public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Alerting: Remove requirement for datasource query on rule read (#87349)

Browse Source 
* Remove requirement for datasource query for rule read

* Address PR comments
This commit is contained in:
William Wernert
2024-05-23 12:44:30 -04:00
committed by GitHub
parent bc5d077b30
commit 006d0021e3
9 changed files with 123 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/ngalert/api/api_ruler_test.go
+13 -69
View File
@@ -196,17 +196,22 @@ func TestRouteDeleteAlertRules(t *testing.T) {
func TestRouteGetNamespaceRulesConfig(t *testing.T) {
gen := models.RuleGen
t.Run("fine-grained access is enabled", func(t *testing.T) {
t.Run("should return rules for which user has access to data source", func(t *testing.T) {
t.Run("should return all rules, with or without data source access", func(t *testing.T) {
orgID := rand.Int63()
folder := randFolder()
ruleStore := fakes.NewRuleStore(t)
ruleStore.Folders[orgID] = append(ruleStore.Folders[orgID], folder)
folderGen := gen.With(gen.WithOrgID(orgID), gen.WithNamespace(folder))
expectedRules := folderGen.GenerateManyRef(2, 6)
ruleStore.PutRule(context.Background(), expectedRules...)
ruleStore.PutRule(context.Background(), folderGen.GenerateManyRef(2, 6)...)
queryAccessRules := folderGen.GenerateManyRef(2, 6)
ruleStore.PutRule(context.Background(), queryAccessRules...)
noQueryAccessRules := folderGen.GenerateManyRef(2, 6)
ruleStore.PutRule(context.Background(), noQueryAccessRules...)
permissions := createPermissionsForRules(expectedRules, orgID)
allRules := make([]*models.AlertRule, 0, len(queryAccessRules)+len(noQueryAccessRules))
allRules = append(allRules, queryAccessRules...)
allRules = append(allRules, noQueryAccessRules...)
permissions := createPermissionsForRules(queryAccessRules, orgID)
req := createRequestContextWithPerms(orgID, permissions, nil)
response := createService(ruleStore).RouteGetNamespaceRulesConfig(req, folder.UID)
@@ -220,9 +225,9 @@ func TestRouteGetNamespaceRulesConfig(t *testing.T) {
for _, group := range groups {
grouploop:
for _, actualRule := range group.Rules {
for i, expected := range expectedRules {
for i, expected := range allRules {
if actualRule.GrafanaManagedAlert.UID == expected.UID {
expectedRules = append(expectedRules[:i], expectedRules[i+1:]...)
allRules = append(allRules[:i], allRules[i+1:]...)
continue grouploop
}
}
@@ -230,7 +235,7 @@ func TestRouteGetNamespaceRulesConfig(t *testing.T) {
}
}
}
assert.Emptyf(t, expectedRules, "not all expected rules were returned")
assert.Emptyf(t, allRules, "not all expected rules were returned")
})
})
t.Run("should return the provenance of the alert rules", func(t *testing.T) {
@@ -367,28 +372,6 @@ func TestRouteGetRuleByUID(t *testing.T) {
require.Equal(t, http.StatusNotFound, response.Status())
})
t.Run("error due to user not being authorized to view a rule in the group", func(t *testing.T) {
orgID := rand.Int63()
folder := randFolder()
ruleStore := fakes.NewRuleStore(t)
ruleStore.Folders[orgID] = append(ruleStore.Folders[orgID], folder)
groupKey := models.GenerateGroupKey(orgID)
groupKey.NamespaceUID = folder.UID
gen := models.RuleGen.With(models.RuleGen.WithGroupKey(groupKey))
authorizedRule := gen.With(gen.WithUniqueGroupIndex()).Generate()
ruleStore.PutRule(context.Background(), &authorizedRule)
unauthorizedRule := gen.With(gen.WithUniqueGroupIndex()).Generate()
ruleStore.PutRule(context.Background(), &unauthorizedRule)
perms := createPermissionsForRules([]*models.AlertRule{&authorizedRule}, orgID)
req := createRequestContextWithPerms(orgID, perms, nil)
response := createService(ruleStore).RouteGetRuleByUID(req, authorizedRule.UID)
require.Equal(t, http.StatusForbidden, response.Status())
})
}
func TestRouteGetRulesConfig(t *testing.T) {
@@ -478,45 +461,6 @@ func TestRouteGetRulesConfig(t *testing.T) {
func TestRouteGetRulesGroupConfig(t *testing.T) {
gen := models.RuleGen
t.Run("fine-grained access is enabled", func(t *testing.T) {
t.Run("should check access to data source", func(t *testing.T) {
orgID := rand.Int63()
folder := randFolder()
ruleStore := fakes.NewRuleStore(t)
ruleStore.Folders[orgID] = append(ruleStore.Folders[orgID], folder)
groupKey := models.GenerateGroupKey(orgID)
groupKey.NamespaceUID = folder.UID
expectedRules := gen.With(gen.WithGroupKey(groupKey)).GenerateManyRef(2, 6)
ruleStore.PutRule(context.Background(), expectedRules...)
t.Run("and return Forbidden if user does not have access one of rules", func(t *testing.T) {
permissions := createPermissionsForRules(expectedRules[1:], orgID)
request := createRequestContextWithPerms(orgID, permissions, map[string]string{
":Namespace": folder.UID,
":Groupname": groupKey.RuleGroup,
})
response := createService(ruleStore).RouteGetRulesGroupConfig(request, folder.UID, groupKey.RuleGroup)
require.Equal(t, http.StatusForbidden, response.Status())
})
t.Run("and return rules if user has access to all of them", func(t *testing.T) {
permissions := createPermissionsForRules(expectedRules, orgID)
request := createRequestContextWithPerms(orgID, permissions, map[string]string{
":Namespace": folder.UID,
":Groupname": groupKey.RuleGroup,
})
response := createService(ruleStore).RouteGetRulesGroupConfig(request, folder.UID, groupKey.RuleGroup)
require.Equal(t, http.StatusAccepted, response.Status())
result := &apimodels.RuleGroupConfigResponse{}
require.NoError(t, json.Unmarshal(response.Body(), result))
require.NotNil(t, result)
require.Len(t, result.Rules, len(expectedRules))
})
})
})
t.Run("should return rules in group sorted by group index", func(t *testing.T) {
orgID := rand.Int63()
folder := randFolder()