public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Access Control: Move dashboard actions and create scope provider (#48618)

Browse Source 
* Move dashboard actions and create scope provider
This commit is contained in:
Karl Persson
2022-05-04 16:12:09 +02:00
committed by GitHub
parent 00dbea91ea
commit 2738d1c557
15 changed files with 135 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/annotation_test.go
+6 -5
View File
@@ -15,6 +15,7 @@ import (
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/annotations"
"github.com/grafana/grafana/pkg/services/dashboards"
dashboardstore "github.com/grafana/grafana/pkg/services/dashboards/database"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/sqlstore"
@@ -406,7 +407,7 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
description: "Should find all annotations when has permissions to list all annotations and read all dashboards",
permissions: map[string][]string{
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsAll},
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
dashboards.ActionDashboardsRead: {dashboards.ScopeDashboardsAll},
},
expectedAnnotationIds: []int64{dash1Annotation.Id, dash2Annotation.Id, organizationAnnotation.Id},
},
@@ -414,7 +415,7 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
description: "Should find all dashboard annotations",
permissions: map[string][]string{
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeDashboard},
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
dashboards.ActionDashboardsRead: {dashboards.ScopeDashboardsAll},
},
expectedAnnotationIds: []int64{dash1Annotation.Id, dash2Annotation.Id},
},
@@ -422,7 +423,7 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
description: "Should find only annotations from dashboards that user can read",
permissions: map[string][]string{
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeDashboard},
accesscontrol.ActionDashboardsRead: {fmt.Sprintf("dashboards:uid:%s", dash1UID)},
dashboards.ActionDashboardsRead: {fmt.Sprintf("dashboards:uid:%s", dash1UID)},
},
expectedAnnotationIds: []int64{dash1Annotation.Id},
},
@@ -437,14 +438,14 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
description: "Should find only organization annotations",
permissions: map[string][]string{
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeOrganization},
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
dashboards.ActionDashboardsRead: {dashboards.ScopeDashboardsAll},
},
expectedAnnotationIds: []int64{organizationAnnotation.Id},
},
{
description: "Should error if user doesn't have annotation read permissions",
permissions: map[string][]string{
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
dashboards.ActionDashboardsRead: {dashboards.ScopeDashboardsAll},
},
expectedError: true,
},