceaccounts.ActionRead)
if err != nil {
return err

3
pkg/services/sqlstore/annotation.go
View File

@ -11,7 +11,6 @@ import (
"github.com/grafana/grafana/pkg/models"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/annotations"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
)
@ -229,7 +228,7 @@ func (r *SQLAnnotationRepo) Find(ctx context.Context, query *annotations.ItemQue
}
}
if r.sql.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !ac.IsDisabled(r.sql.Cfg) {
acFilter, acArgs, err := getAccessControlFilter(query.SignedInUser)
if err != nil {
return err

5
pkg/services/sqlstore/annotation_test.go
View File

@ -339,10 +339,7 @@ func TestAnnotations(t *testing.T) {
}
func TestAnnotationListingWithRBAC(t *testing.T) {
sql := sqlstore.InitTestDB(t)
sql.Cfg.IsFeatureToggleEnabled = func(key string) bool {
return key == featuremgmt.FlagAccesscontrol
}
sql := sqlstore.InitTestDB(t, sqlstore.InitTestDBOpt{FeatureFlags: []string{featuremgmt.FlagAccesscontrol}})
repo := sqlstore.NewSQLAnnotationRepo(sql)
dashboardStore := dashboardstore.ProvideDashboardStore(sql)

3
pkg/services/sqlstore/apikey.go
View File

@ -8,7 +8,6 @@ import (
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/featuremgmt"
)
// GetAPIKeys queries the database based
@ -29,7 +28,7 @@ func (ss *SQLStore) GetAPIKeys(ctx context.Context, query *models.GetApiKeysQuer
sess = sess.Where("service_account_id IS NULL")
if ss.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !accesscontrol.IsDisabled(ss.Cfg) {
filter, err := accesscontrol.Filter(query.User, "id", "apikeys:id:", accesscontrol.ActionAPIKeyRead)
if err != nil {
return err

4
pkg/services/sqlstore/dashboard.go
View File

@ -7,7 +7,7 @@ import (
"github.com/prometheus/client_golang/prometheus"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
"github.com/grafana/grafana/pkg/util"
@ -74,7 +74,7 @@ func (ss *SQLStore) FindDashboards(ctx context.Context, query *models.FindPersis
},
}
if ss.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !accesscontrol.IsDisabled(ss.Cfg) {
// if access control is enabled, overwrite the filters so far
filters = []interface{}{
permissions.NewAccessControlDashboardPermissionFilter(query.SignedInUser, query.Permission, query.Type),

5
pkg/services/sqlstore/org_users.go
View File

@ -8,7 +8,6 @@ import (
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/util"
)
@ -110,7 +109,7 @@ func (ss *SQLStore) GetOrgUsers(ctx context.Context, query *models.GetOrgUsersQu
whereConditions = append(whereConditions, fmt.Sprintf("%s.is_service_account = ?", ss.Dialect.Quote("user")))
whereParams = append(whereParams, ss.Dialect.BooleanStr(false))
if ss.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) && query.User != nil {
if !accesscontrol.IsDisabled(ss.Cfg) && query.User != nil {
acFilter, err := accesscontrol.Filter(query.User, "org_user.user_id", "users:id:", accesscontrol.ActionOrgUsersRead)
if err != nil {
return err
@ -175,7 +174,7 @@ func (ss *SQLStore) SearchOrgUsers(ctx context.Context, query *models.SearchOrgU
whereConditions = append(whereConditions, fmt.Sprintf("%s.is_service_account = %s", ss.Dialect.Quote("user"), ss.Dialect.BooleanStr(false)))
if ss.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !accesscontrol.IsDisabled(ss.Cfg) {
acFilter, err := accesscontrol.Filter(query.User, "org_user.user_id", "users:id:", accesscontrol.ActionOrgUsersRead)
if err != nil {
return err

7
pkg/services/sqlstore/team.go
View File

@ -9,7 +9,6 @@ import (
"github.com/grafana/grafana/pkg/models"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/featuremgmt"
)
type TeamStore interface {
@ -214,7 +213,7 @@ func (ss *SQLStore) SearchTeams(ctx context.Context, query *models.SearchTeamsQu
acFilter ac.SQLFilter
err error
)
if ss.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !ac.IsDisabled(ss.Cfg) {
acFilter, err = ac.Filter(query.SignedInUser, "team.id", "teams:id:", ac.ActionTeamsRead)
if err != nil {
return err
@ -259,7 +258,7 @@ func (ss *SQLStore) SearchTeams(ctx context.Context, query *models.SearchTeamsQu
}
// Only count teams user can see
if ss.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !ac.IsDisabled(ss.Cfg) {
countSess.Where(acFilter.Where, acFilter.Args...)
}
@ -516,7 +515,7 @@ func (ss *SQLStore) GetTeamMembers(ctx context.Context, query *models.GetTeamMem
// With accesscontrol we filter out users based on the SignedInUser's permissions
// Note we assume that checking SignedInUser is allowed to see team members for this team has already been performed
// If the signed in user is not set no member will be returned
if ss.Cfg.IsFeatureToggleEnabled(featuremgmt.FlagAccesscontrol) {
if !ac.IsDisabled(ss.Cfg) {
sqlID := fmt.Sprintf("%s.%s", ss.engine.Dialect().Quote("user"), ss.engine.Dialect().Quote("id"))
*acFilter, err = ac.Filter(query.SignedInUser, sqlID, "users:id:", ac.ActionOrgUsersRead)
if err != nil {