public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Reject plugin registrations without a name (#81719)

Browse Source 
* RBAC: Reject plugin registrations without a name

* Lint'
This commit is contained in:
Gabriel MABILLE
2024-02-02 11:12:00 +01:00
committed by GitHub
parent 65e9990a87
commit 4a1e8f3d98
3 changed files with 28 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/pluginutils/utils_test.go
+15 -6
View File
@@ -85,34 +85,41 @@ func TestValidatePluginRole(t *testing.T) {
role ac.RoleDTO
wantErr error
}{
{
name: "empty display name",
pluginID: "test-app",
role: ac.RoleDTO{DisplayName: ""},
wantErr: &ac.ErrorInvalidRole{},
},
{
name: "empty",
pluginID: "",
role: ac.RoleDTO{Name: "plugins::"},
role: ac.RoleDTO{Name: "plugins::reader", DisplayName: "Reader"},
wantErr: ac.ErrPluginIDRequired,
},
{
name: "invalid name",
pluginID: "test-app",
role: ac.RoleDTO{Name: "test-app:reader"},
role: ac.RoleDTO{Name: "test-app:reader", DisplayName: "Reader"},
wantErr: &ac.ErrorInvalidRole{},
},
{
name: "invalid id in name",
pluginID: "test-app",
role: ac.RoleDTO{Name: "plugins:test-app2:reader"},
role: ac.RoleDTO{Name: "plugins:test-app2:reader", DisplayName: "Reader"},
wantErr: &ac.ErrorInvalidRole{},
},
{
name: "valid name",
pluginID: "test-app",
role: ac.RoleDTO{Name: "plugins:test-app:reader"},
role: ac.RoleDTO{Name: "plugins:test-app:reader", DisplayName: "Reader"},
},
{
name: "invalid permission",
pluginID: "test-app",
role: ac.RoleDTO{
Name: "plugins:test-app:reader",
DisplayName: "Reader",
Permissions: []ac.Permission{{Action: "invalidtest-app:read"}},
},
wantErr: &ac.ErrorInvalidRole{},
@@ -121,7 +128,8 @@ func TestValidatePluginRole(t *testing.T) {
name: "valid permissions",
pluginID: "test-app",
role: ac.RoleDTO{
Name: "plugins:test-app:reader",
Name: "plugins:test-app:reader",
DisplayName: "Reader",
Permissions: []ac.Permission{
{Action: "plugins.app:access", Scope: "plugins:id:test-app"},
{Action: "test-app:read"},
@@ -133,7 +141,8 @@ func TestValidatePluginRole(t *testing.T) {
name: "invalid permission targets other plugin",
pluginID: "test-app",
role: ac.RoleDTO{
Name: "plugins:test-app:reader",
Name: "plugins:test-app:reader",
DisplayName: "Reader",
Permissions: []ac.Permission{
{Action: "plugins.app:access", Scope: "plugins:id:other-app"},
},