From 16e62965f5a4d77fb00108f8a612ccdd499e7dab Mon Sep 17 00:00:00 2001 From: Karl Persson Date: Mon, 31 Jan 2022 14:44:20 +0100 Subject: [PATCH] handle case when scope is wildcard (#44654) --- pkg/services/accesscontrol/filter.go | 4 ++-- pkg/services/accesscontrol/filter_test.go | 24 +++++++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/pkg/services/accesscontrol/filter.go b/pkg/services/accesscontrol/filter.go index 97a14354ba7..ae7fed5625c 100644 --- a/pkg/services/accesscontrol/filter.go +++ b/pkg/services/accesscontrol/filter.go @@ -30,8 +30,8 @@ func Filter(ctx context.Context, sqlID, prefix, action string, user *models.Sign var hasWildcard bool var ids []interface{} for _, scope := range user.Permissions[user.OrgId][action] { - if strings.HasPrefix(scope, prefix) { - if id := strings.TrimPrefix(scope, prefix); id == ":*" || id == ":id:*" { + if strings.HasPrefix(scope, prefix) || scope == "*" { + if id := strings.TrimPrefix(scope, prefix); id == "*" || id == ":*" || id == ":id:*" { hasWildcard = true break } diff --git a/pkg/services/accesscontrol/filter_test.go b/pkg/services/accesscontrol/filter_test.go index 76acf541663..aa71df99b0a 100644 --- a/pkg/services/accesscontrol/filter_test.go +++ b/pkg/services/accesscontrol/filter_test.go @@ -31,6 +31,22 @@ func TestFilter_Datasources(t *testing.T) { }, expectedDataSources: []string{"ds:1", "ds:2", "ds:3", "ds:4", "ds:5", "ds:6", "ds:7", "ds:8", "ds:9", "ds:10"}, }, + { + desc: "expect all data sources for wildcard id scope to be returned", + sqlID: "data_source.id", + permissions: []*accesscontrol.Permission{ + {Action: "datasources:read", Scope: "datasources:id:*"}, + }, + expectedDataSources: []string{"ds:1", "ds:2", "ds:3", "ds:4", "ds:5", "ds:6", "ds:7", "ds:8", "ds:9", "ds:10"}, + }, + { + desc: "expect all data sources for wildcard scope to be returned", + sqlID: "data_source.id", + permissions: []*accesscontrol.Permission{ + {Action: "datasources:read", Scope: "*"}, + }, + expectedDataSources: []string{"ds:1", "ds:2", "ds:3", "ds:4", "ds:5", "ds:6", "ds:7", "ds:8", "ds:9", "ds:10"}, + }, { desc: "expect no data sources to be returned", sqlID: "data_source.id", @@ -47,6 +63,14 @@ func TestFilter_Datasources(t *testing.T) { }, expectedDataSources: []string{"ds:3", "ds:7", "ds:8"}, }, + { + desc: "expect no data sources to be returned for malformed scope", + sqlID: "data_source.id", + permissions: []*accesscontrol.Permission{ + {Action: "datasources:read", Scope: "datasources:id:1*"}, + }, + expectedDataSources: []string{}, + }, { desc: "expect error if sqlID is not in the accept list", sqlID: "other.id",