RBAC: Allow role registration for plugins (#57387)

* Picking role registration from OnCall POC branch * Fix test * Remove include actions from this PR * Removing unused permission * Adding test to DeclarePluginRoles * Add testcase to RegisterFixed role * Additional test case * Adding tests to validate plugins roles * Add test to plugin loader * Nit. * Scuemata validation * Changing the design to decouple accesscontrol from plugin management Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * Fixing tests Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Add missing files Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Remove feature toggle check from loader * Remove feature toggleimport * Feedback Co-Authored-By: marefr <marcus.efraimsson@gmail.com> * Fix test' * Make plugins.RoleRegistry interface typed * Remove comment question * No need for json tags anymore * Nit. log * Adding the schema validation * Remove group to take plugin Name instead * Revert sqlstore -> db * Nit. * Nit. on tests Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Update pkg/services/accesscontrol/plugins.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Log message Co-Authored-By: marefr <marcus.efraimsson@gmail.com> * Log message Co-Authored-By: marefr <marcus.efraimsson@gmail.com> * Remove unecessary method. Update test name. Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Fix linting * Update cue descriptions * Fix test Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: marefr <marcus.efraimsson@gmail.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
2022-11-07 11:30:45 +01:00
parent 334b498632
commit 30fae33f66
22 changed files with 852 additions and 32 deletions
@@ -0,0 +1,62 @@
+package pluginutils
+
+import (
+	"strings"
+
+	"github.com/grafana/grafana/pkg/plugins"
+	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
+)
+
+// ValidatePluginPermissions errors when a permission does not match expected pattern for plugins
+func ValidatePluginPermissions(pluginID string, permissions []ac.Permission) error {
+	for i := range permissions {
+		if permissions[i].Action != plugins.ActionAppAccess &&
+			!strings.HasPrefix(permissions[i].Action, pluginID+":") &&
+			!strings.HasPrefix(permissions[i].Action, pluginID+".") {
+			return &ac.ErrorActionPrefixMissing{Action: permissions[i].Action,
+				Prefixes: []string{plugins.ActionAppAccess, pluginID + ":", pluginID + "."}}
+		}
+	}
+
+	return nil
+}
+
+// ValidatePluginRole errors when a plugin role does not match expected pattern
+// or doesn't have permissions matching the expected pattern.
+func ValidatePluginRole(pluginID string, role ac.RoleDTO) error {
+	if pluginID == "" {
+		return ac.ErrPluginIDRequired
+	}
+	if !strings.HasPrefix(role.Name, ac.PluginRolePrefix+pluginID+":") {
+		return &ac.ErrorRolePrefixMissing{Role: role.Name, Prefixes: []string{ac.PluginRolePrefix + pluginID + ":"}}
+	}
+
+	return ValidatePluginPermissions(pluginID, role.Permissions)
+}
+
+func ToRegistrations(pluginName string, regs []plugins.RoleRegistration) []ac.RoleRegistration {
+	res := make([]ac.RoleRegistration, 0, len(regs))
+	for i := range regs {
+		res = append(res, ac.RoleRegistration{
+			Role: ac.RoleDTO{
+				Version:     1,
+				Name:        regs[i].Role.Name,
+				DisplayName: regs[i].Role.DisplayName,
+				Description: regs[i].Role.Description,
+				Group:       pluginName,
+				Permissions: toPermissions(regs[i].Role.Permissions),
+				OrgID:       ac.GlobalOrgID,
+			},
+			Grants: regs[i].Grants,
+		})
+	}
+	return res
+}
+
+func toPermissions(perms []plugins.Permission) []ac.Permission {
+	res := make([]ac.Permission, 0, len(perms))
+	for i := range perms {
+		res = append(res, ac.Permission{Action: perms[i].Action, Scope: perms[i].Scope})
+	}
+	return res
+}
@@ -0,0 +1,142 @@
+package pluginutils
+
+import (
+	"testing"
+
+	"github.com/grafana/grafana/pkg/plugins"
+	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/stretchr/testify/require"
+)
+
+func TestToRegistrations(t *testing.T) {
+	tests := []struct {
+		name string
+		regs []plugins.RoleRegistration
+		want []ac.RoleRegistration
+	}{
+		{
+			name: "no registration",
+			regs: nil,
+			want: []ac.RoleRegistration{},
+		},
+		{
+			name: "registration gets converted successfully",
+			regs: []plugins.RoleRegistration{
+				{
+					Role: plugins.Role{
+						Name:        "test:name",
+						DisplayName: "Test",
+						Description: "Test",
+						Permissions: []plugins.Permission{
+							{Action: "test:action"},
+							{Action: "test:action", Scope: "test:scope"},
+						},
+					},
+					Grants: []string{"Admin", "Editor"},
+				},
+				{
+					Role: plugins.Role{
+						Name:        "test:name",
+						Permissions: []plugins.Permission{},
+					},
+				},
+			},
+			want: []ac.RoleRegistration{
+				{
+					Role: ac.RoleDTO{
+						Version:     1,
+						Name:        "test:name",
+						DisplayName: "Test",
+						Description: "Test",
+						Group:       "PluginName",
+						Permissions: []ac.Permission{
+							{Action: "test:action"},
+							{Action: "test:action", Scope: "test:scope"},
+						},
+						OrgID: ac.GlobalOrgID,
+					},
+					Grants: []string{"Admin", "Editor"},
+				},
+				{
+					Role: ac.RoleDTO{
+						Version:     1,
+						Name:        "test:name",
+						Group:       "PluginName",
+						Permissions: []ac.Permission{},
+						OrgID:       ac.GlobalOrgID,
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ToRegistrations("PluginName", tt.regs)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestValidatePluginRole(t *testing.T) {
+	tests := []struct {
+		name     string
+		pluginID string
+		role     ac.RoleDTO
+		wantErr  error
+	}{
+		{
+			name:     "empty",
+			pluginID: "",
+			role:     ac.RoleDTO{Name: "plugins::"},
+			wantErr:  ac.ErrPluginIDRequired,
+		},
+		{
+			name:     "invalid name",
+			pluginID: "test-app",
+			role:     ac.RoleDTO{Name: "test-app:reader"},
+			wantErr:  &ac.ErrorInvalidRole{},
+		},
+		{
+			name:     "invalid id in name",
+			pluginID: "test-app",
+			role:     ac.RoleDTO{Name: "plugins:test-app2:reader"},
+			wantErr:  &ac.ErrorInvalidRole{},
+		},
+		{
+			name:     "valid name",
+			pluginID: "test-app",
+			role:     ac.RoleDTO{Name: "plugins:test-app:reader"},
+		},
+		{
+			name:     "invalid permission",
+			pluginID: "test-app",
+			role: ac.RoleDTO{
+				Name:        "plugins:test-app:reader",
+				Permissions: []ac.Permission{{Action: "invalidtest-app:read"}},
+			},
+			wantErr: &ac.ErrorInvalidRole{},
+		},
+		{
+			name:     "valid permissions",
+			pluginID: "test-app",
+			role: ac.RoleDTO{
+				Name: "plugins:test-app:reader",
+				Permissions: []ac.Permission{
+					{Action: "plugins.app:access"},
+					{Action: "test-app:read"},
+					{Action: "test-app.resources:read"},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidatePluginRole(tt.pluginID, tt.role)
+			if tt.wantErr != nil {
+				require.ErrorIs(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}