RBAC: Allow app plugins access restriction (#51524)

* RBAC: Allow app plugins restriction Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * Fix tests * Imports * WIP * Adding RBAC to AppPluginsRoutes * Switching middleware order * Restrict access to resources * Nit * Cosmetic changes * Fix fallback * Moving declaration to HttpServer Co-Authored-By: marefr <marcus.efraimsson@gmail.com> Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: marefr <marcus.efraimsson@gmail.com>
2022-07-08 13:24:09 +02:00
parent 0c33b9f211
commit 5975c4bc6d
8 changed files with 76 additions and 15 deletions
@@ -0,0 +1,30 @@
+package plugins
+
+import (
+	"github.com/grafana/grafana/pkg/models"
+	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
+)
+
+const (
+	ActionAppAccess = "plugins.app:access"
+)
+
+var (
+	ScopeProvider = ac.NewScopeProvider("plugins")
+)
+
+func DeclareRBACRoles(acService ac.AccessControl) error {
+	AppPluginsReader := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Name:        ac.FixedRolePrefix + "plugins.app:reader",
+			DisplayName: "Application Plugins Access",
+			Description: "Access application plugins (still enforcing the organization role)",
+			Group:       "Plugins",
+			Permissions: []ac.Permission{
+				{Action: ActionAppAccess, Scope: ScopeProvider.GetResourceAllScope()},
+			},
+		},
+		Grants: []string{string(models.ROLE_VIEWER)},
+	}
+	return acService.DeclareFixedRoles(AppPluginsReader)
+}