IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-18 17:15:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

Access control: Move data source actions and scopes to datasource package (#46594)

Browse Source 
* Add permission actions and id scope

* Remove scope and actions variable prefix

* Move page evaluators and rename them
This commit is contained in:
Karl Persson
2022-03-16 15:11:03 +01:00
committed by GitHub
parent ea815d640f
commit d27ff42376
6 changed files with 90 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/datasources/accesscontrol.go
+37 -9
View File
@@ -3,17 +3,45 @@ package datasources
import "github.com/grafana/grafana/pkg/services/accesscontrol"
const (
ActionDatasourcesRead = "datasources:read"
ActionDatasourcesQuery = "datasources:query"
ActionDatasourcesCreate = "datasources:create"
ActionDatasourcesWrite = "datasources:write"
ActionDatasourcesDelete = "datasources:delete"
ActionDatasourcesIDRead = "datasources.id:read"
ScopeRoot = "datasources"
ScopeDatasourcesRoot = "datasources"
ActionRead = "datasources:read"
ActionQuery = "datasources:query"
ActionCreate = "datasources:create"
ActionWrite = "datasources:write"
ActionDelete = "datasources:delete"
ActionIDRead = "datasources.id:read"
ActionPermissionsRead = "datasources.permissions:read"
ActionPermissionsWrite = "datasources.permissions:write"
)
var (
ScopeDatasourcesAll = accesscontrol.GetResourceAllScope(ScopeDatasourcesRoot)
ScopeDatasourcesProvider = accesscontrol.NewScopeProvider(ScopeDatasourcesRoot)
ScopeID = accesscontrol.Scope("datasources", "id", accesscontrol.Parameter(":datasourceId"))
ScopeAll = accesscontrol.GetResourceAllScope(ScopeRoot)
ScopeProvider = accesscontrol.NewScopeProvider(ScopeRoot)
)
var (
// ConfigurationPageAccess is used to protect the "Configure > Data sources" tab access
ConfigurationPageAccess = accesscontrol.EvalAll(
accesscontrol.EvalPermission(ActionRead),
accesscontrol.EvalAny(
accesscontrol.EvalPermission(ActionCreate),
accesscontrol.EvalPermission(ActionDelete),
accesscontrol.EvalPermission(ActionWrite),
),
)
// NewPageAccess is used to protect the "Configure > Data sources > New" page access
NewPageAccess = accesscontrol.EvalAll(
accesscontrol.EvalPermission(ActionRead),
accesscontrol.EvalPermission(ActionCreate),
accesscontrol.EvalPermission(ActionWrite),
)
// EditPageAccess is used to protect the "Configure > Data sources > Edit" page access
EditPageAccess = accesscontrol.EvalAll(
accesscontrol.EvalPermission(ActionRead),
accesscontrol.EvalPermission(ActionWrite),
)
)
pkg/services/datasources/service/datasource_service.go
+4 -4
View File
@@ -97,7 +97,7 @@ type DataSourceRetriever interface {
// NewNameScopeResolver provides an AttributeScopeResolver able to
// translate a scope prefixed with "datasources:name:" into an id based scope.
func NewNameScopeResolver(db DataSourceRetriever) (string, accesscontrol.AttributeScopeResolveFunc) {
prefix := datasources.ScopeDatasourcesProvider.GetResourceScopeName("")
prefix := datasources.ScopeProvider.GetResourceScopeName("")
dsNameResolver := func(ctx context.Context, orgID int64, initialScope string) (string, error) {
if !strings.HasPrefix(initialScope, prefix) {
return "", accesscontrol.ErrInvalidScope
@@ -113,7 +113,7 @@ func NewNameScopeResolver(db DataSourceRetriever) (string, accesscontrol.Attribu
return "", err
}
return datasources.ScopeDatasourcesProvider.GetResourceScope(strconv.FormatInt(query.Result.Id, 10)), nil
return datasources.ScopeProvider.GetResourceScope(strconv.FormatInt(query.Result.Id, 10)), nil
}
return prefix, dsNameResolver
@@ -122,7 +122,7 @@ func NewNameScopeResolver(db DataSourceRetriever) (string, accesscontrol.Attribu
// NewUidScopeResolver provides an AttributeScopeResolver able to
// translate a scope prefixed with "datasources:uid:" into an id based scope.
func NewUidScopeResolver(db DataSourceRetriever) (string, accesscontrol.AttributeScopeResolveFunc) {
prefix := datasources.ScopeDatasourcesProvider.GetResourceScopeUID("")
prefix := datasources.ScopeProvider.GetResourceScopeUID("")
dsUIDResolver := func(ctx context.Context, orgID int64, initialScope string) (string, error) {
if !strings.HasPrefix(initialScope, prefix) {
return "", accesscontrol.ErrInvalidScope
@@ -138,7 +138,7 @@ func NewUidScopeResolver(db DataSourceRetriever) (string, accesscontrol.Attribut
return "", err
}
return datasources.ScopeDatasourcesProvider.GetResourceScope(strconv.FormatInt(query.Result.Id, 10)), nil
return datasources.ScopeProvider.GetResourceScope(strconv.FormatInt(query.Result.Id, 10)), nil
}
return prefix, dsUIDResolver