public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Access control: service account role check (#47710) (#47724)

Browse Source 
* forbid setting role higher than user's role

* change response code

* can assign API key permissions to non-admin users

* add: assign viewer role directly upon creation

* refactor: add AddSATcommand infavor of AddAPIkey

* refactor: frontend fixes for ServiceAccountToken

Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com>
(cherry picked from commit a245531f0c)

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
This commit is contained in:
Grot (@grafanabot)
2022-04-13 17:27:23 +01:00
committed by GitHub
co-authored by Ieva
parent a8bfaafeb5
commit 67d42fc51c
15 changed files with 64 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/api.go
+1 -1
View File
@@ -279,7 +279,7 @@ func (hs *HTTPServer) registerRoutes() {
keysRoute.Get("/", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyRead, ac.ScopeAPIKeysAll)), routing.Wrap(hs.GetAPIKeys))
keysRoute.Post("/", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyCreate)), quota("api_key"), routing.Wrap(hs.AddAPIKey))
keysRoute.Delete("/:id", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyDelete, apikeyIDScope)), routing.Wrap(hs.DeleteAPIKey))
}, reqOrgAdmin)
})
// Preferences
apiRoute.Group("/preferences", func(prefRoute routing.RouteRegister) {