Access control: Use access control for dashboard and folder (#44702)

* Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2022-03-03 15:05:47 +01:00
parent 4caf5dbbd9
commit 4982ca3b1d
49 changed files with 2074 additions and 319 deletions
@@ -262,10 +262,111 @@ func (hs *HTTPServer) declareFixedRoles() error {
 		Grants: []string{string(models.ROLE_VIEWER)},
 	}

+	dashboardsCreatorRole := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Version:     1,
+			Name:        "fixed:dashboards:creator",
+			DisplayName: "Dashboard creator",
+			Description: "Create dashboard in general folder.",
+			Group:       "Dashboards",
+			Permissions: []ac.Permission{
+				{Action: ac.ActionFoldersRead, Scope: ac.Scope("folders", "id", "0")},
+				{Action: ac.ActionDashboardsCreate, Scope: ac.Scope("folders", "id", "0")},
+			},
+		},
+		Grants: []string{"Editor"},
+	}
+
+	dashboardsReaderRole := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Version:     1,
+			Name:        "fixed:dashboards:reader",
+			DisplayName: "Dashboard reader",
+			Description: "Read all dashboards.",
+			Group:       "Dashboards",
+			Permissions: []ac.Permission{
+				{Action: ac.ActionDashboardsRead, Scope: ac.ScopeDashboardsAll},
+			},
+		},
+		Grants: []string{"Admin"},
+	}
+
+	dashboardsWriterRole := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Version:     1,
+			Name:        "fixed:dashboards:writer",
+			DisplayName: "Dashboard writer",
+			Group:       "Dashboards",
+			Description: "Create, read, write or delete all dashboards and their permissions.",
+			Permissions: ac.ConcatPermissions(dashboardsReaderRole.Role.Permissions, []ac.Permission{
+				{Action: ac.ActionDashboardsWrite, Scope: ac.ScopeDashboardsAll},
+				{Action: ac.ActionDashboardsDelete, Scope: ac.ScopeDashboardsAll},
+				{Action: ac.ActionDashboardsCreate, Scope: ac.ScopeFoldersAll},
+				{Action: ac.ActionDashboardsPermissionsRead, Scope: ac.ScopeDashboardsAll},
+				{Action: ac.ActionDashboardsPermissionsWrite, Scope: ac.ScopeDashboardsAll},
+			}),
+		},
+		Grants: []string{"Admin"},
+	}
+
+	foldersCreatorRole := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Version:     1,
+			Name:        "fixed:folders:creator",
+			DisplayName: "Folder creator",
+			Description: "Create folders.",
+			Group:       "Folders",
+			Permissions: []ac.Permission{
+				{Action: ac.ActionFoldersCreate},
+			},
+		},
+		Grants: []string{"Editor"},
+	}
+
+	foldersReaderRole := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Version:     1,
+			Name:        "fixed:folders:reader",
+			DisplayName: "Folder reader",
+			Description: "Read all folders and dashboards.",
+			Group:       "Folders",
+			Permissions: []ac.Permission{
+				{Action: ac.ActionFoldersRead, Scope: ac.ScopeFoldersAll},
+				{Action: ac.ActionDashboardsRead, Scope: ac.ScopeFoldersAll},
+			},
+		},
+		Grants: []string{"Admin"},
+	}
+
+	foldersWriterRole := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Version:     1,
+			Name:        "fixed:folders:writer",
+			DisplayName: "Folder writer",
+			Description: "Create, read, write or delete all folders and dashboards and their permissions.",
+			Group:       "Folders",
+			Permissions: ac.ConcatPermissions(
+				foldersReaderRole.Role.Permissions,
+				[]ac.Permission{
+					{Action: ac.ActionFoldersCreate},
+					{Action: ac.ActionFoldersWrite, Scope: ac.ScopeFoldersAll},
+					{Action: ac.ActionFoldersDelete, Scope: ac.ScopeFoldersAll},
+					{Action: ac.ActionDashboardsWrite, Scope: ac.ScopeFoldersAll},
+					{Action: ac.ActionDashboardsDelete, Scope: ac.ScopeFoldersAll},
+					{Action: ac.ActionDashboardsCreate, Scope: ac.ScopeFoldersAll},
+					{Action: ac.ActionDashboardsPermissionsRead, Scope: ac.ScopeFoldersAll},
+					{Action: ac.ActionDashboardsPermissionsWrite, Scope: ac.ScopeFoldersAll},
+				}),
+		},
+		Grants: []string{"Admin"},
+	}
+
 	return hs.AccessControl.DeclareFixedRoles(
 		provisioningWriterRole, datasourcesReaderRole, datasourcesWriterRole, datasourcesIdReaderRole,
-		datasourcesCompatibilityReaderRole, orgReaderRole, orgWriterRole, orgMaintainerRole, teamsCreatorRole,
-		teamsWriterRole, datasourcesExplorerRole, annotationsReaderRole,
+		datasourcesCompatibilityReaderRole, orgReaderRole, orgWriterRole,
+		orgMaintainerRole, teamsCreatorRole, teamsWriterRole, datasourcesExplorerRole, annotationsReaderRole,
+		dashboardsCreatorRole, dashboardsReaderRole, dashboardsWriterRole,
+		foldersCreatorRole, foldersReaderRole, foldersWriterRole,
 	)
 }