public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chore: Update authlib (foder as top level argument) (#111800)

Browse Source
This commit is contained in:
Ryan McKinley
2025-10-01 14:40:28 +00:00
committed by GitHub
parent 3541926e5c
commit 2f2289f226
61 changed files with 181 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/storage/unified/resource/access.go
+3 -3
View File
@@ -107,7 +107,7 @@ func NewAuthzLimitedClient(client claims.AccessClient, opts AuthzOptions) claims
}
// Check implements claims.AccessClient.
func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest, folder string) (claims.CheckResponse, error) {
t := time.Now()
ctx, span := c.tracer.Start(ctx, "authzLimitedClient.Check", trace.WithAttributes(
attribute.String("group", req.Group),
@@ -115,7 +115,7 @@ func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req c
attribute.String("namespace", req.Namespace),
attribute.String("name", req.Name),
attribute.String("verb", req.Verb),
attribute.String("folder", req.Folder),
attribute.String("folder", folder),
attribute.Bool("fallback_used", FallbackUsed(ctx)),
))
defer span.End()
@@ -145,7 +145,7 @@ func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req c
span.SetAttributes(attribute.Bool("allowed", true))
return claims.CheckResponse{Allowed: true}, nil
}
resp, err := c.client.Check(ctx, id, req)
resp, err := c.client.Check(ctx, id, req, folder)
if err != nil {
c.logger.Error("Check", "group", req.Group, "resource", req.Resource, "error", err, "duration", time.Since(t), "traceid", trace.SpanContextFromContext(ctx).TraceID().String())
c.metrics.errorsTotal.WithLabelValues(req.Group, req.Resource, req.Verb).Inc()
pkg/storage/unified/resource/access_test.go
+3 -3
View File
@@ -34,7 +34,7 @@ func TestAuthzLimitedClient_Check(t *testing.T) {
Verb: utils.VerbGet,
Namespace: "stacks-1",
}
resp, err := client.Check(context.Background(), &identity.StaticRequester{Namespace: "stacks-1"}, req)
resp, err := client.Check(context.Background(), &identity.StaticRequester{Namespace: "stacks-1"}, req, "")
assert.NoError(t, err)
assert.Equal(t, test.expected, resp.Allowed)
}
@@ -135,7 +135,7 @@ func TestNamespaceMatching(t *testing.T) {
// Create a mock auth info with the specified namespace
// Test Check method
user := &identity.StaticRequester{Namespace: tt.authNamespace}
_, checkErr := client.Check(ctx, user, checkReq)
_, checkErr := client.Check(ctx, user, checkReq, "")
// Test Compile method
compileReq := authlib.ListRequest{
@@ -199,7 +199,7 @@ func TestNamespaceMatchingFallback(t *testing.T) {
// Create a mock auth info with the specified namespace
// Test Check method
user := &identity.StaticRequester{Namespace: tt.authNamespace}
_, checkErr := client.Check(ctx, user, checkReq)
_, checkErr := client.Check(ctx, user, checkReq, "")
// Test Compile method
compileReq := authlib.ListRequest{
pkg/storage/unified/resource/bulk.go
+1 -1
View File
@@ -190,7 +190,7 @@ func (s *server) BulkProcess(stream resourcepb.BulkStore_BulkProcessServer) erro
Group: k.Group,
Resource: k.Resource,
Verb: utils.VerbDeleteCollection,
})
}, "")
if err != nil || !rsp.Allowed {
return sendAndClose(&resourcepb.BulkResponse{
Error: &resourcepb.ErrorResult{
pkg/storage/unified/resource/server.go
+6 -15
View File
@@ -22,7 +22,6 @@ import (
claims "github.com/grafana/authlib/types"
"github.com/grafana/dskit/backoff"
"github.com/grafana/grafana/pkg/apimachinery/utils"
"github.com/grafana/grafana/pkg/apimachinery/validation"
secrets "github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
@@ -558,8 +557,7 @@ func (s *server) newEvent(ctx context.Context, user claims.AuthInfo, key *resour
check.Name = key.Name
}
check.Folder = obj.GetFolder()
a, err := s.access.Check(ctx, user, check)
a, err := s.access.Check(ctx, user, check, obj.GetFolder())
if err != nil {
return nil, AsErrorResult(err)
}
@@ -596,10 +594,9 @@ func (s *server) checkFolderMovePermissions(ctx context.Context, user claims.Aut
Resource: key.Resource,
Namespace: key.Namespace,
Name: key.Name,
Folder: oldFolder,
}
a, err := s.access.Check(ctx, user, updateCheck)
a, err := s.access.Check(ctx, user, updateCheck, oldFolder)
if err != nil {
return AsErrorResult(err)
}
@@ -616,10 +613,10 @@ func (s *server) checkFolderMovePermissions(ctx context.Context, user claims.Aut
Group: key.Group,
Resource: key.Resource,
Namespace: key.Namespace,
Folder: newFolder,
Name: key.Name,
}
a, err = s.access.Check(ctx, user, createCheck)
a, err = s.access.Check(ctx, user, createCheck, newFolder)
if err != nil {
return AsErrorResult(err)
}
@@ -809,8 +806,7 @@ func (s *server) delete(ctx context.Context, user claims.AuthInfo, req *resource
Resource: req.Key.Resource,
Namespace: req.Key.Namespace,
Name: req.Key.Name,
Folder: latest.Folder,
})
}, latest.Folder)
if err != nil {
rsp.Error = AsErrorResult(err)
return rsp, nil
@@ -876,10 +872,6 @@ func (s *server) Read(ctx context.Context, req *resourcepb.ReadRequest) (*resour
}}, nil
}
// if req.Key.Group == "" {
// status, _ := AsErrorResult(apierrors.NewBadRequest("missing group"))
// return &ReadResponse{Status: status}, nil
// }
if req.Key.Resource == "" {
return &resourcepb.ReadResponse{Error: NewBadRequestError("missing resource")}, nil
}
@@ -912,8 +904,7 @@ func (s *server) read(ctx context.Context, user claims.AuthInfo, req *resourcepb
Resource: req.Key.Resource,
Namespace: req.Key.Namespace,
Name: req.Key.Name,
Folder: rsp.Folder,
})
}, rsp.Folder)
if err != nil {
return &resourcepb.ReadResponse{Error: AsErrorResult(err)}, nil
}
pkg/storage/unified/search/bleve_test.go
+3 -2
View File
@@ -15,7 +15,6 @@ import (
"time"
"github.com/blevesearch/bleve/v2"
authlib "github.com/grafana/authlib/types"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/testutil"
"github.com/stretchr/testify/assert"
@@ -23,6 +22,8 @@ import (
"go.uber.org/atomic"
"go.uber.org/goleak"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
"github.com/grafana/grafana/pkg/infra/log/logtest"
@@ -652,7 +653,7 @@ type StubAccessClient struct {
resourceResponses map[string]bool // key is the resource name, and bool if what the checker will return
}
func (nc *StubAccessClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
func (nc *StubAccessClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest, folder string) (authlib.CheckResponse, error) {
return authlib.CheckResponse{Allowed: nc.resourceResponses[req.Resource]}, nil
}
pkg/storage/unified/testing/server.go
+17 -9
View File
@@ -125,12 +125,15 @@ func runTestResourcePermissionScenarios(t *testing.T, backend resource.StorageBa
resourceUID := fmt.Sprintf("test123-%d", i)
// Create a mock access client with the test case's permission map
checksPerformed := []types.CheckRequest{}
checksPerformed := []CheckRequestEX{}
mockAccess := &mockAccessClient{
allowed: false, // Default to false
allowedMap: tc.permissionMap,
checkFn: func(req types.CheckRequest) {
checksPerformed = append(checksPerformed, req)
checkFn: func(req types.CheckRequest, folder string) {
checksPerformed = append(checksPerformed, CheckRequestEX{
CheckRequest: req,
Folder: folder,
})
},
}
@@ -167,7 +170,7 @@ func runTestResourcePermissionScenarios(t *testing.T, backend resource.StorageBa
}
}`, resourceName, resourceUID, nsPrefix+"-ns1", tc.initialFolder, i)
checksPerformed = []types.CheckRequest{}
checksPerformed = []CheckRequestEX{}
created, err := server.Create(ctx, &resourcepb.CreateRequest{
Value: []byte(resourceJSON),
Key: key,
@@ -232,7 +235,7 @@ func runTestResourcePermissionScenarios(t *testing.T, backend resource.StorageBa
}`, resourceName, resourceUID, nsPrefix+"-ns1", tc.targetFolder, i)
mockAccess.allowed = false // Reset to use the map
checksPerformed = []types.CheckRequest{}
checksPerformed = []CheckRequestEX{}
updated, err := server.Update(ctx, &resourcepb.UpdateRequest{
Key: key,
@@ -494,18 +497,18 @@ func runTestListTrashAccessControl(t *testing.T, backend resource.StorageBackend
type mockAccessClient struct {
allowed bool
allowedMap map[string]bool
checkFn func(types.CheckRequest)
checkFn func(types.CheckRequest, string)
compileFn func(user types.AuthInfo, req types.ListRequest) types.ItemChecker
}
func (m *mockAccessClient) Check(ctx context.Context, user types.AuthInfo, req types.CheckRequest) (types.CheckResponse, error) {
func (m *mockAccessClient) Check(ctx context.Context, user types.AuthInfo, req types.CheckRequest, folder string) (types.CheckResponse, error) {
if m.checkFn != nil {
m.checkFn(req)
m.checkFn(req, folder)
}
// Check specific folder:verb mappings if provided
if m.allowedMap != nil {
key := fmt.Sprintf("%s:%s", req.Folder, req.Verb)
key := fmt.Sprintf("%s:%s", folder, req.Verb)
if allowed, exists := m.allowedMap[key]; exists {
return types.CheckResponse{Allowed: allowed}, nil
}
@@ -526,3 +529,8 @@ func (m *mockAccessClient) Compile(ctx context.Context, user types.AuthInfo, req
return m.allowed
}, types.NoopZookie{}, nil
}
type CheckRequestEX struct {
types.CheckRequest
Folder string
}