From 1c679e814b1e031a351c3d2c066eb85d8633150d Mon Sep 17 00:00:00 2001 From: Karl Persson Date: Thu, 12 May 2022 17:15:18 +0200 Subject: [PATCH] AccessControl: Only return action and scope for user permissions and make them unique (#48939) * Only return action and scope for user permissions and make them unique --- pkg/services/accesscontrol/accesscontrol.go | 3 ++- pkg/services/accesscontrol/database/database.go | 8 ++------ 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/pkg/services/accesscontrol/accesscontrol.go b/pkg/services/accesscontrol/accesscontrol.go index f53ac3c8796..a1a918809db 100644 --- a/pkg/services/accesscontrol/accesscontrol.go +++ b/pkg/services/accesscontrol/accesscontrol.go @@ -21,7 +21,7 @@ type AccessControl interface { // Evaluate evaluates access to the given resources. Evaluate(ctx context.Context, user *models.SignedInUser, evaluator Evaluator) (bool, error) - // GetUserPermissions returns user permissions. + // GetUserPermissions returns user permissions with only action and scope fields set. GetUserPermissions(ctx context.Context, user *models.SignedInUser, options Options) ([]*Permission, error) // GetUserRoles returns user roles. @@ -40,6 +40,7 @@ type AccessControl interface { } type PermissionsProvider interface { + // GetUserPermissions returns user permissions with only action and scope fields set. GetUserPermissions(ctx context.Context, query GetUserPermissionsQuery) ([]*Permission, error) } diff --git a/pkg/services/accesscontrol/database/database.go b/pkg/services/accesscontrol/database/database.go index ec5ef5dbe1c..b69c7b8c858 100644 --- a/pkg/services/accesscontrol/database/database.go +++ b/pkg/services/accesscontrol/database/database.go @@ -26,13 +26,9 @@ func (s *AccessControlStore) GetUserPermissions(ctx context.Context, query acces filter, params := userRolesFilter(query.OrgID, query.UserID, query.Roles) // TODO: optimize this - q := `SELECT - permission.id, - permission.role_id, + q := `SELECT DISTINCT permission.action, - permission.scope, - permission.updated, - permission.created + permission.scope FROM permission INNER JOIN role ON role.id = permission.role_id ` + filter