public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Alerting: Managed receiver resource permission in receiver_svc (#93556)

Browse Source 
* Alerting: Managed receiver resource permission in receiver_svc
This commit is contained in:
Matthew Jacobson
2024-09-23 21:12:25 +03:00
committed by GitHub
parent ff37d477fd
commit 6652233493
16 changed files with 593 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/accesscontrol.go
+2
View File
@@ -155,6 +155,8 @@ type ServiceAccountPermissionsService interface {
type ReceiverPermissionsService interface {
PermissionsService
SetDefaultPermissions(ctx context.Context, orgID int64, user identity.Requester, uid string)
CopyPermissions(ctx context.Context, orgID int64, user identity.Requester, oldUID, newUID string) (int, error)
}
type PermissionsService interface {
pkg/services/accesscontrol/ossaccesscontrol/receivers.go
+137 -1
View File
@@ -1,14 +1,22 @@
package ossaccesscontrol
import (
"context"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/licensing"
"github.com/grafana/grafana/pkg/services/ngalert"
alertingac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/serviceaccounts"
"github.com/grafana/grafana/pkg/services/team"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/setting"
@@ -18,6 +26,14 @@ var ReceiversViewActions = []string{accesscontrol.ActionAlertingReceiversRead}
var ReceiversEditActions = append(ReceiversViewActions, []string{accesscontrol.ActionAlertingReceiversUpdate, accesscontrol.ActionAlertingReceiversDelete}...)
var ReceiversAdminActions = append(ReceiversEditActions, []string{accesscontrol.ActionAlertingReceiversReadSecrets, accesscontrol.ActionAlertingReceiversPermissionsRead, accesscontrol.ActionAlertingReceiversPermissionsWrite}...)
// defaultPermissions returns the default permissions for a newly created receiver.
func defaultPermissions() []accesscontrol.SetResourcePermissionCommand {
return []accesscontrol.SetResourcePermissionCommand{
{BuiltinRole: string(org.RoleEditor), Permission: string(alertingac.ReceiverPermissionEdit)},
{BuiltinRole: string(org.RoleViewer), Permission: string(alertingac.ReceiverPermissionView)},
}
}
func ProvideReceiverPermissionsService(
cfg *setting.Cfg, features featuremgmt.FeatureToggles, router routing.RouteRegister, sql db.DB, ac accesscontrol.AccessControl,
license licensing.Licensing, service accesscontrol.Service,
@@ -50,11 +66,131 @@ func ProvideReceiverPermissionsService(
if err != nil {
return nil, err
}
return &ReceiverPermissionsService{Service: srv}, nil
return &ReceiverPermissionsService{srv, service, log.New("resourcepermissions.receivers")}, nil
}
var _ accesscontrol.ReceiverPermissionsService = new(ReceiverPermissionsService)
type ReceiverPermissionsService struct {
*resourcepermissions.Service
ac accesscontrol.Service
log log.Logger
}
// SetDefaultPermissions sets the default permissions for a newly created receiver.
func (r ReceiverPermissionsService) SetDefaultPermissions(ctx context.Context, orgID int64, user identity.Requester, uid string) {
permissions := defaultPermissions()
clearCache := false
if user != nil && user.IsIdentityType(claims.TypeUser) {
userID, err := user.GetInternalID()
if err != nil {
r.log.Error("Could not make user admin", "receiver_uid", uid, "id", user.GetID(), "error", err)
} else {
permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{
UserID: userID, Permission: string(alertingac.ReceiverPermissionAdmin),
})
clearCache = true
}
}
if _, err := r.SetPermissions(ctx, orgID, uid, permissions...); err != nil {
r.log.Error("Could not set default permissions", "receiver_uid", uid, "error", err)
}
if clearCache {
// Clear permission cache for the user who created the receiver, so that new permissions are fetched for their next call
// Required for cases when caller wants to immediately interact with the newly created object
r.ac.ClearUserPermissionCache(user)
}
}
// copyPermissionUser returns a user with permissions to copy permissions from one receiver to another. This must include
// permissions to read and write permissions for the receiver, as well as read permissions for users, service accounts, and teams.
func copyPermissionUser(orgID int64) identity.Requester {
return accesscontrol.BackgroundUser("receiver_access_service", orgID, org.RoleAdmin, accesscontrol.ConcatPermissions(
accesscontrol.PermissionsForActions(ReceiversAdminActions, alertingac.ScopeReceiversAll),
[]accesscontrol.Permission{ // Permissions needed for GetPermissions to return user, service account, and team permissions.
{Action: accesscontrol.ActionOrgUsersRead, Scope: accesscontrol.ScopeUsersAll},
{Action: serviceaccounts.ActionRead, Scope: serviceaccounts.ScopeAll},
{Action: accesscontrol.ActionTeamsRead, Scope: accesscontrol.ScopeTeamsAll},
},
),
)
}
// CopyPermissions copies the resource permissions from one receiver uid to a new uid. This is a temporary
// method to be used during receiver renaming that is necessitated by receiver uids being generated from the receiver
// name.
func (r ReceiverPermissionsService) CopyPermissions(ctx context.Context, orgID int64, user identity.Requester, oldUID, newUID string) (int, error) {
currentPermissions, err := r.GetPermissions(ctx, copyPermissionUser(orgID), oldUID)
if err != nil {
return 0, err
}
setPermissionCommands := r.toSetResourcePermissionCommands(currentPermissions)
if _, err := r.SetPermissions(ctx, orgID, newUID, setPermissionCommands...); err != nil {
return 0, err
}
// Clear permission cache for the user who updated the receiver, so that new permissions are fetched for their next call
// Required for cases when caller wants to immediately interact with the newly updated object
if user != nil && user.IsIdentityType(claims.TypeUser) {
r.ac.ClearUserPermissionCache(user)
}
return countCustomPermissions(setPermissionCommands), nil
}
// toSetResourcePermissionCommands converts a list of resource permissions to a list of set resource permission commands.
// Only includes managed permissions.
func (r ReceiverPermissionsService) toSetResourcePermissionCommands(permissions []accesscontrol.ResourcePermission) []accesscontrol.SetResourcePermissionCommand {
cmds := make([]accesscontrol.SetResourcePermissionCommand, 0, len(permissions))
for _, p := range permissions {
if !p.IsManaged {
continue
}
permission := r.MapActions(p)
if permission == "" {
continue
}
cmds = append(cmds, accesscontrol.SetResourcePermissionCommand{
Permission: permission,
BuiltinRole: p.BuiltInRole,
TeamID: p.TeamId,
UserID: p.UserId,
})
}
return cmds
}
// countCustomPermissions counts the number of custom permissions in a list of set resource permission commands. A
// custom permission is a permission that is not a default permission for a receiver.
func countCustomPermissions(permissions []accesscontrol.SetResourcePermissionCommand) int {
cacheKey := func(p accesscontrol.SetResourcePermissionCommand) accesscontrol.SetResourcePermissionCommand {
return accesscontrol.SetResourcePermissionCommand{
Permission: "",
BuiltinRole: p.BuiltinRole,
TeamID: p.TeamID,
UserID: p.UserID,
}
}
missingDefaults := make(map[accesscontrol.SetResourcePermissionCommand]string, 2)
for _, p := range defaultPermissions() {
missingDefaults[cacheKey(p)] = p.Permission
}
diff := 0
for _, p := range permissions {
key := cacheKey(p)
perm, ok := missingDefaults[key]
if perm != p.Permission {
diff++
}
if ok {
delete(missingDefaults, key)
}
}
// missing + new
return len(missingDefaults) + diff
}