mirror of
https://github.com/grafana/grafana.git
synced 2026-08-19 01:34:54 -05:00
TaniaandCraig O'Donnell
4f9163ea28
* Add authz support for new annotations api * Mutate hook called * Remove admission hook * Fmt * Replace AuthService with AccessClient * annotation rbac mapping * Run make gen-apps * Annotation authz: fix access control for app_platform API Four fixes found during manual testing of the AccessClient-based authz: 1. Add annotation.grafana.app to serviceIdentityTokenPermissions so that authlib.CheckServicePermissions does not silently block write operations before they reach the RBAC gRPC server. 2. Delete handler: return 403 (not 404) when user can read but lacks delete permission; 404 only when user cannot read the annotation at all. 3. Virtual dashboard.grafana.app/annotations resource in RBAC mapper: add actionSetMapping mirroring dashboard action sets so that managed permissions stored as dashboards:view are matched when checking annotation access on a specific dashboard. 4. sql_adapter.go Get: return apierrors.NewNotFound instead of a plain error when repo.Find filters out the annotation, avoiding a 500 response. * Fix test setup to provide identity and accessClient * Cleanup * Add tests * Revert changes to Authorize * Add authz checks to search handler * Refactor canAccessAnnotation to a standalone function * fixup! Refactor canAccessAnnotation to a standalone function --------- Co-authored-by: Craig O'Donnell <craig.odonnell@grafana.com>