From 0176ead117668390d1dd12add7909c2b1c9971c5 Mon Sep 17 00:00:00 2001 From: Aaron Godin Date: Thu, 22 Aug 2024 05:26:46 -0500 Subject: [PATCH] feat: Add new read filtering to datasources guardian (#91345) * feat: Add new read filtering to datasources guardian * Apply suggestion to use datasources read guardian check for frontend settings --------- Co-authored-by: Eric Leijonmarck --- pkg/api/datasources.go | 2 +- pkg/api/frontendsettings.go | 2 +- pkg/services/datasources/guardian/allow_guardian.go | 4 ++++ pkg/services/datasources/guardian/provider.go | 1 + 4 files changed, 7 insertions(+), 2 deletions(-) diff --git a/pkg/api/datasources.go b/pkg/api/datasources.go index bb79dd6aee7..2a6b3bfd4b8 100644 --- a/pkg/api/datasources.go +++ b/pkg/api/datasources.go @@ -54,7 +54,7 @@ func (hs *HTTPServer) GetDataSources(c *contextmodel.ReqContext) response.Respon return response.Error(http.StatusInternalServerError, "Failed to query datasources", err) } - filtered, err := hs.dsGuardian.New(c.SignedInUser.OrgID, c.SignedInUser).FilterDatasourcesByQueryPermissions(dataSources) + filtered, err := hs.dsGuardian.New(c.SignedInUser.OrgID, c.SignedInUser).FilterDatasourcesByReadPermissions(dataSources) if err != nil { return response.Error(http.StatusInternalServerError, "Failed to query datasources", err) } diff --git a/pkg/api/frontendsettings.go b/pkg/api/frontendsettings.go index 9bf8c35ef75..8f08f6528de 100644 --- a/pkg/api/frontendsettings.go +++ b/pkg/api/frontendsettings.go @@ -410,7 +410,7 @@ func (hs *HTTPServer) getFSDataSources(c *contextmodel.ReqContext, availablePlug // If RBAC is enabled, it will filter out all datasources for a public user, so we need to skip it orgDataSources = dataSources } else { - filtered, err := hs.dsGuardian.New(c.SignedInUser.OrgID, c.SignedInUser).FilterDatasourcesByQueryPermissions(dataSources) + filtered, err := hs.dsGuardian.New(c.SignedInUser.OrgID, c.SignedInUser).FilterDatasourcesByReadPermissions(dataSources) if err != nil { return nil, err } diff --git a/pkg/services/datasources/guardian/allow_guardian.go b/pkg/services/datasources/guardian/allow_guardian.go index add832b43cb..a6a1e5ac257 100644 --- a/pkg/services/datasources/guardian/allow_guardian.go +++ b/pkg/services/datasources/guardian/allow_guardian.go @@ -17,3 +17,7 @@ func (n AllowGuardian) CanQuery(datasourceID int64) (bool, error) { func (n AllowGuardian) FilterDatasourcesByQueryPermissions(ds []*datasources.DataSource) ([]*datasources.DataSource, error) { return ds, nil } + +func (n AllowGuardian) FilterDatasourcesByReadPermissions(ds []*datasources.DataSource) ([]*datasources.DataSource, error) { + return ds, nil +} diff --git a/pkg/services/datasources/guardian/provider.go b/pkg/services/datasources/guardian/provider.go index 261d7d02755..bc32282f0a1 100644 --- a/pkg/services/datasources/guardian/provider.go +++ b/pkg/services/datasources/guardian/provider.go @@ -11,6 +11,7 @@ type DatasourceGuardianProvider interface { type DatasourceGuardian interface { CanQuery(datasourceID int64) (bool, error) + FilterDatasourcesByReadPermissions([]*datasources.DataSource) ([]*datasources.DataSource, error) FilterDatasourcesByQueryPermissions([]*datasources.DataSource) ([]*datasources.DataSource, error) }