SecretsManager: Add roles and access control to APIs (#102456)

2025-03-19 16:30:07 +01:00
parent 616ec9831b
commit 2ade94bbf7
4 changed files with 155 additions and 19 deletions
@@ -0,0 +1,125 @@
+package secret
+
+import (
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/org"
+)
+
+const (
+	// SecureValues
+	ActionSecretSecureValuesCreate = "secret.securevalues:create" // CREATE.
+	ActionSecretSecureValuesWrite  = "secret.securevalues:write"  // UPDATE.
+	ActionSecretSecureValuesRead   = "secret.securevalues:read"   // GET + LIST.
+	ActionSecretSecureValuesDelete = "secret.securevalues:delete" // DELETE.
+
+	// Keepers
+	ActionSecretKeepersCreate = "secret.keepers:create" // CREATE.
+	ActionSecretKeepersWrite  = "secret.keepers:write"  // UPDATE.
+	ActionSecretKeepersRead   = "secret.keepers:read"   // GET + LIST.
+	ActionSecretKeepersDelete = "secret.keepers:delete" // DELETE.
+)
+
+var (
+	ScopeProviderSecretSecureValues = accesscontrol.NewScopeProvider("secret.securevalues")
+	ScopeProviderSecretKeepers      = accesscontrol.NewScopeProvider("secret.keepers")
+
+	ScopeAllSecureValues = ScopeProviderSecretSecureValues.GetResourceAllScope()
+	ScopeAllKeepers      = ScopeProviderSecretKeepers.GetResourceAllScope()
+)
+
+func RegisterAccessControlRoles(service accesscontrol.Service) error {
+	// SecureValues
+	secureValuesReader := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        "fixed:secret.securevalues:reader",
+			DisplayName: "Secrets Manager secure values reader",
+			Description: "Read and list secure values.",
+			Group:       "Secrets Manager",
+			Permissions: []accesscontrol.Permission{
+				{
+					Action: ActionSecretSecureValuesRead,
+					Scope:  ScopeAllSecureValues,
+				},
+			},
+		},
+		Grants: []string{string(org.RoleAdmin)},
+	}
+
+	secureValuesWriter := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        "fixed:secret.securevalues:writer",
+			DisplayName: "Secrets Manager secure values writer",
+			Description: "Create, update and delete secure values.",
+			Group:       "Secrets Manager",
+			Permissions: []accesscontrol.Permission{
+				{
+					Action: ActionSecretSecureValuesCreate,
+					Scope:  ScopeAllSecureValues,
+				},
+				{
+					Action: ActionSecretSecureValuesRead,
+					Scope:  ScopeAllSecureValues,
+				},
+				{
+					Action: ActionSecretSecureValuesWrite,
+					Scope:  ScopeAllSecureValues,
+				},
+				{
+					Action: ActionSecretSecureValuesDelete,
+					Scope:  ScopeAllSecureValues,
+				},
+			},
+		},
+		Grants: []string{string(org.RoleAdmin)},
+	}
+
+	// Keepers
+	keepersReader := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        "fixed:secret.keepers:reader",
+			DisplayName: "Secrets Manager keepers reader",
+			Description: "Read and list keepers.",
+			Group:       "Secrets Manager",
+			Permissions: []accesscontrol.Permission{
+				{
+					Action: ActionSecretKeepersRead,
+					Scope:  ScopeAllKeepers,
+				},
+			},
+		},
+		Grants: []string{string(org.RoleAdmin)},
+	}
+
+	keepersWriter := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        "fixed:secret.keepers:writer",
+			DisplayName: "Secrets Manager keepers writer",
+			Description: "Create, update and delete keepers.",
+			Group:       "Secrets Manager",
+			Permissions: []accesscontrol.Permission{
+				{
+					Action: ActionSecretKeepersCreate,
+					Scope:  ScopeAllKeepers,
+				},
+				{
+					Action: ActionSecretKeepersRead,
+					Scope:  ScopeAllKeepers,
+				},
+				{
+					Action: ActionSecretKeepersWrite,
+					Scope:  ScopeAllKeepers,
+				},
+				{
+					Action: ActionSecretKeepersDelete,
+					Scope:  ScopeAllKeepers,
+				},
+			},
+		},
+		Grants: []string{string(org.RoleAdmin)},
+	}
+
+	return service.DeclareFixedRoles(
+		secureValuesReader, secureValuesWriter,
+		keepersReader, keepersWriter,
+	)
+}