RBAC: Allow role registration for plugins (#57387)

* Picking role registration from OnCall POC branch * Fix test * Remove include actions from this PR * Removing unused permission * Adding test to DeclarePluginRoles * Add testcase to RegisterFixed role * Additional test case * Adding tests to validate plugins roles * Add test to plugin loader * Nit. * Scuemata validation * Changing the design to decouple accesscontrol from plugin management Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * Fixing tests Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Add missing files Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Remove feature toggle check from loader * Remove feature toggleimport * Feedback Co-Authored-By: marefr <marcus.efraimsson@gmail.com> * Fix test' * Make plugins.RoleRegistry interface typed * Remove comment question * No need for json tags anymore * Nit. log * Adding the schema validation * Remove group to take plugin Name instead * Revert sqlstore -> db * Nit. * Nit. on tests Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Update pkg/services/accesscontrol/plugins.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Log message Co-Authored-By: marefr <marcus.efraimsson@gmail.com> * Log message Co-Authored-By: marefr <marcus.efraimsson@gmail.com> * Remove unecessary method. Update test name. Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Fix linting * Update cue descriptions * Fix test Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: marefr <marcus.efraimsson@gmail.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
2022-11-07 11:30:45 +01:00
parent 334b498632
commit 30fae33f66
22 changed files with 852 additions and 32 deletions
@@ -131,6 +131,51 @@ seqs: [
 				// in all orgs
 				autoEnabled?: bool

+				// Optional list of RBAC RoleRegistrations.
+				// Describes and organizes the default permissions associated with any of the Grafana basic roles, 
+				// which characterizes what viewers, editors, admins, or grafana admins can do on the plugin.
+				// The Admin basic role inherits its default permissions from the Editor basic role which in turn
+				// inherits them from the Viewer basic role.
+				roles?: [...#RoleRegistration]
+
+				// RoleRegistration describes an RBAC role and its assignments to basic roles.
+				// It organizes related RBAC permissions on the plugin into a role and defines which basic roles
+				// will get them by default.
+				// Example: the role 'Schedules Reader' bundles permissions to view all schedules of the plugin
+				// which will be granted to Admins by default.
+				#RoleRegistration: {
+					// RBAC role definition to bundle related RBAC permissions on the plugin.
+					role: #Role
+
+					// Default assignment of the role to Grafana basic roles (Viewer, Editor, Admin, Grafana Admin)
+					// The Admin basic role inherits its default permissions from the Editor basic role which in turn
+					// inherits them from the Viewer basic role.
+					grants: [...#BasicRole]
+				}
+
+				// Role describes an RBAC role which allows grouping multiple related permissions on the plugin,
+				// each of which has an action and an optional scope.
+				// Example: the role 'Schedules Reader' bundles permissions to view all schedules of the plugin.
+				#Role: {
+					name: string,
+					displayName: string,
+					description: string,
+					permissions: [...#Permission]
+				}
+
+				// Permission describes an RBAC permission on the plugin. A permission has an action and an option
+				// scope.
+				// Example: action: 'test-app.schedules:read', scope: 'test-app.schedules:*'
+				#Permission: {
+					action: string,
+					scope?: string
+				}
+
+				// BasicRole is a Grafana basic role, which can be 'Viewer', 'Editor', 'Admin' or 'Grafana Admin'.
+				// With RBAC, the Admin basic role inherits its default permissions from the Editor basic role which
+				// in turn inherits them from the Viewer basic role.
+				#BasicRole: "Grafana Admin" | "Admin" | "Editor" | "Viewer"
+
 				// Dependencies needed by the plugin.
 				dependencies: #Dependencies

@@ -49,6 +49,17 @@ const (
 	TypeSecretsmanager Type = "secretsmanager"
 )

+// Defines values for BasicRole.
+const (
+	BasicRoleAdmin BasicRole = "Admin"
+
+	BasicRoleEditor BasicRole = "Editor"
+
+	BasicRoleGrafanaAdmin BasicRole = "Grafana Admin"
+
+	BasicRoleViewer BasicRole = "Viewer"
+)
+
 // Defines values for DependencyType.
 const (
 	DependencyTypeApp DependencyType = "app"
@@ -95,6 +106,17 @@ const (
 	ReleaseStateStable ReleaseState = "stable"
 )

+// Defines values for RoleRegistrationGrants.
+const (
+	RoleRegistrationGrantsAdmin RoleRegistrationGrants = "Admin"
+
+	RoleRegistrationGrantsEditor RoleRegistrationGrants = "Editor"
+
+	RoleRegistrationGrantsGrafanaAdmin RoleRegistrationGrants = "Grafana Admin"
+
+	RoleRegistrationGrantsViewer RoleRegistrationGrants = "Viewer"
+)
+
 // Model is the Go representation of a pluginmeta.
 //
 // THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
@@ -255,6 +277,13 @@ type Model struct {
 		MinInterval *bool `json:"minInterval,omitempty"`
 	} `json:"queryOptions,omitempty"`

+	// Optional list of RBAC RoleRegistrations.
+	// Describes and organizes the default permissions associated with any of the Grafana basic roles,
+	// which characterizes what viewers, editors, admins, or grafana admins can do on the plugin.
+	// The Admin basic role inherits its default permissions from the Editor basic role which in turn
+	// inherits them from the Viewer basic role.
+	Roles *[]RoleRegistration `json:"roles,omitempty"`
+
 	// Routes is a list of proxy routes, if any. For datasource plugins only.
 	Routes *[]Route `json:"routes,omitempty"`

@@ -291,6 +320,14 @@ type Category string
 // Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
 type Type string

+// BasicRole is a Grafana basic role, which can be 'Viewer', 'Editor', 'Admin' or 'Grafana Admin'.
+// With RBAC, the Admin basic role inherits its default permissions from the Editor basic role which
+// in turn inherits them from the Viewer basic role.
+//
+// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
+// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
+type BasicRole string
+
 // BuildInfo is the Go representation of a pluginmeta.BuildInfo.
 //
 // THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
@@ -475,12 +512,71 @@ type JWTTokenAuth struct {
 	Url string `json:"url"`
 }

+// Permission describes an RBAC permission on the plugin. A permission has an action and an option
+// scope.
+// Example: action: 'test-app.schedules:read', scope: 'test-app.schedules:*'
+//
+// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
+// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
+type Permission struct {
+	Action string  `json:"action"`
+	Scope  *string `json:"scope,omitempty"`
+}
+
 // ReleaseState indicates release maturity state of a plugin.
 //
 // THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
 // Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
 type ReleaseState string

+// Role describes an RBAC role which allows grouping multiple related permissions on the plugin,
+// each of which has an action and an optional scope.
+// Example: the role 'Schedules Reader' bundles permissions to view all schedules of the plugin.
+//
+// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
+// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
+type Role struct {
+	Description string `json:"description"`
+	DisplayName string `json:"displayName"`
+	Name        string `json:"name"`
+	Permissions []struct {
+		Action string  `json:"action"`
+		Scope  *string `json:"scope,omitempty"`
+	} `json:"permissions"`
+}
+
+// RoleRegistration describes an RBAC role and its assignments to basic roles.
+// It organizes related RBAC permissions on the plugin into a role and defines which basic roles
+// will get them by default.
+// Example: the role 'Schedules Reader' bundles permissions to view all schedules of the plugin
+// which will be granted to Admins by default.
+//
+// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
+// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
+type RoleRegistration struct {
+	// Default assignment of the role to Grafana basic roles (Viewer, Editor, Admin, Grafana Admin)
+	// The Admin basic role inherits its default permissions from the Editor basic role which in turn
+	// inherits them from the Viewer basic role.
+	Grants []RoleRegistrationGrants `json:"grants"`
+
+	// RBAC role definition to bundle related RBAC permissions on the plugin.
+	Role struct {
+		Description string `json:"description"`
+		DisplayName string `json:"displayName"`
+		Name        string `json:"name"`
+		Permissions []struct {
+			Action string  `json:"action"`
+			Scope  *string `json:"scope,omitempty"`
+		} `json:"permissions"`
+	} `json:"role"`
+}
+
+// RoleRegistrationGrants is the Go representation of a RoleRegistration.Grants.
+//
+// THIS TYPE IS INTENDED FOR INTERNAL USE BY THE GRAFANA BACKEND, AND IS SUBJECT TO BREAKING CHANGES.
+// Equivalent Go types at stable import paths are provided in https://github.com/grafana/grok.
+type RoleRegistrationGrants string
+
 // A proxy route used in datasource plugins for plugin authentication
 // and adding headers to HTTP requests made by the plugin.
 // For more information, refer to [Authentication for data source