mirror of
https://github.com/grafana/grafana.git
synced 2025-02-25 18:55:37 -06:00
Access Control: SQL filter (#43560)
* Add the accesscontrol sql filter utility Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
This commit is contained in:
Karl Persson
GitHub
parent
dcd4e74c54
commit
d350ed0f35
99
pkg/services/accesscontrol/filter.go
Normal file
99
pkg/services/accesscontrol/filter.go
Normal file
@ -0,0 +1,99 @@
|
||||
package accesscontrol
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
|
||||
)
|
||||
|
||||
var sqlIDAcceptList = map[string]struct{}{}
|
||||
|
||||
type SQLDialect interface {
|
||||
DriverName() string
|
||||
}
|
||||
|
||||
// Filter creates a where clause to restrict the view of a query based on a users permissions
|
||||
// Scopes for a certain action will be compared against prefix:id:sqlID where prefix is the scope prefix and sqlID
|
||||
// is the id to generate scope from e.g. user.id
|
||||
func Filter(ctx context.Context, dialect SQLDialect, sqlID, prefix, action string, user *models.SignedInUser) (string, []interface{}, error) {
|
||||
if _, ok := sqlIDAcceptList[sqlID]; !ok {
|
||||
return "", nil, errors.New("sqlID is not in the accept list")
|
||||
}
|
||||
|
||||
if user.Permissions == nil || user.Permissions[user.OrgId] == nil {
|
||||
return "", nil, errors.New("missing permissions")
|
||||
}
|
||||
|
||||
scopes := user.Permissions[user.OrgId][action]
|
||||
if len(scopes) == 0 {
|
||||
return " 1 = 0", nil, nil
|
||||
}
|
||||
|
||||
var sql string
|
||||
var args []interface{}
|
||||
|
||||
switch {
|
||||
case strings.Contains(dialect.DriverName(), migrator.SQLite):
|
||||
sql, args = sqliteQuery(scopes, sqlID, prefix)
|
||||
case strings.Contains(dialect.DriverName(), migrator.MySQL):
|
||||
sql, args = mysqlQuery(scopes, sqlID, prefix)
|
||||
case strings.Contains(dialect.DriverName(), migrator.Postgres):
|
||||
sql, args = postgresQuery(scopes, sqlID, prefix)
|
||||
default:
|
||||
return "", nil, fmt.Errorf("unknown database: %s", dialect.DriverName())
|
||||
}
|
||||
|
||||
return sql, args, nil
|
||||
}
|
||||
|
||||
func sqliteQuery(scopes []string, sqlID, prefix string) (string, []interface{}) {
|
||||
args := []interface{}{prefix}
|
||||
for _, s := range scopes {
|
||||
args = append(args, s)
|
||||
}
|
||||
args = append(args, prefix, prefix, prefix)
|
||||
|
||||
return fmt.Sprintf(`
|
||||
? || ':id:' || %s IN (
|
||||
WITH t(scope) AS (
|
||||
VALUES (?)`+strings.Repeat(`, (?)`, len(scopes)-1)+`
|
||||
)
|
||||
SELECT IIF(t.scope = '*' OR t.scope = ? || ':*' OR t.scope = ? || ':id:*', ? || ':id:' || %s, t.scope) FROM t
|
||||
)
|
||||
`, sqlID, sqlID), args
|
||||
}
|
||||
|
||||
func mysqlQuery(scopes []string, sqlID, prefix string) (string, []interface{}) {
|
||||
args := []interface{}{prefix, prefix, prefix, prefix}
|
||||
for _, s := range scopes {
|
||||
args = append(args, s)
|
||||
}
|
||||
|
||||
return fmt.Sprintf(`
|
||||
CONCAT(?, ':id:', %s) IN (
|
||||
SELECT IF(t.scope = '*' OR t.scope = CONCAT(?, ':*') OR t.scope = CONCAT(?, ':id:*'), CONCAT(?, ':id:', %s), t.scope) FROM
|
||||
(SELECT ? AS scope`+strings.Repeat(" UNION ALL SELECT ?", len(scopes)-1)+`) AS t
|
||||
)
|
||||
`, sqlID, sqlID), args
|
||||
}
|
||||
|
||||
func postgresQuery(scopes []string, sqlID, prefix string) (string, []interface{}) {
|
||||
args := []interface{}{prefix, prefix, prefix, prefix}
|
||||
for _, s := range scopes {
|
||||
args = append(args, s)
|
||||
}
|
||||
|
||||
return fmt.Sprintf(`
|
||||
CONCAT(?, ':id:', %s) IN (
|
||||
SELECT
|
||||
CASE WHEN p.scope = '*' OR p.scope = CONCAT(?, ':*') OR p.scope = CONCAT(?, ':id:*') THEN CONCAT(?, ':id:', %s)
|
||||
ELSE p.scope
|
||||
END
|
||||
FROM (VALUES (?)`+strings.Repeat(", (?)", len(scopes)-1)+`) as p(scope)
|
||||
)
|
||||
`, sqlID, sqlID), args
|
||||
}
|
||||
74
pkg/services/accesscontrol/filter_bench_test.go
Normal file
74
pkg/services/accesscontrol/filter_bench_test.go
Normal file
@ -0,0 +1,74 @@
|
||||
package accesscontrol
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/sqlstore"
|
||||
)
|
||||
|
||||
func BenchmarkFilter10_10(b *testing.B) { benchmarkFilter(b, 10, 10) }
|
||||
func BenchmarkFilter100_10(b *testing.B) { benchmarkFilter(b, 100, 10) }
|
||||
func BenchmarkFilter100_100(b *testing.B) { benchmarkFilter(b, 100, 100) }
|
||||
|
||||
func benchmarkFilter(b *testing.B, numDs, numPermissions int) {
|
||||
store, permissions := setupFilterBenchmark(b, numDs, numPermissions)
|
||||
b.ResetTimer()
|
||||
|
||||
// set sqlIDAcceptList before running tests
|
||||
sqlIDAcceptList = map[string]struct{}{
|
||||
"data_source.id": {},
|
||||
}
|
||||
|
||||
for i := 0; i < b.N; i++ {
|
||||
baseSql := `SELECT data_source.* FROM data_source WHERE`
|
||||
query, args, err := Filter(
|
||||
context.Background(),
|
||||
&FakeDriver{name: "sqlite3"},
|
||||
"data_source.id",
|
||||
"datasources",
|
||||
"datasources:read",
|
||||
&models.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: GroupScopesByAction(permissions)}},
|
||||
)
|
||||
require.NoError(b, err)
|
||||
|
||||
var datasources []models.DataSource
|
||||
sess := store.NewSession(context.Background())
|
||||
err = sess.SQL(baseSql+query, args...).Find(&datasources)
|
||||
require.NoError(b, err)
|
||||
sess.Close()
|
||||
require.Len(b, datasources, numPermissions)
|
||||
}
|
||||
}
|
||||
|
||||
func setupFilterBenchmark(b *testing.B, numDs, numPermissions int) (*sqlstore.SQLStore, []*Permission) {
|
||||
b.Helper()
|
||||
store := sqlstore.InitTestDB(b)
|
||||
|
||||
for i := 1; i <= numDs; i++ {
|
||||
err := store.AddDataSource(context.Background(), &models.AddDataSourceCommand{
|
||||
Name: fmt.Sprintf("ds:%d", i),
|
||||
OrgId: 1,
|
||||
})
|
||||
require.NoError(b, err)
|
||||
}
|
||||
|
||||
if numPermissions > numDs {
|
||||
numPermissions = numDs
|
||||
}
|
||||
|
||||
permissions := make([]*Permission, 0, numPermissions)
|
||||
for i := 1; i <= numPermissions; i++ {
|
||||
permissions = append(permissions, &Permission{
|
||||
Action: "datasources:read",
|
||||
Scope: Scope("datasources", "id", strconv.Itoa(i)),
|
||||
})
|
||||
}
|
||||
|
||||
return store, permissions
|
||||
}
|
||||
251
pkg/services/accesscontrol/filter_test.go
Normal file
251
pkg/services/accesscontrol/filter_test.go
Normal file
@ -0,0 +1,251 @@
|
||||
package accesscontrol
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/sqlstore"
|
||||
)
|
||||
|
||||
type filterTest struct {
|
||||
desc string
|
||||
driverName string
|
||||
sqlID string
|
||||
action string
|
||||
prefix string
|
||||
permissions []*Permission
|
||||
expectedQuery string
|
||||
expectedArgs []interface{}
|
||||
}
|
||||
|
||||
func TestFilter(t *testing.T) {
|
||||
tests := []filterTest{
|
||||
{
|
||||
desc: "should produce datasource filter with sqlite driver",
|
||||
driverName: "sqlite3",
|
||||
sqlID: "data_source.id",
|
||||
prefix: "datasources",
|
||||
action: "datasources:query",
|
||||
permissions: []*Permission{
|
||||
{Action: "datasources:query", Scope: "datasources:id:1"},
|
||||
{Action: "datasources:query", Scope: "datasources:id:2"},
|
||||
{Action: "datasources:query", Scope: "datasources:id:3"},
|
||||
{Action: "datasources:query", Scope: "datasources:id:8"},
|
||||
// Other permissions
|
||||
{Action: "datasources:write", Scope: "datasources:id:100"},
|
||||
{Action: "datasources:delete", Scope: "datasources:id:101"},
|
||||
},
|
||||
expectedQuery: `
|
||||
? || ':id:' || data_source.id IN (
|
||||
WITH t(scope) AS (
|
||||
VALUES (?), (?), (?), (?)
|
||||
)
|
||||
SELECT IIF(t.scope = '*' OR t.scope = ? || ':*' OR t.scope = ? || ':id:*', ? || ':id:' || data_source.id, t.scope) FROM t
|
||||
)
|
||||
`,
|
||||
expectedArgs: []interface{}{
|
||||
"datasources",
|
||||
"datasources:id:1",
|
||||
"datasources:id:2",
|
||||
"datasources:id:3",
|
||||
"datasources:id:8",
|
||||
"datasources",
|
||||
"datasources",
|
||||
"datasources",
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should produce dashboard filter with mysql driver",
|
||||
driverName: "mysql",
|
||||
sqlID: "dashboard.id",
|
||||
prefix: "dashboards",
|
||||
action: "dashboards:read",
|
||||
permissions: []*Permission{
|
||||
{Action: "dashboards:read", Scope: "dashboards:id:1"},
|
||||
{Action: "dashboards:read", Scope: "dashboards:id:2"},
|
||||
{Action: "dashboards:read", Scope: "dashboards:id:5"},
|
||||
// Other permissions
|
||||
{Action: "dashboards:write", Scope: "dashboards:id:100"},
|
||||
{Action: "dashboards:delete", Scope: "dashboards:id:101"},
|
||||
},
|
||||
expectedQuery: `
|
||||
CONCAT(?, ':id:', dashboard.id) IN (
|
||||
SELECT IF(t.scope = '*' OR t.scope = CONCAT(?, ':*') OR t.scope = CONCAT(?, ':id:*'), CONCAT(?, ':id:', dashboard.id), t.scope) FROM
|
||||
(SELECT ? AS scope UNION ALL SELECT ? UNION ALL SELECT ?) AS t
|
||||
)
|
||||
`,
|
||||
expectedArgs: []interface{}{
|
||||
"dashboards",
|
||||
"dashboards",
|
||||
"dashboards",
|
||||
"dashboards",
|
||||
"dashboards:id:1",
|
||||
"dashboards:id:2",
|
||||
"dashboards:id:5",
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should produce user filter with postgres driver",
|
||||
driverName: "postgres",
|
||||
sqlID: "user.id",
|
||||
prefix: "users",
|
||||
action: "users:read",
|
||||
permissions: []*Permission{
|
||||
{Action: "users:read", Scope: "users:id:1"},
|
||||
{Action: "users:read", Scope: "users:id:100"},
|
||||
// Other permissions
|
||||
{Action: "dashboards:write", Scope: "dashboards:id:100"},
|
||||
{Action: "dashboards:delete", Scope: "dashboards:id:101"},
|
||||
},
|
||||
expectedQuery: `
|
||||
CONCAT(?, ':id:', user.id) IN (
|
||||
SELECT
|
||||
CASE WHEN p.scope = '*' OR p.scope = CONCAT(?, ':*') OR p.scope = CONCAT(?, ':id:*') THEN CONCAT(?, ':id:', user.id)
|
||||
ELSE p.scope
|
||||
END
|
||||
FROM (VALUES (?), (?)) as p(scope)
|
||||
)
|
||||
`,
|
||||
expectedArgs: []interface{}{
|
||||
"users",
|
||||
"users",
|
||||
"users",
|
||||
"users",
|
||||
"users:id:1",
|
||||
"users:id:100",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
// set sqlIDAcceptList before running tests
|
||||
sqlIDAcceptList = map[string]struct{}{
|
||||
"user.id": {},
|
||||
"dashboard.id": {},
|
||||
"data_source.id": {},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
query, args, err := Filter(
|
||||
context.Background(),
|
||||
FakeDriver{name: tt.driverName},
|
||||
tt.sqlID,
|
||||
tt.prefix,
|
||||
tt.action,
|
||||
&models.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: GroupScopesByAction(tt.permissions)}},
|
||||
)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedQuery, query)
|
||||
|
||||
require.Len(t, args, len(tt.expectedArgs))
|
||||
for i := range tt.expectedArgs {
|
||||
assert.Equal(t, tt.expectedArgs[i], args[i])
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
type filterDatasourcesTestCase struct {
|
||||
desc string
|
||||
sqlID string
|
||||
permissions []*Permission
|
||||
expectedDataSources []string
|
||||
expectErr bool
|
||||
}
|
||||
|
||||
func TestFilter_Datasources(t *testing.T) {
|
||||
tests := []filterDatasourcesTestCase{
|
||||
{
|
||||
desc: "expect all data sources to be returned",
|
||||
sqlID: "data_source.id",
|
||||
permissions: []*Permission{
|
||||
{Action: "datasources:read", Scope: "datasources:*"},
|
||||
},
|
||||
expectedDataSources: []string{"ds:1", "ds:2", "ds:3", "ds:4", "ds:5", "ds:6", "ds:7", "ds:8", "ds:9", "ds:10"},
|
||||
},
|
||||
{
|
||||
desc: "expect no data sources to be returned",
|
||||
sqlID: "data_source.id",
|
||||
permissions: []*Permission{},
|
||||
expectedDataSources: []string{},
|
||||
},
|
||||
{
|
||||
desc: "expect data sources with id 3, 7 and 8 to be returned",
|
||||
sqlID: "data_source.id",
|
||||
permissions: []*Permission{
|
||||
{Action: "datasources:read", Scope: "datasources:id:3"},
|
||||
{Action: "datasources:read", Scope: "datasources:id:7"},
|
||||
{Action: "datasources:read", Scope: "datasources:id:8"},
|
||||
},
|
||||
expectedDataSources: []string{"ds:3", "ds:7", "ds:8"},
|
||||
},
|
||||
{
|
||||
desc: "expect error if sqlID is not in the accept list",
|
||||
sqlID: "other.id",
|
||||
permissions: []*Permission{
|
||||
{Action: "datasources:read", Scope: "datasources:id:3"},
|
||||
{Action: "datasources:read", Scope: "datasources:id:7"},
|
||||
{Action: "datasources:read", Scope: "datasources:id:8"},
|
||||
},
|
||||
expectedDataSources: []string{"ds:3", "ds:7", "ds:8"},
|
||||
expectErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
// set sqlIDAcceptList before running tests
|
||||
sqlIDAcceptList = map[string]struct{}{
|
||||
"data_source.id": {},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
store := sqlstore.InitTestDB(t)
|
||||
|
||||
sess := store.NewSession(context.Background())
|
||||
defer sess.Close()
|
||||
|
||||
// seed 10 data sources
|
||||
for i := 1; i <= 10; i++ {
|
||||
err := store.AddDataSource(context.Background(), &models.AddDataSourceCommand{Name: fmt.Sprintf("ds:%d", i)})
|
||||
require.NoError(t, err)
|
||||
}
|
||||
|
||||
baseSql := `SELECT data_source.* FROM data_source WHERE`
|
||||
query, args, err := Filter(
|
||||
context.Background(),
|
||||
&FakeDriver{name: "sqlite3"},
|
||||
tt.sqlID,
|
||||
"datasources",
|
||||
"datasources:read",
|
||||
&models.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: GroupScopesByAction(tt.permissions)}},
|
||||
)
|
||||
|
||||
if !tt.expectErr {
|
||||
require.NoError(t, err)
|
||||
var datasources []models.DataSource
|
||||
err = sess.SQL(baseSql+query, args...).Find(&datasources)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Len(t, datasources, len(tt.expectedDataSources))
|
||||
for i, ds := range datasources {
|
||||
assert.Equal(t, tt.expectedDataSources[i], ds.Name)
|
||||
}
|
||||
} else {
|
||||
require.Error(t, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
type FakeDriver struct {
|
||||
name string
|
||||
}
|
||||
|
||||
func (f FakeDriver) DriverName() string {
|
||||
return f.name
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user