public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: use IdentityType from authlib (#91763)

Browse Source
This commit is contained in:
Ryan McKinley
2024-08-12 09:26:53 +03:00
committed by GitHub
parent faf7cb9312
commit 21d4a4f49e
70 changed files with 230 additions and 212 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/admin_users.go
+2 -1
View File
@@ -8,6 +8,7 @@ import (
"golang.org/x/sync/errgroup"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/apimachinery/identity"
@@ -366,7 +367,7 @@ func (hs *HTTPServer) AdminLogoutUser(c *contextmodel.ReqContext) response.Respo
return response.Error(http.StatusBadRequest, "id is invalid", err)
}
if c.SignedInUser.GetID() == identity.NewTypedID(identity.TypeUser, userID) {
if c.SignedInUser.GetID() == identity.NewTypedID(claims.TypeUser, userID) {
return response.Error(http.StatusBadRequest, "You cannot logout yourself", nil)
}
pkg/api/dashboard.go
+2 -1
View File
@@ -11,6 +11,7 @@ import (
"strconv"
"strings"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/apierrors"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
@@ -43,7 +44,7 @@ func (hs *HTTPServer) isDashboardStarredByUser(c *contextmodel.ReqContext, dashI
return false, nil
}
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
return false, nil
}
pkg/api/folder.go
+2 -1
View File
@@ -6,6 +6,7 @@ import (
"net/http"
"strconv"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/apierrors"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
@@ -194,7 +195,7 @@ func (hs *HTTPServer) setDefaultFolderPermissions(ctx context.Context, orgID int
var permissions []accesscontrol.SetResourcePermissionCommand
if identity.IsIdentityType(user.GetID(), identity.TypeUser) {
if identity.IsIdentityType(user.GetID(), claims.TypeUser) {
userID, err := identity.UserIdentifier(user.GetID())
if err != nil {
return err
pkg/api/index.go
+2 -1
View File
@@ -8,6 +8,7 @@ import (
"net/http"
"strings"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/webassets"
"github.com/grafana/grafana/pkg/apimachinery/identity"
@@ -170,7 +171,7 @@ func (hs *HTTPServer) setIndexViewData(c *contextmodel.ReqContext) (*dtos.IndexV
func (hs *HTTPServer) buildUserAnalyticsSettings(c *contextmodel.ReqContext) dtos.AnalyticsSettings {
// Anonymous users do not have an email or auth info
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
return dtos.AnalyticsSettings{Identifier: "@" + hs.Cfg.AppURL}
}
pkg/api/org.go
+2 -1
View File
@@ -6,6 +6,7 @@ import (
"net/http"
"strconv"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/apimachinery/identity"
@@ -132,7 +133,7 @@ func (hs *HTTPServer) CreateOrg(c *contextmodel.ReqContext) response.Response {
return response.Error(http.StatusBadRequest, "bad request data", err)
}
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
return response.Error(http.StatusForbidden, "Only users can create organizations", nil)
}
pkg/api/pluginproxy/ds_proxy_test.go
+2 -1
View File
@@ -19,6 +19,7 @@ import (
"github.com/stretchr/testify/require"
"golang.org/x/oauth2"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/datasource"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/components/simplejson"
@@ -586,7 +587,7 @@ func TestDataSourceProxy_routeRule(t *testing.T) {
&contextmodel.ReqContext{
SignedInUser: &user.SignedInUser{
Login: "test_user",
FallbackType: identity.TypeUser,
FallbackType: claims.TypeUser,
UserID: 1,
},
},
pkg/api/pluginproxy/pluginproxy_test.go
+2 -2
View File
@@ -12,7 +12,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/plugins"
"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
@@ -79,7 +79,7 @@ func TestPluginProxy(t *testing.T) {
&contextmodel.ReqContext{
SignedInUser: &user.SignedInUser{
Login: "test_user",
FallbackType: identity.TypeUser,
FallbackType: claims.TypeUser,
UserID: 1,
},
Context: &web.Context{
pkg/api/user.go
+5 -4
View File
@@ -8,6 +8,7 @@ import (
"strconv"
"strings"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/apimachinery/identity"
@@ -31,7 +32,7 @@ import (
// 404: notFoundError
// 500: internalServerError
func (hs *HTTPServer) GetSignedInUser(c *contextmodel.ReqContext) response.Response {
if !identity.IsIdentityType(c.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.GetID(), claims.TypeUser) {
return response.JSON(http.StatusOK, user.UserProfileDTO{
IsGrafanaAdmin: c.SignedInUser.GetIsGrafanaAdmin(),
OrgID: c.SignedInUser.GetOrgID(),
@@ -277,7 +278,7 @@ func (hs *HTTPServer) handleUpdateUser(ctx context.Context, cmd user.UpdateUserC
}
func (hs *HTTPServer) StartEmailVerificaton(c *contextmodel.ReqContext) response.Response {
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
return response.Error(http.StatusBadRequest, "Only users can verify their email", nil)
}
@@ -504,7 +505,7 @@ func (hs *HTTPServer) ChangeActiveOrgAndRedirectToHome(c *contextmodel.ReqContex
return
}
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
c.JsonApiErr(http.StatusForbidden, "Endpoint only available for users", nil)
return
}
@@ -629,7 +630,7 @@ func (hs *HTTPServer) ClearHelpFlags(c *contextmodel.ReqContext) response.Respon
}
func getUserID(c *contextmodel.ReqContext) (int64, *response.NormalResponse) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
return 0, response.Error(http.StatusForbidden, "Endpoint only available for users", nil)
}
pkg/api/user_token.go
+3 -2
View File
@@ -8,6 +8,7 @@ import (
"github.com/ua-parser/uap-go/uaparser"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/apimachinery/identity"
@@ -32,7 +33,7 @@ import (
// 403: forbiddenError
// 500: internalServerError
func (hs *HTTPServer) GetUserAuthTokens(c *contextmodel.ReqContext) response.Response {
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
return response.Error(http.StatusForbidden, "entity not allowed to get tokens", nil)
}
@@ -62,7 +63,7 @@ func (hs *HTTPServer) RevokeUserAuthToken(c *contextmodel.ReqContext) response.R
return response.Error(http.StatusBadRequest, "bad request data", err)
}
if !identity.IsIdentityType(c.SignedInUser.GetID(), identity.TypeUser) {
if !identity.IsIdentityType(c.SignedInUser.GetID(), claims.TypeUser) {
return response.Error(http.StatusForbidden, "entity not allowed to revoke tokens", nil)
}