IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Alerting: Stop returning autogen routes for non-admin on api/v2/status (#84864)

Browse Source 
* Alerting: Stop returning autogen routes for non-admin on api/v2/status

* Improve api/v2/status integration tests for user roles
This commit is contained in:
Matthew Jacobson
2024-03-20 16:04:35 -04:00
committed by GitHub
parent 7eee34311d
commit fbd057b258
3 changed files with 125 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/services/ngalert/api/api_alertmanager.go
View File

@@ -50,7 +50,12 @@ func (srv AlertmanagerSrv) RouteGetAMStatus(c *contextmodel.ReqContext) response
return errResp
}
return response.JSON(http.StatusOK, am.GetStatus())
status := am.GetStatus()
if !c.SignedInUser.HasRole(org.RoleAdmin) {
notifier.RemoveAutogenConfigIfExists(status.Config.Route)
}
return response.JSON(http.StatusOK, status)
}
func (srv AlertmanagerSrv) RouteCreateSilence(c *contextmodel.ReqContext, postableSilence apimodels.PostableSilence) response.Response {

47
pkg/services/ngalert/api/api_alertmanager_test.go
View File

@@ -405,6 +405,53 @@ func TestAlertmanagerAutogenConfig(t *testing.T) {
compare(t, validConfigWithoutAutogen, string(response.Body()))
})
})
t.Run("route GET status", func(t *testing.T) {
t.Run("when admin return autogen routes", func(t *testing.T) {
sut, _ := createSutForAutogen(t)
rc := createRequestCtxInOrg(2)
rc.SignedInUser.OrgRole = org.RoleAdmin
response := sut.RouteGetAMStatus(rc)
require.Equal(t, 200, response.Status())
var status struct {
Config apimodels.PostableApiAlertingConfig `json:"config"`
}
err := json.Unmarshal(response.Body(), &status)
require.NoError(t, err)
configBody, err := json.Marshal(apimodels.PostableUserConfig{
TemplateFiles: map[string]string{"a": "template"},
AlertmanagerConfig: status.Config,
})
require.NoError(t, err)
compare(t, validConfigWithAutogen, string(configBody))
})
t.Run("when not admin return no autogen routes", func(t *testing.T) {
sut, _ := createSutForAutogen(t)
rc := createRequestCtxInOrg(2)
response := sut.RouteGetAMStatus(rc)
require.Equal(t, 200, response.Status())
var status struct {
Config apimodels.PostableApiAlertingConfig `json:"config"`
}
err := json.Unmarshal(response.Body(), &status)
require.NoError(t, err)
configBody, err := json.Marshal(apimodels.PostableUserConfig{
TemplateFiles: map[string]string{"a": "template"},
AlertmanagerConfig: status.Config,
})
require.NoError(t, err)
compare(t, validConfigWithoutAutogen, string(configBody))
})
})
}
func TestRouteGetAlertingConfigHistory(t *testing.T) {