From 5fb0bd30e88e8c9211c42c94539c5297e3629d36 Mon Sep 17 00:00:00 2001 From: gamab Date: Fri, 5 Nov 2021 16:55:58 +0100 Subject: [PATCH] AccessControl: Remove permissions on endpoints --- pkg/api/api.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkg/api/api.go b/pkg/api/api.go index 9e24dc4282d..19a587a7c3e 100644 --- a/pkg/api/api.go +++ b/pkg/api/api.go @@ -237,15 +237,15 @@ func (hs *HTTPServer) registerRoutes() { // orgs (admin routes) apiRoute.Group("/orgs/:orgId", func(orgsRoute routing.RouteRegister) { - userIDScope := ac.Scope("users", ac.Parameter(":userId")) + // userIDScope := ac.Scope("users", ac.Parameter(":userId")) orgsRoute.Get("/", reqGrafanaAdmin, routing.Wrap(GetOrgByID)) orgsRoute.Put("/", reqGrafanaAdmin, bind(dtos.UpdateOrgForm{}), routing.Wrap(UpdateOrg)) orgsRoute.Put("/address", reqGrafanaAdmin, bind(dtos.UpdateOrgAddressForm{}), routing.Wrap(UpdateOrgAddress)) orgsRoute.Delete("/", reqGrafanaAdmin, routing.Wrap(DeleteOrgByID)) - orgsRoute.Get("/users", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionOrgUsersRead, ac.ScopeUsersAll)), routing.Wrap(hs.GetOrgUsers)) - orgsRoute.Post("/users", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionOrgUsersAdd, ac.ScopeUsersAll)), bind(models.AddOrgUserCommand{}), routing.Wrap(AddOrgUser)) - orgsRoute.Patch("/users/:userId", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionOrgUsersRoleUpdate, userIDScope)), bind(models.UpdateOrgUserCommand{}), routing.Wrap(UpdateOrgUser)) - orgsRoute.Delete("/users/:userId", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionOrgUsersRemove, userIDScope)), routing.Wrap(RemoveOrgUser)) + orgsRoute.Get("/users", reqGrafanaAdmin, routing.Wrap(hs.GetOrgUsers)) + orgsRoute.Post("/users", reqGrafanaAdmin, bind(models.AddOrgUserCommand{}), routing.Wrap(AddOrgUser)) + orgsRoute.Patch("/users/:userId", reqGrafanaAdmin, bind(models.UpdateOrgUserCommand{}), routing.Wrap(UpdateOrgUser)) + orgsRoute.Delete("/users/:userId", reqGrafanaAdmin, routing.Wrap(RemoveOrgUser)) orgsRoute.Get("/quotas", reqGrafanaAdmin, routing.Wrap(GetOrgQuotas)) orgsRoute.Put("/quotas/:target", reqGrafanaAdmin, bind(models.UpdateOrgQuotaCmd{}), routing.Wrap(UpdateOrgQuota)) })