From 01721d910e4dc76ffcdbfac900a9e48281779669 Mon Sep 17 00:00:00 2001 From: linoman <2051016+linoman@users.noreply.github.com> Date: Fri, 4 Aug 2023 16:29:24 +0200 Subject: [PATCH] Auth: Add documentation references to No Basic role (#72880) * Update the documentation * Add references to the documentation * Replace X with YES in roles table --- .../roles-and-permissions/_index.md | 35 ++++++++++--------- .../administration/service-accounts/index.md | 4 +++ .../RolePicker/BuiltinRoleSelector.tsx | 4 +-- .../components/RolePicker/RolePickerMenu.tsx | 21 ++++++++--- public/app/features/org/UserInviteForm.tsx | 23 +++++++++--- 5 files changed, 59 insertions(+), 28 deletions(-) diff --git a/docs/sources/administration/roles-and-permissions/_index.md b/docs/sources/administration/roles-and-permissions/_index.md index 0bfc972eb38..b31dd35f297 100644 --- a/docs/sources/administration/roles-and-permissions/_index.md +++ b/docs/sources/administration/roles-and-permissions/_index.md @@ -79,26 +79,27 @@ Grafana uses the following roles to control user access: - **Organization administrator**: Has access to all organization resources, including dashboards, users, and teams. - **Editor**: Can view and edit dashboards, folders, and playlists. - **Viewer**: Can view dashboards and playlists. +- **No Basic Role**: Has no permissions. Permissions will be added with RBAC as needed. The following table lists permissions for each role. -| Permission | Organization administrator | Editor | Viewer | -| :----------------------------- | :------------------------: | :----: | :----: | -| View dashboards | x | x | x | -| Add, edit, delete dashboards | x | x | | -| Add, edit, delete folders | x | x | | -| View playlists | x | x | x | -| Add, edit, delete playlists | x | x | | -| Create library panels | x | x | | -| View annotations | x | x | x | -| Add, edit, delete annotations | x | x | | -| Access Explore | x | x | | -| Add, edit, delete data sources | x | | | -| Add and edit users | x | | | -| Add and edit teams | x | | | -| Change organizations settings | x | | | -| Change team settings | x | | | -| Configure application plugins | x | | | +| Permission | Organization administrator | Editor | Viewer | No Basic Role | +| :----------------------------- | :------------------------: | :----: | :----: | :-----------: | +| View dashboards | yes | yes | yes | | +| Add, edit, delete dashboards | yes | yes | | | +| Add, edit, delete folders | yes | yes | | | +| View playlists | yes | yes | yes | | +| Add, edit, delete playlists | yes | yes | | | +| Create library panels | yes | yes | | | +| View annotations | yes | yes | yes | | +| Add, edit, delete annotations | yes | yes | | | +| Access Explore | yes | yes | | | +| Add, edit, delete data sources | yes | | | | +| Add and edit users | yes | | | | +| Add and edit teams | yes | | | | +| Change organizations settings | yes | | | | +| Change team settings | yes | | | | +| Configure application plugins | yes | | | | ## Dashboard permissions diff --git a/docs/sources/administration/service-accounts/index.md b/docs/sources/administration/service-accounts/index.md index 200abe24399..67d23b456ff 100644 --- a/docs/sources/administration/service-accounts/index.md +++ b/docs/sources/administration/service-accounts/index.md @@ -120,6 +120,10 @@ You can assign roles to a service account using the Grafana UI or via the API. F In [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise/" >}}), you can also [assign RBAC roles]({{< relref "../roles-and-permissions/access-control/assign-rbac-roles" >}}) to grant very specific permissions to applications that interact with Grafana. +{{% admonition type="note" %}} +Since Grafana 10.2.0, the `No Basic Role` is available for organization users or service accounts. This role has no permissions. Permissions can be granted with RBAC. +{{% /admonition %}} + ### Before you begin - Ensure you have permission to update service accounts roles. By default, the organization administrator role is required to update service accounts permissions. For more information about user permissions, refer to [About users and permissions]({{< relref "../roles-and-permissions/#" >}}). diff --git a/public/app/core/components/RolePicker/BuiltinRoleSelector.tsx b/public/app/core/components/RolePicker/BuiltinRoleSelector.tsx index e9e5d02386b..4b2739b6b17 100644 --- a/public/app/core/components/RolePicker/BuiltinRoleSelector.tsx +++ b/public/app/core/components/RolePicker/BuiltinRoleSelector.tsx @@ -2,7 +2,7 @@ import React from 'react'; import { SelectableValue } from '@grafana/data'; import { config } from '@grafana/runtime'; -import { Icon, RadioButtonList, Tooltip, useStyles2, useTheme2 } from '@grafana/ui'; +import { Icon, RadioButtonList, Tooltip, useStyles2, useTheme2, PopoverContent } from '@grafana/ui'; import { contextSrv } from 'app/core/core'; import { OrgRole } from 'app/types'; @@ -24,7 +24,7 @@ interface Props { onChange: (value: OrgRole) => void; disabled?: boolean; disabledMesssage?: string; - tooltipMessage?: string; + tooltipMessage?: PopoverContent; } export const BuiltinRoleSelector = ({ value, onChange, disabled, disabledMesssage, tooltipMessage }: Props) => { diff --git a/public/app/core/components/RolePicker/RolePickerMenu.tsx b/public/app/core/components/RolePicker/RolePickerMenu.tsx index be4d481df99..adda62484dd 100644 --- a/public/app/core/components/RolePicker/RolePickerMenu.tsx +++ b/public/app/core/components/RolePicker/RolePickerMenu.tsx @@ -2,7 +2,7 @@ import { css, cx } from '@emotion/css'; import React, { useEffect, useRef, useState } from 'react'; import { config } from '@grafana/runtime'; -import { Button, CustomScrollbar, HorizontalGroup, useStyles2, useTheme2 } from '@grafana/ui'; +import { Button, CustomScrollbar, HorizontalGroup, TextLink, useStyles2, useTheme2 } from '@grafana/ui'; import { getSelectStyles } from '@grafana/ui/src/components/Select/getSelectStyles'; import { contextSrv } from 'app/core/core'; import { OrgRole, Role } from 'app/types'; @@ -37,9 +37,22 @@ const fixedRoleGroupNames: Record = { }; const noBasicRoleFlag = contextSrv.licensedAccessControlEnabled() && config.featureToggles.noBasicRole; -const tooltipMessage = noBasicRoleFlag - ? 'You can now select the "No basic role" option and add permissions to your custom needs.' - : undefined; +const tooltipMessage = noBasicRoleFlag ? ( + <> + You can now select the "No basic role" option and add permissions to your custom needs. You can find more + information in  + + our documentation + + . + +) : ( + '' +); interface RolePickerMenuProps { basicRole?: OrgRole; diff --git a/public/app/features/org/UserInviteForm.tsx b/public/app/features/org/UserInviteForm.tsx index 8863516e421..86535bf40ba 100644 --- a/public/app/features/org/UserInviteForm.tsx +++ b/public/app/features/org/UserInviteForm.tsx @@ -14,6 +14,7 @@ import { InputControl, FieldSet, Icon, + TextLink, Tooltip, Label, } from '@grafana/ui'; @@ -24,10 +25,22 @@ import { OrgRole, useDispatch } from 'app/types'; import { addInvitee } from '../invites/state/actions'; const noBasicRoleFlag = contextSrv.licensedAccessControlEnabled() && config.featureToggles.noBasicRole; - -const tooltipMessage = noBasicRoleFlag - ? 'You can now select the "No basic role" option and add permissions to your custom needs.' - : undefined; +const tooltipMessage = noBasicRoleFlag ? ( + <> + You can now select the "No basic role" option and add permissions to your custom needs. You can find more + information in  + + our documentation + + . + +) : ( + '' +); const roles: Array> = Object.values(OrgRole) .filter((r) => noBasicRoleFlag || r !== OrgRole.None) @@ -82,7 +95,7 @@ export const UserInviteForm = () => { Role {tooltipMessage && ( - {tooltipMessage}}> + )}