public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chore: Update authlib (foder as top level argument) (#111800)

Browse Source
This commit is contained in:
Ryan McKinley
2025-10-01 14:40:28 +00:00
committed by GitHub
parent 3541926e5c
commit 2f2289f226
61 changed files with 181 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/authorizer.go
+4 -1
View File
@@ -85,7 +85,7 @@ type LegacyAccessClient struct {
opts map[string]ResourceAuthorizerOptions
}
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest, folder string) (claims.CheckResponse, error) {
ident, ok := id.(identity.Requester)
if !ok {
return claims.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
@@ -140,6 +140,9 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
return claims.CheckResponse{}, err
}
// NOTE: folder is looked up again in the evaluator:
// pkg/services/accesscontrol/acimpl/accesscontrol.go#L77
return claims.CheckResponse{Allowed: allowed}, nil
}
pkg/services/accesscontrol/authorizer_test.go
+6 -6
View File
@@ -24,7 +24,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Resource: "dashboards",
Namespace: "default",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, false, res.Allowed)
})
@@ -47,7 +47,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, false, res.Allowed)
@@ -70,7 +70,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Verb: "list",
Namespace: "default",
Resource: "dashboards",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
@@ -94,7 +94,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
@@ -119,7 +119,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
@@ -129,7 +129,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
Namespace: "default",
Resource: "dashboards",
Name: "1",
})
}, "")
assert.NoError(t, err)
assert.Equal(t, false, res.Allowed)
pkg/services/apiserver/auth/authorizer/resource.go
+1 -1
View File
@@ -36,7 +36,7 @@ func (r ResourceAuthorizer) Authorize(ctx context.Context, attr authorizer.Attri
Name: attr.GetName(),
Subresource: attr.GetSubresource(),
Path: attr.GetPath(),
})
}, "") // NOTE: we do not know the folder in this context
if err != nil {
return authorizer.DecisionDeny, "", err
pkg/services/authz/zanzana/client/client.go
+5 -4
View File
@@ -3,11 +3,12 @@ package client
import (
"context"
"go.opentelemetry.io/otel"
"google.golang.org/grpc"
authzlib "github.com/grafana/authlib/authz"
authzv1 "github.com/grafana/authlib/authz/proto/v1"
authlib "github.com/grafana/authlib/types"
"go.opentelemetry.io/otel"
"google.golang.org/grpc"
"github.com/grafana/grafana/pkg/infra/log"
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
@@ -36,11 +37,11 @@ func New(cc grpc.ClientConnInterface) (*Client, error) {
return c, nil
}
func (c *Client) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (c *Client) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Check")
defer span.End()
return c.authzlibclient.Check(ctx, id, req)
return c.authzlibclient.Check(ctx, id, req, folder)
}
func (c *Client) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.ListRequest) (authlib.ItemChecker, authlib.Zookie, error) {
pkg/services/authz/zanzana/client/noop.go
+1 -1
View File
@@ -16,7 +16,7 @@ func NewNoop() *NoopClient {
type NoopClient struct{}
func (nc *NoopClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (nc *NoopClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
return authlib.CheckResponse{}, nil
}
pkg/services/authz/zanzana/client/shadow_client.go
+4 -4
View File
@@ -3,9 +3,9 @@ package client
import (
"context"
authlib "github.com/grafana/authlib/types"
"github.com/prometheus/client_golang/prometheus"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
)
@@ -29,7 +29,7 @@ func WithShadowClient(accessClient authlib.AccessClient, zanzanaClient authlib.A
return client
}
func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
acResChan := make(chan authlib.CheckResponse, 1)
acErrChan := make(chan error, 1)
@@ -42,7 +42,7 @@ func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authl
defer timer.ObserveDuration()
zanzanaCtx := context.WithoutCancel(ctx)
res, err := c.zanzanaClient.Check(zanzanaCtx, id, req)
res, err := c.zanzanaClient.Check(zanzanaCtx, id, req, folder)
if err != nil {
c.logger.Error("Failed to run zanzana check", "error", err)
}
@@ -61,7 +61,7 @@ func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authl
}()
timer := prometheus.NewTimer(c.metrics.evaluationsSeconds.WithLabelValues("rbac"))
res, err := c.accessClient.Check(ctx, id, req)
res, err := c.accessClient.Check(ctx, id, req, folder)
timer.ObserveDuration()
acResChan <- res
acErrChan <- err
pkg/services/authz/zanzana/zanzana.go
+1 -3
View File
@@ -7,7 +7,6 @@ import (
openfgav1 "github.com/openfga/api/proto/openfga/v1"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
)
@@ -123,7 +122,7 @@ func MergeFolderResourceTuples(a, b *openfgav1.TupleKey) {
va.GetListValue().Values = append(va.GetListValue().Values, vb.GetListValue().Values...)
}
func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*authlib.CheckRequest, bool) {
func TranslateToCheckRequest(namespace, action, kind, name string) (*authlib.CheckRequest, bool) {
translation, ok := resourceTranslations[kind]
if !ok {
@@ -146,7 +145,6 @@ func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*aut
Group: translation.group,
Resource: translation.resource,
Name: name,
Folder: folder,
}
return req, true
pkg/services/dashboards/database/database.go
+3 -1
View File
@@ -18,6 +18,7 @@ import (
"github.com/grafana/grafana/pkg/services/dashboards"
dashver "github.com/grafana/grafana/pkg/services/dashboardversion"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/folder"
"github.com/grafana/grafana/pkg/services/libraryelements/model"
"github.com/grafana/grafana/pkg/services/quota"
"github.com/grafana/grafana/pkg/services/sqlstore"
@@ -96,6 +97,7 @@ func (d *dashboardStore) GetDashboardsByLibraryPanelUID(ctx context.Context, lib
return connectedDashboards, err
}
// nolint:gocyclo
func (d *dashboardStore) ValidateDashboardBeforeSave(ctx context.Context, dash *dashboards.Dashboard, overwrite bool) (bool, error) {
ctx, span := tracer.Start(ctx, "dashboards.database.ValidateDashboardBeforesave")
defer span.End()
@@ -107,7 +109,7 @@ func (d *dashboardStore) ValidateDashboardBeforeSave(ctx context.Context, dash *
// we don't save FolderID in kubernetes object when saving through k8s
// this block guarantees we save dashboards with folder_id and folder_uid in those cases
if !dash.IsFolder && dash.FolderUID != "" && dash.FolderID == 0 { // nolint:staticcheck
if !dash.IsFolder && dash.FolderUID != "" && dash.FolderID == 0 && dash.FolderUID != folder.GeneralFolderUID { // nolint:staticcheck
var existing dashboards.Dashboard
folderIdFound, err := sess.Where("uid=? AND org_id=?", dash.FolderUID, dash.OrgID).Get(&existing)
if err != nil {