public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AccessControl: Present user edit actions according to AC metadata (#43602)

Browse Source 
* AccessControl: Add user metadata to user detail view

* AccessControl: Do not present delete or disable buttons based on ac metadata in admin/users

* AccessControl: do not allow password changing or user editing without permission

* AccessControl: Fetch global:users scope for admin

* AccessControl: optimize org.user metadata fetch

* Chore: early return if ac metadata is not available
This commit is contained in:
J Guerreiro
2022-01-05 09:59:17 +01:00
committed by GitHub
parent ba58b34219
commit 056e143664
8 changed files with 85 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/org_users.go
+15 -17
View File
@@ -105,7 +105,7 @@ func (hs *HTTPServer) GetOrgUsersForCurrentOrgLookup(c *models.ReqContext) respo
return response.JSON(200, result)
}
func (hs *HTTPServer) getUserAccessControlMetadata(c *models.ReqContext, userID int64) (accesscontrol.Metadata, error) {
func (hs *HTTPServer) getUserAccessControlMetadata(c *models.ReqContext, resourceIDs map[string]bool) (map[string]accesscontrol.Metadata, error) {
if hs.AccessControl == nil || hs.AccessControl.IsDisabled() || !c.QueryBool("accesscontrol") {
return nil, nil
}
@@ -115,15 +115,7 @@ func (hs *HTTPServer) getUserAccessControlMetadata(c *models.ReqContext, userID
return nil, err
}
key := fmt.Sprintf("%d", userID)
userIDs := map[string]bool{key: true}
metadata, err := accesscontrol.GetResourcesMetadata(c.Req.Context(), userPermissions, "users", userIDs)
if err != nil {
return nil, err
}
return metadata[key], err
return accesscontrol.GetResourcesMetadata(c.Req.Context(), userPermissions, "users", resourceIDs)
}
// GET /api/orgs/:orgId/users
@@ -147,22 +139,28 @@ func (hs *HTTPServer) getOrgUsersHelper(c *models.ReqContext, query *models.GetO
}
filteredUsers := make([]*models.OrgUserDTO, 0, len(query.Result))
userIDs := map[string]bool{}
for _, user := range query.Result {
if dtos.IsHiddenUser(user.Login, signedInUser, hs.Cfg) {
continue
}
user.AvatarUrl = dtos.GetGravatarUrl(user.Email)
accessControlMetadata, errAC := hs.getUserAccessControlMetadata(c, user.UserId)
if errAC != nil {
hs.log.Error("Failed to get access control metadata", "error", errAC)
}
user.AccessControl = accessControlMetadata
userIDs[fmt.Sprint(user.UserId)] = true
filteredUsers = append(filteredUsers, user)
}
accessControlMetadata, errAC := hs.getUserAccessControlMetadata(c, userIDs)
if errAC != nil {
hs.log.Error("Failed to get access control metadata", "error", errAC)
return filteredUsers, nil
}
for i := range filteredUsers {
filteredUsers[i].AccessControl = accessControlMetadata[fmt.Sprint(filteredUsers[i].UserId)]
}
return filteredUsers, nil
}