From 4e3294cd8da863369357fc538c6470fd37a45119 Mon Sep 17 00:00:00 2001 From: Ieva Date: Fri, 14 Jun 2024 15:23:29 +0300 Subject: [PATCH] RBAC: Fix the check for whether an action set should be added (#89219) fox the check for whether an action set should be added --- .../accesscontrol/resourcepermissions/store.go | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/pkg/services/accesscontrol/resourcepermissions/store.go b/pkg/services/accesscontrol/resourcepermissions/store.go index aa0bae28b41..6e45d06afd2 100644 --- a/pkg/services/accesscontrol/resourcepermissions/store.go +++ b/pkg/services/accesscontrol/resourcepermissions/store.go @@ -671,7 +671,7 @@ func (s *store) createPermissions(sess *db.Session, roleID int64, cmd SetResourc /* Add ACTION SET of managed permissions to in-memory store */ - if s.shouldStoreActionSet(permission) { + if s.shouldStoreActionSet(resource, permission) { actionSetName := GetActionSetName(resource, permission) p := managedPermission(actionSetName, resource, resourceID, resourceAttribute) p.RoleID = roleID @@ -683,13 +683,13 @@ func (s *store) createPermissions(sess *db.Session, roleID int64, cmd SetResourc // If there are no missing actions for the resource (in case of access level downgrade or resource removal), we don't need to insert any actions // we still want to add the action set (when permission != "") - if len(missingActions) == 0 && !s.shouldStoreActionSet(permission) { + if len(missingActions) == 0 && !s.shouldStoreActionSet(resource, permission) { return nil } // if we have actionset feature enabled and are only working with action sets // skip adding the missing actions to the permissions table - if !(s.shouldStoreActionSet(permission) && s.cfg.OnlyStoreAccessActionSets) { + if !(s.shouldStoreActionSet(resource, permission) && s.cfg.OnlyStoreAccessActionSets) { for action := range missingActions { p := managedPermission(action, resource, resourceID, resourceAttribute) p.RoleID = roleID @@ -706,8 +706,12 @@ func (s *store) createPermissions(sess *db.Session, roleID int64, cmd SetResourc return nil } -func (s *store) shouldStoreActionSet(permission string) bool { - return (s.features.IsEnabled(context.TODO(), featuremgmt.FlagAccessActionSets) && permission != "" && isFolderOrDashboardAction(permission)) +func (s *store) shouldStoreActionSet(resource, permission string) bool { + if !(s.features.IsEnabled(context.TODO(), featuremgmt.FlagAccessActionSets) && permission != "") { + return false + } + actionSetName := GetActionSetName(resource, permission) + return isFolderOrDashboardAction(actionSetName) } func deletePermissions(sess *db.Session, ids []int64) error {