public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apiserver: Refactor authenticator and authorizers (#101449)

Browse Source 
* Clean up authenticator

* Cleanup authorizers and replace org_id and stack_id with namespace authorizer

* Remove dependency on org service

* Extract orgID from /apis/ urls and validate stack id
This commit is contained in:
Karl Persson
2025-03-06 16:01:12 +01:00
committed by GitHub
parent 0a24a7cd4c
commit 43f56c5ca1
16 changed files with 372 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/service_test.go
+40 -1
View File
@@ -265,7 +265,9 @@ func TestService_OrgID(t *testing.T) {
type TestCase struct {
desc string
req *authn.Request
stackID int64
expectedOrgID int64
expectedErr error
}
tests := []TestCase{
@@ -301,12 +303,48 @@ func TestService_OrgID(t *testing.T) {
}},
expectedOrgID: 0,
},
{
desc: "should set org id from default namespace",
req: &authn.Request{HTTPRequest: &http.Request{
Header: map[string][]string{},
URL: mustParseURL("http://localhost/apis/folder.grafana.app/v0alpha1/namespaces/default/folders"),
}},
expectedOrgID: 1,
},
{
desc: "should set org id from namespace",
req: &authn.Request{HTTPRequest: &http.Request{
Header: map[string][]string{},
URL: mustParseURL("http://localhost/apis/folder.grafana.app/v0alpha1/namespaces/org-2/folders"),
}},
expectedOrgID: 2,
},
{
desc: "should set set org 1 for stack namespace",
req: &authn.Request{HTTPRequest: &http.Request{
Header: map[string][]string{},
URL: mustParseURL("http://localhost/apis/folder.grafana.app/v0alpha1/namespaces/stacks-100/folders"),
}},
stackID: 100,
expectedOrgID: 1,
},
{
desc: "should error for wrong stack namespace",
req: &authn.Request{HTTPRequest: &http.Request{
Header: map[string][]string{},
URL: mustParseURL("http://localhost/apis/folder.grafana.app/v0alpha1/namespaces/stacks-100/folders"),
}},
stackID: 101,
expectedOrgID: 0,
expectedErr: errInvalidNamespace,
},
}
for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
var calledWith int64
s := setupTests(t, func(svc *Service) {
svc.stackID = tt.stackID
svc.RegisterClient(authntest.MockClient{
AuthenticateFunc: func(ctx context.Context, r *authn.Request) (*authn.Identity, error) {
calledWith = r.OrgID
@@ -316,7 +354,8 @@ func TestService_OrgID(t *testing.T) {
})
})
_, _ = s.Authenticate(context.Background(), tt.req)
_, err := s.Authenticate(context.Background(), tt.req)
assert.ErrorIs(t, tt.expectedErr, err)
assert.Equal(t, tt.expectedOrgID, calledWith)
})
}