public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Adding action set resolver for RBAC evaluation (#86801)

Browse Source 
* add action set resolver

* rename variables

* some fixes and some tests

* more tests

* more tests, and put action set storing behind a feature toggle

* undo change from cfg to feature mgmt - will cover it in a separate PR due to the amount of test changes

* fix dependency cycle, update some tests

* add one more test

* fix for feature toggle check not being set on test configs

* linting fixes

* check that action set name can be split nicely

* clean up tests by turning GetActionSetNames into a function

* undo accidental change

* test fix

* more test fixes
This commit is contained in:
Ieva
2024-05-09 10:18:03 +01:00
committed by GitHub
parent 6380a01543
commit 105313f5c2
17 changed files with 444 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tests/api/alerting/api_alertmanager_silence_test.go
+1 -2
View File
@@ -306,8 +306,7 @@ func TestIntegrationSilenceAuth(t *testing.T) {
apiClient := newAlertingApiClient(grafanaListedAddr, randomLogin, randomLogin)
// Set permissions.
asService := resourcepermissions.NewActionSetService()
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
for _, cmd := range tt.permissions {
_, err := permissionsStore.SetUserResourcePermission(
context.Background(),
pkg/tests/api/alerting/api_backtesting_test.go
+1 -2
View File
@@ -107,9 +107,8 @@ func TestBacktesting(t *testing.T) {
require.Equalf(t, http.StatusForbidden, status, "Response: %s", body)
})
asService := resourcepermissions.NewActionSetService()
// access control permissions store
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
_, err := permissionsStore.SetUserResourcePermission(context.Background(),
accesscontrol.GlobalOrgID,
accesscontrol.User{ID: testUserId},
pkg/tests/api/alerting/api_prometheus_test.go
+1 -2
View File
@@ -674,9 +674,8 @@ func TestIntegrationPrometheusRulesPermissions(t *testing.T) {
apiClient := newAlertingApiClient(grafanaListedAddr, "grafana", "password")
asService := resourcepermissions.NewActionSetService()
// access control permissions store
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
// Create the namespace we'll save our alerts to.
apiClient.CreateFolder(t, "folder1", "folder1")
pkg/tests/api/alerting/api_ruler_test.go
+4 -8
View File
@@ -52,8 +52,7 @@ func TestIntegrationAlertRulePermissions(t *testing.T) {
})
grafanaListedAddr, env := testinfra.StartGrafanaEnv(t, dir, p)
asService := resourcepermissions.NewActionSetService()
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
// Create a user to make authenticated requests
userID := createUser(t, env.SQLStore, env.Cfg, user.CreateUserCommand{
@@ -337,8 +336,7 @@ func TestIntegrationAlertRuleNestedPermissions(t *testing.T) {
})
grafanaListedAddr, env := testinfra.StartGrafanaEnv(t, dir, p)
asService := resourcepermissions.NewActionSetService()
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
// Create a user to make authenticated requests
userID := createUser(t, env.SQLStore, env.Cfg, user.CreateUserCommand{
@@ -734,8 +732,7 @@ func TestAlertRulePostExport(t *testing.T) {
})
grafanaListedAddr, env := testinfra.StartGrafanaEnv(t, dir, p)
asService := resourcepermissions.NewActionSetService()
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
// Create a user to make authenticated requests
userID := createUser(t, env.SQLStore, env.Cfg, user.CreateUserCommand{
@@ -1415,8 +1412,7 @@ func TestIntegrationRuleUpdate(t *testing.T) {
AppModeProduction: true,
})
grafanaListedAddr, env := testinfra.StartGrafanaEnv(t, dir, path)
asService := resourcepermissions.NewActionSetService()
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
// Create a user to make authenticated requests
userID := createUser(t, env.SQLStore, env.Cfg, user.CreateUserCommand{
pkg/tests/api/alerting/api_testing_test.go
+1 -2
View File
@@ -275,8 +275,7 @@ func TestGrafanaRuleConfig(t *testing.T) {
})
// access control permissions store
asService := resourcepermissions.NewActionSetService()
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures(), &asService)
permissionsStore := resourcepermissions.NewStore(env.SQLStore, featuremgmt.WithFeatures())
_, err := permissionsStore.SetUserResourcePermission(context.Background(),
accesscontrol.GlobalOrgID,
accesscontrol.User{ID: testUserId},
pkg/tests/api/folders/api_folders_test.go
+1 -2
View File
@@ -65,8 +65,7 @@ func TestGetFolders(t *testing.T) {
viewerClient := tests.GetClient(grafanaListedAddr, "viewer", "viewer")
// access control permissions store
actionSetService := resourcepermissions.NewActionSetService()
permissionsStore := resourcepermissions.NewStore(store, featuremgmt.WithFeatures(), &actionSetService)
permissionsStore := resourcepermissions.NewStore(store, featuremgmt.WithFeatures())
numberOfFolders := 5
indexWithoutPermission := 3