From 5fcb3017650a728deca6554af2ac2c2b45ba8064 Mon Sep 17 00:00:00 2001 From: Ieva Date: Tue, 3 Sep 2024 15:08:31 +0100 Subject: [PATCH] [v11.1.x] RBAC: Always store action sets (#92856) RBAC: Always store action sets (#92833) always store action sets, even if FT is disabled (cherry picked from commit 46e81e98cfd2cda4fc9f8d361bfe612a7d569428) --- .../accesscontrol/resourcepermissions/store.go | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/pkg/services/accesscontrol/resourcepermissions/store.go b/pkg/services/accesscontrol/resourcepermissions/store.go index bd8a7666671..7e008c08e83 100644 --- a/pkg/services/accesscontrol/resourcepermissions/store.go +++ b/pkg/services/accesscontrol/resourcepermissions/store.go @@ -671,7 +671,7 @@ func (s *store) createPermissions(sess *db.Session, roleID int64, cmd SetResourc /* Add ACTION SET of managed permissions to in-memory store */ - if s.shouldStoreActionSet(permission) { + if s.shouldStoreActionSet(resource, permission) { actionSetName := GetActionSetName(resource, permission) p := managedPermission(actionSetName, resource, resourceID, resourceAttribute) p.RoleID = roleID @@ -683,13 +683,13 @@ func (s *store) createPermissions(sess *db.Session, roleID int64, cmd SetResourc // If there are no missing actions for the resource (in case of access level downgrade or resource removal), we don't need to insert any actions // we still want to add the action set (when permission != "") - if len(missingActions) == 0 && !s.shouldStoreActionSet(permission) { + if len(missingActions) == 0 && !s.shouldStoreActionSet(resource, permission) { return nil } // if we have actionset feature enabled and are only working with action sets // skip adding the missing actions to the permissions table - if !(s.shouldStoreActionSet(permission) && s.cfg.OnlyStoreAccessActionSets) { + if !(s.shouldStoreActionSet(resource, permission) && s.cfg.OnlyStoreAccessActionSets) { for action := range missingActions { p := managedPermission(action, resource, resourceID, resourceAttribute) p.RoleID = roleID @@ -706,8 +706,12 @@ func (s *store) createPermissions(sess *db.Session, roleID int64, cmd SetResourc return nil } -func (s *store) shouldStoreActionSet(permission string) bool { - return (s.features.IsEnabled(context.TODO(), featuremgmt.FlagAccessActionSets) && permission != "") +func (s *store) shouldStoreActionSet(resource, permission string) bool { + if permission == "" { + return false + } + actionSetName := GetActionSetName(resource, permission) + return isFolderOrDashboardAction(actionSetName) } func deletePermissions(sess *db.Session, ids []int64) error {