WIP: guardian service for search

Removes restricted dashboards from search result.

pkg/services/sqlstore/guardian.go

@@ -0,0 +1,38 @@
+package sqlstore
+
+import (
+	"strconv"
+
+	"github.com/grafana/grafana/pkg/bus"
+	m "github.com/grafana/grafana/pkg/models"
+)
+
+func init() {
+	bus.AddHandler("sql", GetAllowedDashboards)
+}
+
+func GetAllowedDashboards(query *m.GetAllowedDashboardsQuery) error {
+
+	rawSQL := `select distinct d.id as DashboardId
+from dashboard as d
+	left join dashboard as df on d.parent_id = df.id
+	left join dashboard_acl as dfa on d.parent_id = dfa.dashboard_id or d.id = dfa.dashboard_id
+	left join user_group_member as ugm on ugm.user_group_id =  dfa.user_group_id
+where (
+  (d.has_acl = 1 and (dfa.user_id = ? or ugm.user_id = ? or df.created_by = ? or (d.is_folder = 1 and d.created_by = ?)))
+  or d.has_acl = 0)
+  and d.org_id = ?`
+
+	res, err := x.Query(rawSQL, query.UserId, query.UserId, query.UserId, query.UserId, query.OrgId)
+	if err != nil {
+		return err
+	}
+
+	query.Result = make([]int64, 0)
+	for _, dash := range res {
+		id, _ := strconv.ParseInt(string(dash["DashboardId"]), 10, 64)
+		query.Result = append(query.Result, id)
+	}
+
+	return nil
+}

pkg/services/sqlstore/guardian_test.go

@@ -0,0 +1,32 @@
+package sqlstore
+
+import (
+	"testing"
+
+	m "github.com/grafana/grafana/pkg/models"
+	. "github.com/smartystreets/goconvey/convey"
+)
+
+func TestGuardianAccess(t *testing.T) {
+
+	Convey("Testing DB", t, func() {
+		InitTestDB(t)
+
+		Convey("Given one dashboard folder with two dashboard and one dashboard in the root folder", func() {
+			folder := insertTestDashboard("1 test dash folder", 1, 0, true, "prod", "webapp")
+			// dashInFolder1 := insertTestDashboard("test dash 23", 1, folder.Id, false, "prod", "webapp")
+			// dashInFolder2 := insertTestDashboard("test dash 45", 1, folder.Id, false, "prod")
+			dashInRoot := insertTestDashboard("test dash 67", 1, 0, false, "prod", "webapp")
+
+			Convey("and no acls are set", func() {
+				Convey("should return all dashboards", func() {
+					query := &m.GetAllowedDashboardsQuery{UserId: 1, OrgId: 1, DashList: []int64{folder.Id, dashInRoot.Id}}
+					err := GetAllowedDashboards(query)
+					So(err, ShouldBeNil)
+					So(query.Result[0], ShouldEqual, folder.Id)
+					So(query.Result[1], ShouldEqual, dashInRoot.Id)
+				})
+			})
+		})
+	})
+}

pkg/services/sqlstore/migrations/dashboard_mig.go

@@ -172,4 +172,8 @@ func addDashboardMigration(mg *Migrator) {
 	mg.AddMigration("add unique index dashboard_acl_dashboard_id_user_id", NewAddIndexMigration(dashboardAclV1, dashboardAclV1.Indices[1]))
 	mg.AddMigration("add unique index dashboard_acl_dashboard_id_group_id", NewAddIndexMigration(dashboardAclV1, dashboardAclV1.Indices[2]))
 
+	// add column to flag if dashboard has an ACL
+	mg.AddMigration("Add column has_acl in dashboard", NewAddColumnMigration(dashboardV2, &Column{
+		Name: "has_acl", Type: DB_Bool, Nullable: false, Default: "0",
+	}))
 }