public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Authorization: Add group to role DisplayName to make filtered list more clear (#102950)

Browse Source 
* add group to role DisplayName to make searching easier

* clean up more role names; add filtered display text when fetching

* pass filter state into role menu to decide how to display role name

* prop name better describes what it does
This commit is contained in:
Cory Forseth
2025-04-08 09:15:03 -05:00
committed by GitHub
parent a3c632b814
commit 4caa9853cb
18 changed files with 62 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/accesscontrol.go
+10 -10
View File
@@ -99,7 +99,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
builtInDatasourceReader := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:datasources.builtin:reader",
DisplayName: "Built in reader",
DisplayName: "Built in data source reader",
Description: "Read and query Grafana's built in test data sources.",
Group: "Data sources",
Permissions: []ac.Permission{
@@ -321,7 +321,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
dashboardAnnotationsWriterRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:annotations.dashboard:writer",
DisplayName: "Dashboard annotation writer",
DisplayName: "Writer (dashboard)",
Description: "Update annotations associated with dashboards.",
Group: "Annotations",
Permissions: []ac.Permission{
@@ -353,7 +353,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
annotationsReaderRole = ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:annotations:reader",
DisplayName: "Organization annotation reader",
DisplayName: "Reader (organization)",
Description: "Read organization annotations and annotation tags",
Group: "Annotations",
Permissions: []ac.Permission{
@@ -370,7 +370,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
annotationsWriterRole = ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:annotations:writer",
DisplayName: "Organization annotation writer",
DisplayName: "Writer (organization)",
Description: "Update organization annotations.",
Group: "Annotations",
Permissions: []ac.Permission{
@@ -463,7 +463,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
generalFolderReaderRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:folders.general:reader",
DisplayName: "General folder reader",
DisplayName: "Reader (root)",
Description: "Access the general (root) folder.",
Group: "Folders",
Hidden: true,
@@ -526,7 +526,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
libraryPanelsGeneralReaderRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:library.panels:general.reader",
DisplayName: "General reader",
DisplayName: "Reader (root)",
Description: "Read all library panels under the root folder.",
Group: "Library panels",
Permissions: []ac.Permission{
@@ -554,7 +554,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
libraryPanelsGeneralWriterRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:library.panels:general.writer",
DisplayName: "Root level writer",
DisplayName: "Writer (root)",
Group: "Library panels",
Description: "Create, read, write or delete all library panels and their permissions under the root folder.",
Permissions: ac.ConcatPermissions(libraryPanelsGeneralReaderRole.Role.Permissions, []ac.Permission{
@@ -569,7 +569,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
publicDashboardsWriterRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:dashboards.public:writer",
DisplayName: "Public Dashboard writer",
DisplayName: "Writer (public)",
Description: "Create, write or disable a public dashboard.",
Group: "Dashboards",
Permissions: []ac.Permission{
@@ -658,7 +658,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
allAnnotationsReaderRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:annotations.all:reader",
DisplayName: "Reader",
DisplayName: "Reader (all)",
Description: "Read all annotations and tags",
Group: "Annotations",
Permissions: []ac.Permission{
@@ -672,7 +672,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
allAnnotationsWriterRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:annotations.all:writer",
DisplayName: "Writer",
DisplayName: "Writer (all)",
Description: "Update all annotations.",
Group: "Annotations",
Permissions: []ac.Permission{
pkg/services/accesscontrol/ossaccesscontrol/dashboard.go
+2 -2
View File
@@ -163,8 +163,8 @@ func ProvideDashboardPermissions(
"Edit": getDashboardEditActions(features),
"Admin": getDashboardAdminActions(features),
},
ReaderRoleName: "Dashboard permission reader",
WriterRoleName: "Dashboard permission writer",
ReaderRoleName: "Permission reader",
WriterRoleName: "Permission writer",
RoleGroup: "Dashboards",
}
pkg/services/accesscontrol/ossaccesscontrol/folder.go
+2 -2
View File
@@ -126,8 +126,8 @@ func ProvideFolderPermissions(
"Edit": append(getDashboardEditActions(features), FolderEditActions...),
"Admin": append(getDashboardAdminActions(features), FolderAdminActions...),
},
ReaderRoleName: "Folder permission reader",
WriterRoleName: "Folder permission writer",
ReaderRoleName: "Permission reader",
WriterRoleName: "Permission writer",
RoleGroup: "Folders",
}
srv, err := resourcepermissions.New(cfg, options, features, router, license, accesscontrol, service, sql, teamService, userService, actionSetService)
pkg/services/accesscontrol/ossaccesscontrol/service_account.go
+2 -2
View File
@@ -67,8 +67,8 @@ func ProvideServiceAccountPermissions(
"Edit": ServiceAccountEditActions,
"Admin": ServiceAccountAdminActions,
},
ReaderRoleName: "Service account permission reader",
WriterRoleName: "Service account permission writer",
ReaderRoleName: "Permission reader",
WriterRoleName: "Permission writer",
RoleGroup: "Service accounts",
}
pkg/services/accesscontrol/ossaccesscontrol/team.go
+2 -2
View File
@@ -78,8 +78,8 @@ func ProvideTeamPermissions(
"Member": TeamMemberActions,
"Admin": TeamAdminActions,
},
ReaderRoleName: "Team permission reader",
WriterRoleName: "Team permission writer",
ReaderRoleName: "Permission reader",
WriterRoleName: "Permission writer",
RoleGroup: "Teams",
OnSetUser: func(session *db.Session, orgID int64, user accesscontrol.User, resourceID, permission string) error {
teamId, err := strconv.ParseInt(resourceID, 10, 64)
pkg/services/accesscontrol/roles.go
+13 -13
View File
@@ -43,7 +43,7 @@ const (
var (
ldapReaderRole = RoleDTO{
Name: "fixed:ldap:reader",
DisplayName: "LDAP reader",
DisplayName: "Reader",
Description: "Read LDAP configuration and status.",
Group: "LDAP",
Permissions: []Permission{
@@ -58,7 +58,7 @@ var (
ldapWriterRole = RoleDTO{
Name: "fixed:ldap:writer",
DisplayName: "LDAP writer",
DisplayName: "Writer",
Description: "Read and update LDAP configuration and read LDAP status.",
Group: "LDAP",
Permissions: ConcatPermissions(ldapReaderRole.Permissions, []Permission{
@@ -73,9 +73,9 @@ var (
orgUsersWriterRole = RoleDTO{
Name: "fixed:org.users:writer",
DisplayName: "Organization user writer",
DisplayName: "Writer (organizational)",
Description: "Within a single organization, add a user, invite a user, read information about a user and their role, remove a user from that organization, or change the role of a user.",
Group: "User administration (organizational)",
Group: "User administration",
Permissions: ConcatPermissions(orgUsersReaderRole.Permissions, []Permission{
{
Action: ActionOrgUsersAdd,
@@ -94,9 +94,9 @@ var (
orgUsersReaderRole = RoleDTO{
Name: "fixed:org.users:reader",
DisplayName: "Organization user reader",
DisplayName: "Reader (organizational)",
Description: "Read users within a single organization.",
Group: "User administration (organizational)",
Group: "User administration",
Permissions: []Permission{
{
Action: ActionOrgUsersRead,
@@ -111,7 +111,7 @@ var (
SettingsReaderRole = RoleDTO{
Name: "fixed:settings:reader",
DisplayName: "Setting reader",
DisplayName: "Reader",
Description: "Read Grafana instance settings.",
Group: "Settings",
Permissions: []Permission{
@@ -124,7 +124,7 @@ var (
statsReaderRole = RoleDTO{
Name: "fixed:stats:reader",
DisplayName: "Statistics reader",
DisplayName: "Reader",
Description: "Read Grafana instance statistics.",
Group: "Statistics",
Permissions: []Permission{
@@ -136,9 +136,9 @@ var (
usersReaderRole = RoleDTO{
Name: "fixed:users:reader",
DisplayName: "User reader",
DisplayName: "Reader (global)",
Description: "Read all users and their information, such as team memberships, authentication tokens, and quotas.",
Group: "User administration (global)",
Group: "User administration",
Permissions: []Permission{
{
Action: ActionUsersRead,
@@ -157,9 +157,9 @@ var (
usersWriterRole = RoleDTO{
Name: "fixed:users:writer",
DisplayName: "User writer",
DisplayName: "Writer (global)",
Description: "Read and update all attributes and settings for all users in Grafana: update user information, read user information, create or enable or disable a user, make a user a Grafana administrator, sign out a user, update a user’s authentication token, or update quotas for all users.",
Group: "User administration (global)",
Group: "User administration",
Permissions: ConcatPermissions(usersReaderRole.Permissions, []Permission{
{
Action: ActionUsersPasswordUpdate,
@@ -295,7 +295,7 @@ var (
usagestatsReaderRole = RoleDTO{
Name: "fixed:usagestats:reader",
DisplayName: "Usage stats report reader",
DisplayName: "Usage report reader",
Description: "View usage statistics report",
Group: "Statistics",
Permissions: []Permission{
pkg/services/pluginsintegration/pluginaccesscontrol/accesscontrol.go
+2 -2
View File
@@ -60,7 +60,7 @@ func DeclareRBACRoles(service ac.Service, cfg *setting.Cfg, features featuremgmt
PluginsWriter := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: ac.FixedRolePrefix + "plugins:writer",
DisplayName: "Plugin Writer",
DisplayName: "Writer",
Description: "Enable and disable plugins and edit plugins' settings",
Group: "Plugins",
Permissions: []ac.Permission{
@@ -72,7 +72,7 @@ func DeclareRBACRoles(service ac.Service, cfg *setting.Cfg, features featuremgmt
PluginsMaintainer := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: ac.FixedRolePrefix + "plugins:maintainer",
DisplayName: "Plugin Maintainer",
DisplayName: "Maintainer",
Description: "Install, uninstall plugins. Needs to be assigned globally.",
Group: "Plugins",
Permissions: []ac.Permission{
pkg/services/serviceaccounts/manager/roles.go
+3 -3
View File
@@ -10,7 +10,7 @@ func RegisterRoles(service accesscontrol.Service) error {
saReader := accesscontrol.RoleRegistration{
Role: accesscontrol.RoleDTO{
Name: "fixed:serviceaccounts:reader",
DisplayName: "Service accounts reader",
DisplayName: "Reader",
Description: "Read service accounts and service account tokens.",
Group: "Service accounts",
Permissions: []accesscontrol.Permission{
@@ -26,7 +26,7 @@ func RegisterRoles(service accesscontrol.Service) error {
saCreator := accesscontrol.RoleRegistration{
Role: accesscontrol.RoleDTO{
Name: "fixed:serviceaccounts:creator",
DisplayName: "Service accounts creator",
DisplayName: "Creator",
Description: "Create service accounts.",
Group: "Service accounts",
Permissions: []accesscontrol.Permission{
@@ -41,7 +41,7 @@ func RegisterRoles(service accesscontrol.Service) error {
saWriter := accesscontrol.RoleRegistration{
Role: accesscontrol.RoleDTO{
Name: "fixed:serviceaccounts:writer",
DisplayName: "Service accounts writer",
DisplayName: "Writer",
Description: "Create, delete and read service accounts, manage service account permissions.",
Group: "Service accounts",
Permissions: accesscontrol.ConcatPermissions(saReader.Role.Permissions, []accesscontrol.Permission{
pkg/services/supportbundles/supportbundlesimpl/models.go
+2 -2
View File
@@ -14,7 +14,7 @@ const (
var (
bundleReaderRole = accesscontrol.RoleDTO{
Name: "fixed:support.bundles:reader",
DisplayName: "Support bundle reader",
DisplayName: "Reader",
Description: "List and download support bundles",
Group: "Support bundles",
Permissions: []accesscontrol.Permission{
@@ -24,7 +24,7 @@ var (
bundleWriterRole = accesscontrol.RoleDTO{
Name: "fixed:support.bundles:writer",
DisplayName: "Support bundle writer",
DisplayName: "Writer",
Description: "Create, delete, list and download support bundles",
Group: "Support bundles",
Permissions: []accesscontrol.Permission{