RBAC: prevent seeding oncall access (#80862)

* RBAC: prevent seeding oncall access * Add comments and an early exit * Test SeedAssignmentOnCallAccessMigrator * imports * Comment rework * Check error * Nit.
2024-01-24 09:23:40 +01:00
parent fd73b75ef7
commit 63679813b0
2 changed files with 138 additions and 0 deletions
@@ -0,0 +1,79 @@
+package test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/grafana/pkg/infra/log"
+	acmig "github.com/grafana/grafana/pkg/services/sqlstore/migrations/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
+	"github.com/grafana/grafana/pkg/setting"
+)
+
+func TestPreventOnCallAccessSeed(t *testing.T) {
+	// Run initial migration to have a working DB
+	x := setupTestDB(t)
+
+	type SeedAssignment struct {
+		BuiltinRole, Action, Scope, Origin string
+	}
+
+	want := []SeedAssignment{
+		{BuiltinRole: "Admin", Action: "plugins.app:access", Scope: "plugins:id:grafana-oncall-app", Origin: "grafana-oncall-app"},
+		{BuiltinRole: "Editor", Action: "plugins.app:access", Scope: "plugins:id:grafana-oncall-app", Origin: "grafana-oncall-app"},
+		{BuiltinRole: "Viewer", Action: "plugins.app:access", Scope: "plugins:id:grafana-oncall-app", Origin: "grafana-oncall-app"},
+		{BuiltinRole: "Grafana Admin", Action: "plugins.app:access", Scope: "plugins:id:grafana-oncall-app", Origin: "grafana-oncall-app"},
+	}
+
+	type testCase struct {
+		desc string
+		init []SeedAssignment
+		want []SeedAssignment
+	}
+	tt := []testCase{
+		{
+			desc: "fresh table skip migration",
+			want: []SeedAssignment{},
+		},
+		{
+			desc: "seeded with an OnCall access already",
+			init: []SeedAssignment{
+				{BuiltinRole: "Admin", Action: "plugins.app:access", Scope: "plugins:id:grafana-oncall-app", Origin: "grafana-oncall-app"},
+			},
+			want: want,
+		},
+		{
+			desc: "seeded without any OnCall access",
+			init: []SeedAssignment{{BuiltinRole: "Admin", Action: "plugins.app:access", Scope: "plugins:id:*"}},
+			want: append(want, SeedAssignment{BuiltinRole: "Admin", Action: "plugins.app:access", Scope: "plugins:id:*"}),
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.desc, func(t *testing.T) {
+			// Remove migration
+			_, errDeleteMig := x.Exec(`DELETE FROM migration_log WHERE migration_id LIKE ?`, acmig.PreventSeedingOnCallAccessID+"%")
+			require.NoError(t, errDeleteMig)
+			_, errDeleteAssigns := x.Exec(`DELETE FROM seed_assignment`)
+			require.NoError(t, errDeleteAssigns)
+
+			if len(tc.init) > 0 {
+				_, errInsertAssign := x.Table("seed_assignment").InsertMulti(tc.init)
+				require.NoError(t, errInsertAssign)
+			}
+
+			// Run accesscontrol migration
+			acmigrator := migrator.NewMigrator(x, &setting.Cfg{Logger: log.New("acmigration.test")})
+			acmigrator.AddMigration(acmig.PreventSeedingOnCallAccessID, &acmig.SeedAssignmentOnCallAccessMigrator{})
+
+			errRunningMig := acmigrator.Start(false, 0)
+			require.NoError(t, errRunningMig)
+
+			got := []SeedAssignment{}
+			errFind := x.Table("seed_assignment").Find(&got)
+			require.NoError(t, errFind)
+			require.ElementsMatch(t, tc.want, got)
+		})
+	}
+}