public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Zanzana: Use authz client (#104037)

Browse Source 
* Zanzana: use client from authzlib

* update go.sum

* use user UID for debugging

* Remove unused function
This commit is contained in:
Alexander Zobnin
2025-04-24 10:57:24 +02:00
committed by GitHub
parent 356c979328
commit 1584349b99
2 changed files with 14 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/zanzana/client/client.go
+12 -64
View File
@@ -3,12 +3,12 @@ package client
import (
"context"
authzlib "github.com/grafana/authlib/authz"
authzv1 "github.com/grafana/authlib/authz/proto/v1"
authlib "github.com/grafana/authlib/types"
"go.opentelemetry.io/otel"
"google.golang.org/grpc"
"github.com/grafana/grafana/pkg/apimachinery/utils"
"github.com/grafana/grafana/pkg/infra/log"
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
)
@@ -18,16 +18,19 @@ var _ authlib.AccessClient = (*Client)(nil)
var tracer = otel.Tracer("github.com/grafana/grafana/pkg/services/authz/zanzana/client")
type Client struct {
logger log.Logger
authz authzv1.AuthzServiceClient
authzext authzextv1.AuthzExtentionServiceClient
logger log.Logger
authz authzv1.AuthzServiceClient
authzext authzextv1.AuthzExtentionServiceClient
authzlibclient *authzlib.ClientImpl
}
func New(cc grpc.ClientConnInterface) (*Client, error) {
authzlibclient := authzlib.NewClient(cc, authzlib.WithTracerClientOption(tracer))
c := &Client{
authz: authzv1.NewAuthzServiceClient(cc),
authzext: authzextv1.NewAuthzExtentionServiceClient(cc),
logger: log.New("zanzana-client"),
authzlibclient: authzlibclient,
authz: authzv1.NewAuthzServiceClient(cc),
authzext: authzextv1.NewAuthzExtentionServiceClient(cc),
logger: log.New("zanzana-client"),
}
return c, nil
@@ -37,69 +40,14 @@ func (c *Client) Check(ctx context.Context, id authlib.AuthInfo, req authlib.Che
ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Check")
defer span.End()
res, err := c.authz.Check(ctx, &authzv1.CheckRequest{
Subject: id.GetUID(),
Verb: req.Verb,
Group: req.Group,
Resource: req.Resource,
Namespace: req.Namespace,
Name: req.Name,
Subresource: req.Subresource,
Path: req.Path,
Folder: req.Folder,
})
if err != nil {
return authlib.CheckResponse{}, err
}
return authlib.CheckResponse{Allowed: res.GetAllowed()}, nil
return c.authzlibclient.Check(ctx, id, req)
}
func (c *Client) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.ListRequest) (authlib.ItemChecker, error) {
ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Compile")
defer span.End()
res, err := c.authz.List(ctx, &authzv1.ListRequest{
Subject: id.GetUID(),
Group: req.Group,
Verb: utils.VerbList,
Resource: req.Resource,
Namespace: req.Namespace,
})
if err != nil {
return nil, err
}
return newItemChecker(res), nil
}
func newItemChecker(res *authzv1.ListResponse) authlib.ItemChecker {
// if we can see all resource of this type we can just return a function that always return true
if res.GetAll() {
return func(_, _ string) bool { return true }
}
folders := make(map[string]struct{}, len(res.Folders))
for _, f := range res.Folders {
folders[f] = struct{}{}
}
items := make(map[string]struct{}, len(res.Items))
for _, i := range res.Items {
items[i] = struct{}{}
}
return func(name, folder string) bool {
if _, ok := items[name]; ok {
return true
}
if _, ok := folders[folder]; ok {
return true
}
return false
}
return c.authzlibclient.Compile(ctx, id, req)
}
func (c *Client) Read(ctx context.Context, req *authzextv1.ReadRequest) (*authzextv1.ReadResponse, error) {
pkg/services/authz/zanzana/client/shadow_client.go
+2 -2
View File
@@ -51,7 +51,7 @@ func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authl
if acErr == nil {
if res.Allowed != acRes.Allowed {
c.metrics.evaluationStatusTotal.WithLabelValues("error").Inc()
c.logger.Warn("Zanzana check result does not match", "expected", acRes.Allowed, "actual", res.Allowed)
c.logger.Warn("Zanzana check result does not match", "expected", acRes.Allowed, "actual", res.Allowed, "user", id.GetUID(), "request", req)
} else {
c.metrics.evaluationStatusTotal.WithLabelValues("success").Inc()
}
@@ -99,7 +99,7 @@ func (c *ShadowClient) Compile(ctx context.Context, id authlib.AuthInfo, req aut
zanzanaRes := zanzanaItemChecker(name, folder)
if zanzanaRes != rbacRes {
c.metrics.evaluationStatusTotal.WithLabelValues("error").Inc()
c.logger.Warn("Zanzana compile result does not match", "expected", rbacRes, "actual", zanzanaRes)
c.logger.Warn("Zanzana compile result does not match", "expected", rbacRes, "actual", zanzanaRes, "name", name, "folder", folder)
} else {
c.metrics.evaluationStatusTotal.WithLabelValues("success").Inc()
}