From 2e4c921868a3bf27630e137e62d71c7dba36921c Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Mon, 19 Dec 2022 10:25:03 -0600 Subject: [PATCH] [v9.3.x] RBAC: Fix DeleteUserPermissions not being called on Upsert org sync (#60534) RBAC: Fix DeleteUserPermissions not being called on Upsert org sync (#60531) * fix DeleteUserPermissions not being called on RemoveOrgUser * do not error out of auth flow * fix test missing service (cherry picked from commit 77786f236afe3c175026fae045d404510b7349bf) Co-authored-by: Jo --- pkg/services/login/loginservice/loginservice.go | 7 ++++--- pkg/services/login/loginservice/loginservice_test.go | 2 ++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/pkg/services/login/loginservice/loginservice.go b/pkg/services/login/loginservice/loginservice.go index 1c28ac1423c..24cd0da7b45 100644 --- a/pkg/services/login/loginservice/loginservice.go +++ b/pkg/services/login/loginservice/loginservice.go @@ -324,12 +324,13 @@ func (ls *Implementation) syncOrgRoles(ctx context.Context, usr *user.User, extU logger.Error(err.Error(), "userId", cmd.UserID, "orgId", cmd.OrgID) continue } - if err := ls.accessControl.DeleteUserPermissions(ctx, orgId, cmd.UserID); err != nil { - logger.Warn("failed to delete permissions for user", "userID", cmd.UserID, "orgID", orgId) - } return err } + + if err := ls.accessControl.DeleteUserPermissions(ctx, orgId, cmd.UserID); err != nil { + logger.Warn("failed to delete permissions for user", "error", err, "userID", cmd.UserID, "orgID", orgId) + } } // update user's default org if needed diff --git a/pkg/services/login/loginservice/loginservice_test.go b/pkg/services/login/loginservice/loginservice_test.go index edd9bade8d6..616c80d3d84 100644 --- a/pkg/services/login/loginservice/loginservice_test.go +++ b/pkg/services/login/loginservice/loginservice_test.go @@ -9,6 +9,7 @@ import ( "github.com/go-kit/log" "github.com/go-kit/log/level" "github.com/grafana/grafana/pkg/models" + "github.com/grafana/grafana/pkg/services/accesscontrol/actest" "github.com/grafana/grafana/pkg/services/login" "github.com/grafana/grafana/pkg/services/login/logintest" "github.com/grafana/grafana/pkg/services/org" @@ -56,6 +57,7 @@ func Test_syncOrgRoles_whenTryingToRemoveLastOrgLogsError(t *testing.T) { SQLStore: nil, userService: usertest.NewUserServiceFake(), orgService: orgService, + accessControl: &actest.FakeService{}, } err := login.syncOrgRoles(context.Background(), &user, &externalUser)