K8s/Folders: Add all features to k8s endpoints (#81858)

pkg/registry/apis/folders/conversions.go

@@ -42,7 +42,9 @@ func convertToK8sResource(v *folder.Folder, namespacer request.NamespaceMapper)
 			meta.SetUpdatedBy(fmt.Sprintf("user:%d", v.UpdatedBy))
 		}
 	}
-
+	if v.ParentUID != "" {
+		meta.SetFolder(v.ParentUID)
+	}
 	f.UID = utils.CalculateClusterWideUID(f)
 	return f
 }

pkg/registry/apis/folders/register.go

@@ -1,6 +1,7 @@
 package folders
 
 import (
+	"context"
 	"fmt"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -14,10 +15,13 @@ import (
 	common "k8s.io/kube-openapi/pkg/common"
 
 	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
+	"github.com/grafana/grafana/pkg/infra/appcontext"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/apiserver/builder"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
 	grafanarest "github.com/grafana/grafana/pkg/services/apiserver/rest"
 	"github.com/grafana/grafana/pkg/services/apiserver/utils"
+	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/setting"
@@ -29,26 +33,29 @@ var resourceInfo = v0alpha1.FolderResourceInfo
 
 // This is used just so wire has something unique to return
 type FolderAPIBuilder struct {
-	gv         schema.GroupVersion
-	features   *featuremgmt.FeatureManager
-	namespacer request.NamespaceMapper
-	folderSvc  folder.Service
+	gv            schema.GroupVersion
+	features      *featuremgmt.FeatureManager
+	namespacer    request.NamespaceMapper
+	folderSvc     folder.Service
+	accessControl accesscontrol.AccessControl
 }
 
 func RegisterAPIService(cfg *setting.Cfg,
 	features *featuremgmt.FeatureManager,
 	apiregistration builder.APIRegistrar,
 	folderSvc folder.Service,
+	accessControl accesscontrol.AccessControl,
 ) *FolderAPIBuilder {
 	if !features.IsEnabledGlobally(featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs) {
 		return nil // skip registration unless opting into experimental apis
 	}
 
 	builder := &FolderAPIBuilder{
-		gv:         resourceInfo.GroupVersion(),
-		features:   features,
-		namespacer: request.GetNamespaceMapper(cfg),
-		folderSvc:  folderSvc,
+		gv:            resourceInfo.GroupVersion(),
+		features:      features,
+		namespacer:    request.GetNamespaceMapper(cfg),
+		folderSvc:     folderSvc,
+		accessControl: accessControl,
 	}
 	apiregistration.RegisterAPI(builder)
 	return builder
@@ -63,6 +70,8 @@ func addKnownTypes(scheme *runtime.Scheme, gv schema.GroupVersion) {
 		&v0alpha1.Folder{},
 		&v0alpha1.FolderList{},
 		&v0alpha1.FolderInfoList{},
+		&v0alpha1.DescendantCounts{},
+		&v0alpha1.FolderAccessInfo{},
 	)
 }
 
@@ -120,7 +129,8 @@ func (b *FolderAPIBuilder) GetAPIGroupInfo(
 	storage := map[string]rest.Storage{}
 	storage[resourceInfo.StoragePath()] = legacyStore
 	storage[resourceInfo.StoragePath("parents")] = &subParentsREST{b.folderSvc}
-	storage[resourceInfo.StoragePath("children")] = &subChildrenREST{b.folderSvc}
+	storage[resourceInfo.StoragePath("count")] = &subCountREST{b.folderSvc}
+	storage[resourceInfo.StoragePath("access")] = &subAccessREST{b.folderSvc}
 
 	// enable dual writes if a RESTOptionsGetter is provided
 	if dualWrite && optsGetter != nil {
@@ -144,5 +154,39 @@ func (b *FolderAPIBuilder) GetAPIRoutes() *builder.APIRoutes {
 }
 
 func (b *FolderAPIBuilder) GetAuthorizer() authorizer.Authorizer {
-	return nil // TODO: the FGAC rules encoded in the service can be moved here
+	return authorizer.AuthorizerFunc(
+		func(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
+			if !attr.IsResourceRequest() || attr.GetName() == "" {
+				return authorizer.DecisionNoOpinion, "", nil
+			}
+
+			// require a user
+			user, err := appcontext.User(ctx)
+			if err != nil {
+				return authorizer.DecisionDeny, "valid user is required", err
+			}
+
+			action := dashboards.ActionFoldersRead
+			scope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(attr.GetName())
+
+			// "get" is used for sub-resources with GET http (parents, access, count)
+			switch attr.GetVerb() {
+			case "patch":
+				fallthrough
+			case "create":
+				fallthrough
+			case "update":
+				action = dashboards.ActionFoldersWrite
+			case "deletecollection":
+				fallthrough
+			case "delete":
+				action = dashboards.ActionFoldersDelete
+			}
+
+			ok, err := b.accessControl.Evaluate(ctx, user, accesscontrol.EvalPermission(action, scope))
+			if ok {
+				return authorizer.DecisionAllow, "", nil
+			}
+			return authorizer.DecisionDeny, "folder", err
+		})
 }

pkg/registry/apis/folders/sub_access.go

@@ -0,0 +1,69 @@
+package folders
+
+import (
+	"context"
+	"net/http"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apiserver/pkg/registry/rest"
+
+	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
+	"github.com/grafana/grafana/pkg/infra/appcontext"
+	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
+	"github.com/grafana/grafana/pkg/services/folder"
+	"github.com/grafana/grafana/pkg/services/guardian"
+)
+
+type subAccessREST struct {
+	service folder.Service
+}
+
+var _ = rest.Connecter(&subAccessREST{})
+
+func (r *subAccessREST) New() runtime.Object {
+	return &v0alpha1.FolderAccessInfo{}
+}
+
+func (r *subAccessREST) Destroy() {
+}
+
+func (r *subAccessREST) ConnectMethods() []string {
+	return []string{"GET"}
+}
+
+func (r *subAccessREST) NewConnectOptions() (runtime.Object, bool, string) {
+	return nil, false, "" // true means you can use the trailing path as a variable
+}
+
+func (r *subAccessREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
+	ns, err := request.NamespaceInfoFrom(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+	user, err := appcontext.User(ctx)
+	if err != nil {
+		return nil, err
+	}
+	// Can view is managed here (and in the Authorizer)
+	f, err := r.service.Get(ctx, &folder.GetFolderQuery{
+		UID:          &name,
+		OrgID:        ns.OrgID,
+		SignedInUser: user,
+	})
+	if err != nil {
+		return nil, err
+	}
+	guardian, err := guardian.NewByFolder(ctx, f, ns.OrgID, user)
+	if err != nil {
+		return nil, err
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		access := &v0alpha1.FolderAccessInfo{}
+		access.CanEdit, _ = guardian.CanEdit()
+		access.CanSave, _ = guardian.CanSave()
+		access.CanAdmin, _ = guardian.CanAdmin()
+		access.CanDelete, _ = guardian.CanDelete()
+		responder.Object(http.StatusOK, access)
+	}), nil
+}

pkg/registry/apis/folders/sub_children.go

@@ -1,73 +0,0 @@
-package folders
-
-import (
-	"context"
-	"net/http"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apiserver/pkg/registry/rest"
-
-	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
-	"github.com/grafana/grafana/pkg/infra/appcontext"
-	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
-	"github.com/grafana/grafana/pkg/services/folder"
-)
-
-type subChildrenREST struct {
-	service folder.Service
-}
-
-var _ = rest.Connecter(&subChildrenREST{})
-
-func (r *subChildrenREST) New() runtime.Object {
-	return &v0alpha1.FolderInfoList{}
-}
-
-func (r *subChildrenREST) Destroy() {
-}
-
-func (r *subChildrenREST) ConnectMethods() []string {
-	return []string{"GET"}
-}
-
-func (r *subChildrenREST) NewConnectOptions() (runtime.Object, bool, string) {
-	return nil, false, "" // true means you can use the trailing path as a variable
-}
-
-func (r *subChildrenREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
-	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		ns, err := request.NamespaceInfoFrom(ctx, true)
-		if err != nil {
-			responder.Error(err)
-			return
-		}
-
-		user, err := appcontext.User(ctx)
-		if err != nil {
-			responder.Error(err)
-			return
-		}
-
-		children, err := r.service.GetChildren(ctx, &folder.GetChildrenQuery{
-			SignedInUser: user,
-			UID:          name,
-			OrgID:        ns.OrgID,
-		})
-		if err != nil {
-			responder.Error(err)
-			return
-		}
-
-		info := &v0alpha1.FolderInfoList{
-			Items: make([]v0alpha1.FolderInfo, 0),
-		}
-		for _, parent := range children {
-			info.Items = append(info.Items, v0alpha1.FolderInfo{
-				UID:    parent.UID,
-				Title:  parent.Title,
-				Parent: parent.ParentUID,
-			})
-		}
-		responder.Object(http.StatusOK, info)
-	}), nil
-}

pkg/registry/apis/folders/sub_count.go

@@ -0,0 +1,64 @@
+package folders
+
+import (
+	"context"
+	"net/http"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apiserver/pkg/registry/rest"
+
+	"github.com/grafana/grafana/pkg/apis/folder/v0alpha1"
+	"github.com/grafana/grafana/pkg/infra/appcontext"
+	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
+	"github.com/grafana/grafana/pkg/services/folder"
+)
+
+type subCountREST struct {
+	service folder.Service
+}
+
+var _ = rest.Connecter(&subCountREST{})
+
+func (r *subCountREST) New() runtime.Object {
+	return &v0alpha1.DescendantCounts{}
+}
+
+func (r *subCountREST) Destroy() {
+}
+
+func (r *subCountREST) ConnectMethods() []string {
+	return []string{"GET"}
+}
+
+func (r *subCountREST) NewConnectOptions() (runtime.Object, bool, string) {
+	return nil, false, "" // true means you can use the trailing path as a variable
+}
+
+func (r *subCountREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
+	user, err := appcontext.User(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		ns, err := request.NamespaceInfoFrom(ctx, true)
+		if err != nil {
+			responder.Error(err)
+			return
+		}
+
+		counts, err := r.service.GetDescendantCounts(ctx, &folder.GetDescendantCountsQuery{
+			UID:          &name,
+			OrgID:        ns.OrgID,
+			SignedInUser: user,
+		})
+		if err != nil {
+			responder.Error(err)
+			return
+		}
+
+		responder.Object(http.StatusOK, &v0alpha1.DescendantCounts{
+			Counts: counts,
+		})
+	}), nil
+}