public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Authlib: Use types package rather than claims (#99243)

Browse Source
This commit is contained in:
Ryan McKinley
2025-01-21 12:06:55 +03:00
committed by GitHub
parent b2d0359e72
commit 680e6bc1f8
149 changed files with 394 additions and 376 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/admin_users.go
+2 -2
View File
@@ -8,7 +8,7 @@ import (
"golang.org/x/sync/errgroup"
"github.com/grafana/authlib/claims"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/infra/metrics"
@@ -367,7 +367,7 @@ func (hs *HTTPServer) AdminLogoutUser(c *contextmodel.ReqContext) response.Respo
return response.Error(http.StatusBadRequest, "id is invalid", err)
}
if c.SignedInUser.GetID() == claims.NewTypeID(claims.TypeUser, id) {
if c.SignedInUser.GetID() == authlib.NewTypeID(authlib.TypeUser, id) {
return response.Error(http.StatusBadRequest, "You cannot logout yourself", nil)
}
pkg/api/common_test.go
+2 -1
View File
@@ -11,10 +11,11 @@ import (
"path/filepath"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/infra/db"
pkg/api/dashboard.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
"strconv"
"strings"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/apierrors"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
pkg/api/folder.go
+1 -1
View File
@@ -14,7 +14,7 @@ import (
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/client-go/dynamic"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/apierrors"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
pkg/api/index.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"net/http"
"strings"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/webassets"
"github.com/grafana/grafana/pkg/apimachinery/identity"
pkg/api/login_test.go
+2 -1
View File
@@ -12,10 +12,11 @@ import (
"strings"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/api/routing"
pkg/api/org.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"net/http"
"strconv"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/infra/metrics"
pkg/api/org_test.go
+2 -1
View File
@@ -6,10 +6,11 @@ import (
"strings"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
"github.com/grafana/grafana/pkg/services/authn"
pkg/api/pluginproxy/ds_proxy_test.go
+1 -1
View File
@@ -19,7 +19,7 @@ import (
"github.com/stretchr/testify/require"
"golang.org/x/oauth2"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/datasource"
"github.com/grafana/grafana/pkg/apimachinery/identity"
pkg/api/pluginproxy/pluginproxy_test.go
+1 -1
View File
@@ -12,7 +12,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/plugins"
pkg/api/user.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"strconv"
"strings"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
pkg/api/user_token.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"github.com/ua-parser/uap-go/uaparser"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/infra/network"
pkg/apimachinery/go.mod
+2 -2
View File
@@ -3,8 +3,8 @@ module github.com/grafana/grafana/pkg/apimachinery
go 1.23.1
require (
github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 // @grafana/identity-access-team
github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 // @grafana/identity-access-team
github.com/grafana/authlib v0.0.0-20250120145936-5f0e28e7a87c // @grafana/identity-access-team
github.com/grafana/authlib/types v0.0.0-20250120145936-5f0e28e7a87c // @grafana/identity-access-team
github.com/stretchr/testify v1.10.0
k8s.io/apimachinery v0.32.0
k8s.io/apiserver v0.32.0
pkg/apimachinery/go.sum
+4 -4
View File
@@ -32,10 +32,10 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884 h1:MSRBiQrSJZ+iowjU4Tgtq8+uC5/cs9XdtUdSWCNHrNE=
github.com/grafana/authlib v0.0.0-20250108202437-7a039176d884/go.mod h1:x7df73G3xuSD35Xv9cjaMLyPJCgM9Z/Wj5ISouoAfiI=
github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 h1:3DHH81RJCi8Bcgn2MdBh7vgWUshmAFjZzBCVuxiQ0uk=
github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335/go.mod h1:r+F8H6awwjNQt/KPZ2GNwjk8TvsJ7/gxzkXN26GlL/A=
github.com/grafana/authlib v0.0.0-20250120145936-5f0e28e7a87c h1:duHQ8Bih3nt9p68aQdp+22a6mFBLpK4IOURhEq+Cvk8=
github.com/grafana/authlib v0.0.0-20250120145936-5f0e28e7a87c/go.mod h1:/gYfphsNu9v1qYWXxpv1NSvMEMSwvdf8qb8YlgwIRl8=
github.com/grafana/authlib/types v0.0.0-20250120145936-5f0e28e7a87c h1:b0sPDtt33uFdmvUJjSCld3kwE2E49dUvevuUDSJsEuo=
github.com/grafana/authlib/types v0.0.0-20250120145936-5f0e28e7a87c/go.mod h1:qYjSd1tmJiuVoSICp7Py9/zD54O9uQQA3wuM6Gg4DFM=
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
pkg/apimachinery/identity/context.go
+2 -2
View File
@@ -5,14 +5,14 @@ import (
"fmt"
"reflect"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
)
type ctxUserKey struct{}
// WithRequester attaches the requester to the context.
func WithRequester(ctx context.Context, usr Requester) context.Context {
ctx = claims.WithClaims(ctx, usr) // also set the upstream auth info claims
ctx = claims.WithAuthInfo(ctx, usr) // also set the upstream auth info claims
return context.WithValue(ctx, ctxUserKey{}, usr)
}
pkg/apimachinery/identity/requester.go
+2 -1
View File
@@ -4,8 +4,9 @@ import (
"fmt"
"strconv"
"github.com/grafana/authlib/claims"
"k8s.io/apiserver/pkg/authentication/user"
claims "github.com/grafana/authlib/types"
)
type Requester interface {
pkg/apimachinery/identity/static.go
+1 -1
View File
@@ -5,7 +5,7 @@ import (
"strconv"
authnlib "github.com/grafana/authlib/authn"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
)
var _ Requester = (*StaticRequester)(nil)
pkg/apis/iam/v0alpha1/types_display.go
+2 -1
View File
@@ -1,8 +1,9 @@
package v0alpha1
import (
"github.com/grafana/authlib/claims"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
claims "github.com/grafana/authlib/types"
)
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
pkg/apiserver/endpoints/filters/requester.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/klog/v2"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
)
pkg/apiserver/go.mod
+1 -1
View File
@@ -4,7 +4,7 @@ go 1.23.1
require (
github.com/google/go-cmp v0.6.0
github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335
github.com/grafana/authlib/types v0.0.0-20250120145936-5f0e28e7a87c
github.com/grafana/grafana/pkg/apimachinery v0.0.0-20240701135906-559738ce6ae1
github.com/prometheus/client_golang v1.20.5
github.com/stretchr/testify v1.10.0
pkg/apiserver/go.sum
+2 -2
View File
@@ -79,8 +79,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335 h1:3DHH81RJCi8Bcgn2MdBh7vgWUshmAFjZzBCVuxiQ0uk=
github.com/grafana/authlib/claims v0.0.0-20241202085737-df90af04f335/go.mod h1:r+F8H6awwjNQt/KPZ2GNwjk8TvsJ7/gxzkXN26GlL/A=
github.com/grafana/authlib/types v0.0.0-20250120145936-5f0e28e7a87c h1:b0sPDtt33uFdmvUJjSCld3kwE2E49dUvevuUDSJsEuo=
github.com/grafana/authlib/types v0.0.0-20250120145936-5f0e28e7a87c/go.mod h1:qYjSd1tmJiuVoSICp7Py9/zD54O9uQQA3wuM6Gg4DFM=
github.com/grafana/grafana/pkg/apimachinery v0.0.0-20240701135906-559738ce6ae1 h1:ItDcDxUjVLPKja+hogpqgW/kj8LxUL2qscelXIsN1Bs=
github.com/grafana/grafana/pkg/apimachinery v0.0.0-20240701135906-559738ce6ae1/go.mod h1:DkxMin+qOh1Fgkxfbt+CUfBqqsCQJMG9op8Os/irBPA=
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
pkg/apiserver/rest/dualwriter_syncer.go
+1 -1
View File
@@ -16,7 +16,7 @@ import (
"k8s.io/apiserver/pkg/registry/rest"
"k8s.io/klog/v2"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
)
pkg/middleware/auth_test.go
+7 -7
View File
@@ -7,10 +7,10 @@ import (
"net/http/httptest"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/log/logtest"
"github.com/grafana/grafana/pkg/infra/tracing"
@@ -68,7 +68,7 @@ func TestAuth_Middleware(t *testing.T) {
desc: "ReqSignedIn should return 200 for anonymous user",
path: "/api/secure",
authMiddleware: ReqSignedIn,
identity: &authn.Identity{Type: claims.TypeAnonymous},
identity: &authn.Identity{Type: authlib.TypeAnonymous},
expecedReached: true,
expectedCode: http.StatusOK,
},
@@ -76,7 +76,7 @@ func TestAuth_Middleware(t *testing.T) {
desc: "ReqSignedIn should return redirect anonymous user with forceLogin query string",
path: "/secure?forceLogin=true",
authMiddleware: ReqSignedIn,
identity: &authn.Identity{Type: claims.TypeAnonymous},
identity: &authn.Identity{Type: authlib.TypeAnonymous},
expecedReached: false,
expectedCode: http.StatusFound,
},
@@ -84,7 +84,7 @@ func TestAuth_Middleware(t *testing.T) {
desc: "ReqSignedIn should return redirect anonymous user when orgId in query string is different from currently used",
path: "/secure?orgId=2",
authMiddleware: ReqSignedIn,
identity: &authn.Identity{Type: claims.TypeAnonymous},
identity: &authn.Identity{Type: authlib.TypeAnonymous},
expecedReached: false,
expectedCode: http.StatusFound,
},
@@ -92,7 +92,7 @@ func TestAuth_Middleware(t *testing.T) {
desc: "ReqSignedInNoAnonymous should return 401 for anonymous user",
path: "/api/secure",
authMiddleware: ReqSignedInNoAnonymous,
identity: &authn.Identity{Type: claims.TypeAnonymous},
identity: &authn.Identity{Type: authlib.TypeAnonymous},
expecedReached: false,
expectedCode: http.StatusUnauthorized,
},
@@ -100,7 +100,7 @@ func TestAuth_Middleware(t *testing.T) {
desc: "ReqSignedInNoAnonymous should return 200 for authenticated user",
path: "/api/secure",
authMiddleware: ReqSignedInNoAnonymous,
identity: &authn.Identity{ID: "1", Type: claims.TypeUser},
identity: &authn.Identity{ID: "1", Type: authlib.TypeUser},
expecedReached: true,
expectedCode: http.StatusOK,
},
@@ -108,7 +108,7 @@ func TestAuth_Middleware(t *testing.T) {
desc: "snapshot public mode disabled should return 200 for authenticated user",
path: "/api/secure",
authMiddleware: SnapshotPublicModeOrCreate(&setting.Cfg{SnapshotPublicMode: false}, ac),
identity: &authn.Identity{ID: "1", Type: claims.TypeUser},
identity: &authn.Identity{ID: "1", Type: authlib.TypeUser},
expecedReached: true,
expectedCode: http.StatusOK,
},
pkg/middleware/quota_test.go
+2 -1
View File
@@ -3,9 +3,10 @@ package middleware
import (
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/quota/quotatest"
pkg/registry/apis/dashboard/authorizer.go
+1 -1
View File
@@ -5,7 +5,7 @@ import (
"k8s.io/apiserver/pkg/authorization/authorizer"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/dashboards"
pkg/registry/apis/dashboard/legacy/sql_dashboards.go
+2 -2
View File
@@ -13,7 +13,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/ptr"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
@@ -359,7 +359,7 @@ func (a *dashboardSqlAccess) DeleteDashboard(ctx context.Context, orgId int64, u
// SaveDashboard implements DashboardAccess.
func (a *dashboardSqlAccess) SaveDashboard(ctx context.Context, orgId int64, dash *dashboard.Dashboard) (*dashboard.Dashboard, bool, error) {
created := false
user, ok := claims.From(ctx)
user, ok := claims.AuthInfoFrom(ctx)
if !ok || user == nil {
return nil, created, fmt.Errorf("no user found in context")
}
pkg/registry/apis/dashboard/legacy/storage.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"strings"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/utils"
dashboard "github.com/grafana/grafana/pkg/apis/dashboard"
"github.com/grafana/grafana/pkg/storage/unified/resource"
pkg/registry/apis/dashboard/register.go
+1 -1
View File
@@ -14,7 +14,7 @@ import (
"k8s.io/kube-openapi/pkg/common"
"k8s.io/kube-openapi/pkg/spec3"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
dashboardinternal "github.com/grafana/grafana/pkg/apis/dashboard"
dashboardv0alpha1 "github.com/grafana/grafana/pkg/apis/dashboard/v0alpha1"
dashboardv1alpha1 "github.com/grafana/grafana/pkg/apis/dashboard/v1alpha1"
pkg/registry/apis/dashboard/sub_dto.go
+1 -1
View File
@@ -10,7 +10,7 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/registry/rest"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
dashboard "github.com/grafana/grafana/pkg/apis/dashboard"
pkg/registry/apis/dashboardsnapshot/register.go
+1 -1
View File
@@ -18,7 +18,7 @@ import (
"k8s.io/kube-openapi/pkg/spec3"
"k8s.io/kube-openapi/pkg/validation/spec"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
dashboardsnapshot "github.com/grafana/grafana/pkg/apis/dashboardsnapshot/v0alpha1"
"github.com/grafana/grafana/pkg/infra/db"
pkg/registry/apis/folders/legacy_storage.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/registry/rest"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/apierrors"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
pkg/registry/apis/iam/authorizer.go
+5 -6
View File
@@ -4,10 +4,9 @@ import (
"context"
"fmt"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
"k8s.io/apiserver/pkg/authorization/authorizer"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/utils"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
@@ -15,7 +14,7 @@ import (
gfauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
)
func newLegacyAuthorizer(ac accesscontrol.AccessControl, store legacy.LegacyIdentityStore) (authorizer.Authorizer, authz.AccessClient) {
func newLegacyAuthorizer(ac accesscontrol.AccessControl, store legacy.LegacyIdentityStore) (authorizer.Authorizer, authlib.AccessClient) {
client := accesscontrol.NewLegacyAccessClient(
ac,
accesscontrol.ResourceAuthorizerOptions{
@@ -25,7 +24,7 @@ func newLegacyAuthorizer(ac accesscontrol.AccessControl, store legacy.LegacyIden
utils.VerbGet: accesscontrol.ActionOrgUsersRead,
utils.VerbList: accesscontrol.ActionOrgUsersRead,
},
Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns claims.NamespaceInfo, name string) ([]string, error) {
Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns authlib.NamespaceInfo, name string) ([]string, error) {
res, err := store.GetUserInternalID(ctx, ns, legacy.GetUserInternalIDQuery{
UID: name,
})
@@ -45,7 +44,7 @@ func newLegacyAuthorizer(ac accesscontrol.AccessControl, store legacy.LegacyIden
accesscontrol.ResourceAuthorizerOptions{
Resource: iamv0.ServiceAccountResourceInfo.GetName(),
Attr: "id",
Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns claims.NamespaceInfo, name string) ([]string, error) {
Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns authlib.NamespaceInfo, name string) ([]string, error) {
res, err := store.GetServiceAccountInternalID(ctx, ns, legacy.GetServiceAccountInternalIDQuery{
UID: name,
})
@@ -58,7 +57,7 @@ func newLegacyAuthorizer(ac accesscontrol.AccessControl, store legacy.LegacyIden
accesscontrol.ResourceAuthorizerOptions{
Resource: iamv0.TeamResourceInfo.GetName(),
Attr: "id",
Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns claims.NamespaceInfo, name string) ([]string, error) {
Resolver: accesscontrol.ResourceResolverFunc(func(ctx context.Context, ns authlib.NamespaceInfo, name string) ([]string, error) {
res, err := store.GetTeamInternalID(ctx, ns, legacy.GetTeamInternalIDQuery{
UID: name,
})
pkg/registry/apis/iam/common/common.go
+5 -6
View File
@@ -4,8 +4,7 @@ import (
"context"
"strconv"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
@@ -41,14 +40,14 @@ type ListResponse[T Resource] struct {
Continue int64
}
type ListFunc[T Resource] func(ctx context.Context, ns claims.NamespaceInfo, p Pagination) (*ListResponse[T], error)
type ListFunc[T Resource] func(ctx context.Context, ns authlib.NamespaceInfo, p Pagination) (*ListResponse[T], error)
// List is a helper function that will perform access check on resources if
// prvovided with a claims.AccessClient.
// prvovided with a authlib.AccessClient.
func List[T Resource](
ctx context.Context,
resourceName string,
ac authz.AccessClient,
ac authlib.AccessClient,
p Pagination,
fn ListFunc[T],
) (*ListResponse[T], error) {
@@ -65,7 +64,7 @@ func List[T Resource](
check := func(_, _, _ string) bool { return true }
if ac != nil {
var err error
check, err = ac.Compile(ctx, ident, authz.ListRequest{
check, err = ac.Compile(ctx, ident, authlib.ListRequest{
Resource: resourceName,
Namespace: ns.Value,
})
pkg/registry/apis/iam/common/common_test.go
+4 -4
View File
@@ -4,10 +4,10 @@ import (
"context"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"k8s.io/apiserver/pkg/endpoints/request"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
@@ -28,7 +28,7 @@ func TestList(t *testing.T) {
t.Run("should allow all items if no access client is passed", func(t *testing.T) {
ctx := newContext("stacks-1", newIdent())
res, err := List(ctx, "items", nil, Pagination{Limit: 2}, func(ctx context.Context, ns claims.NamespaceInfo, p Pagination) (*ListResponse[item], error) {
res, err := List(ctx, "items", nil, Pagination{Limit: 2}, func(ctx context.Context, ns authlib.NamespaceInfo, p Pagination) (*ListResponse[item], error) {
return &ListResponse[item]{
Items: []item{{"1"}, {"2"}},
}, nil
@@ -44,7 +44,7 @@ func TestList(t *testing.T) {
Resource: "items",
Attr: "uid",
})
res, err := List(ctx, "items", a, Pagination{Limit: 2}, func(ctx context.Context, ns claims.NamespaceInfo, p Pagination) (*ListResponse[item], error) {
res, err := List(ctx, "items", a, Pagination{Limit: 2}, func(ctx context.Context, ns authlib.NamespaceInfo, p Pagination) (*ListResponse[item], error) {
return &ListResponse[item]{
Items: []item{{"1"}, {"2"}},
}, nil
@@ -66,7 +66,7 @@ func TestList(t *testing.T) {
var called bool
res, err := List(ctx, "items", a, Pagination{Limit: 2}, func(ctx context.Context, ns claims.NamespaceInfo, p Pagination) (*ListResponse[item], error) {
res, err := List(ctx, "items", a, Pagination{Limit: 2}, func(ctx context.Context, ns authlib.NamespaceInfo, p Pagination) (*ListResponse[item], error) {
if called {
return &ListResponse[item]{
Items: []item{{"3"}},
pkg/registry/apis/iam/legacy/display.go
+1 -1
View File
@@ -4,7 +4,7 @@ import (
"context"
"fmt"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/storage/legacysql"
"github.com/grafana/grafana/pkg/storage/unified/sql/sqltemplate"
)
pkg/registry/apis/iam/legacy/service_account.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"fmt"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
"github.com/grafana/grafana/pkg/storage/legacysql"
"github.com/grafana/grafana/pkg/storage/unified/sql/sqltemplate"
pkg/registry/apis/iam/legacy/sql.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"fmt"
"text/template"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/storage/legacysql"
)
pkg/registry/apis/iam/legacy/team.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"fmt"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
"github.com/grafana/grafana/pkg/services/team"
"github.com/grafana/grafana/pkg/storage/legacysql"
pkg/registry/apis/iam/legacy/user.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"fmt"
"text/template"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
"github.com/grafana/grafana/pkg/services/team"
"github.com/grafana/grafana/pkg/services/user"
pkg/registry/apis/iam/register.go
+2 -2
View File
@@ -11,7 +11,7 @@ import (
genericapiserver "k8s.io/apiserver/pkg/server"
common "k8s.io/kube-openapi/pkg/common"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/infra/db"
@@ -32,7 +32,7 @@ var _ builder.APIGroupBuilder = (*IdentityAccessManagementAPIBuilder)(nil)
type IdentityAccessManagementAPIBuilder struct {
store legacy.LegacyIdentityStore
authorizer authorizer.Authorizer
accessClient authz.AccessClient
accessClient types.AccessClient
// Not set for multi-tenant deployment for now
sso ssosettings.Service
pkg/registry/apis/iam/serviceaccount/store.go
+3 -4
View File
@@ -10,8 +10,7 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/registry/rest"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/utils"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
@@ -29,13 +28,13 @@ var (
var resource = iamv0.ServiceAccountResourceInfo
func NewLegacyStore(store legacy.LegacyIdentityStore, ac authz.AccessClient) *LegacyStore {
func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient) *LegacyStore {
return &LegacyStore{store, ac}
}
type LegacyStore struct {
store legacy.LegacyIdentityStore
ac authz.AccessClient
ac claims.AccessClient
}
func (s *LegacyStore) New() runtime.Object {
pkg/registry/apis/iam/team/rest_members.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/registry/rest"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
pkg/registry/apis/iam/team/store.go
+3 -4
View File
@@ -10,8 +10,7 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/registry/rest"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/utils"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
@@ -30,13 +29,13 @@ var (
var resource = iamv0.TeamResourceInfo
func NewLegacyStore(store legacy.LegacyIdentityStore, ac authz.AccessClient) *LegacyStore {
func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient) *LegacyStore {
return &LegacyStore{store, ac}
}
type LegacyStore struct {
store legacy.LegacyIdentityStore
ac authz.AccessClient
ac claims.AccessClient
}
func (s *LegacyStore) New() runtime.Object {
pkg/registry/apis/iam/team/store_binding.go
+1 -1
View File
@@ -10,7 +10,7 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/registry/rest"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
pkg/registry/apis/iam/user/rest_display.go
+6 -5
View File
@@ -6,16 +6,17 @@ import (
"strconv"
"strings"
"github.com/grafana/authlib/claims"
errorsK8s "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apiserver/pkg/registry/rest"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/dtos"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
"github.com/grafana/grafana/pkg/setting"
errorsK8s "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apiserver/pkg/registry/rest"
)
type LegacyDisplayREST struct {
pkg/registry/apis/iam/user/store.go
+3 -4
View File
@@ -10,8 +10,7 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/registry/rest"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/utils"
iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
"github.com/grafana/grafana/pkg/registry/apis/iam/common"
@@ -30,13 +29,13 @@ var (
var resource = iamv0.UserResourceInfo
func NewLegacyStore(store legacy.LegacyIdentityStore, ac authz.AccessClient) *LegacyStore {
func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient) *LegacyStore {
return &LegacyStore{store, ac}
}
type LegacyStore struct {
store legacy.LegacyIdentityStore
ac authz.AccessClient
ac claims.AccessClient
}
func (s *LegacyStore) New() runtime.Object {
pkg/server/wireexts_oss.go
+1
View File
@@ -6,6 +6,7 @@ package server
import (
"github.com/google/wire"
search2 "github.com/grafana/grafana/pkg/storage/unified/search"
"github.com/grafana/grafana/pkg/infra/metrics"
pkg/services/accesscontrol/acimpl/service.go
+1 -1
View File
@@ -8,10 +8,10 @@ import (
"strings"
"time"
"github.com/grafana/authlib/claims"
"github.com/prometheus/client_golang/prometheus"
"go.opentelemetry.io/otel/attribute"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/db"
pkg/services/accesscontrol/api/api.go
+2 -1
View File
@@ -7,9 +7,10 @@ import (
"net/http"
"strconv"
"github.com/grafana/authlib/claims"
"go.opentelemetry.io/otel"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/middleware"
pkg/services/accesscontrol/authorize_in_org_test.go
+1 -1
View File
@@ -9,7 +9,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
pkg/services/accesscontrol/authorizer.go
+14 -15
View File
@@ -5,8 +5,7 @@ import (
"errors"
"fmt"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
)
@@ -45,7 +44,7 @@ type ResourceAuthorizerOptions struct {
Resolver ResourceResolver
}
var _ authz.AccessClient = (*LegacyAccessClient)(nil)
var _ claims.AccessClient = (*LegacyAccessClient)(nil)
func NewLegacyAccessClient(ac AccessControl, opts ...ResourceAuthorizerOptions) *LegacyAccessClient {
stored := map[string]ResourceAuthorizerOptions{}
@@ -85,34 +84,34 @@ type LegacyAccessClient struct {
opts map[string]ResourceAuthorizerOptions
}
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
ident, ok := id.(identity.Requester)
if !ok {
return authz.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
return claims.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
}
opts, ok := c.opts[req.Resource]
if !ok {
// For now we fallback to grafana admin if no options are found for resource.
if ident.GetIsGrafanaAdmin() {
return authz.CheckResponse{Allowed: true}, nil
return claims.CheckResponse{Allowed: true}, nil
}
return authz.CheckResponse{}, nil
return claims.CheckResponse{}, nil
}
skip := opts.Unchecked[req.Verb]
if skip {
return authz.CheckResponse{Allowed: true}, nil
return claims.CheckResponse{Allowed: true}, nil
}
action, ok := opts.Mapping[req.Verb]
if !ok {
return authz.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
return claims.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
}
ns, err := claims.ParseNamespace(req.Namespace)
if err != nil {
return authz.CheckResponse{}, err
return claims.CheckResponse{}, err
}
var eval Evaluator
@@ -120,7 +119,7 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
if opts.Resolver != nil {
scopes, err := opts.Resolver.Resolve(ctx, ns, req.Name)
if err != nil {
return authz.CheckResponse{}, err
return claims.CheckResponse{}, err
}
eval = EvalPermission(action, scopes...)
} else {
@@ -131,18 +130,18 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
eval = EvalPermission(action)
} else {
// Assuming that all non list request should have a valid name
return authz.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
return claims.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
}
allowed, err := c.ac.Evaluate(ctx, ident, eval)
if err != nil {
return authz.CheckResponse{}, err
return claims.CheckResponse{}, err
}
return authz.CheckResponse{Allowed: allowed}, nil
return claims.CheckResponse{Allowed: allowed}, nil
}
func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req claims.ListRequest) (claims.ItemChecker, error) {
ident, ok := id.(identity.Requester)
if !ok {
return nil, errors.New("expected identity.Requester for legacy access control")
pkg/services/accesscontrol/authorizer_test.go
+7 -8
View File
@@ -6,8 +6,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/grafana/authlib/authz"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
@@ -20,7 +19,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
t.Run("should reject when when no configuration for resource exist", func(t *testing.T) {
a := accesscontrol.NewLegacyAccessClient(ac)
res, err := a.Check(context.Background(), &identity.StaticRequester{}, authz.CheckRequest{
res, err := a.Check(context.Background(), &identity.StaticRequester{}, authlib.CheckRequest{
Verb: "get",
Resource: "dashboards",
Namespace: "default",
@@ -43,7 +42,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
accesscontrol.Permission{Action: "dashboards:read", Scope: "dashboards:uid:2"},
)
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "get",
Namespace: "default",
Resource: "dashboards",
@@ -67,7 +66,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
accesscontrol.Permission{Action: "dashboards:read"},
)
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "list",
Namespace: "default",
Resource: "dashboards",
@@ -90,7 +89,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
accesscontrol.Permission{Action: "dashboards:read", Scope: "dashboards:uid:1"},
)
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "get",
Namespace: "default",
Resource: "dashboards",
@@ -115,7 +114,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
ident := newIdent(accesscontrol.Permission{})
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "get",
Namespace: "default",
Resource: "dashboards",
@@ -125,7 +124,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
res, err = a.Check(context.Background(), ident, authz.CheckRequest{
res, err = a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "create",
Namespace: "default",
Resource: "dashboards",
pkg/services/accesscontrol/cacheutils_test.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
pkg/services/accesscontrol/dualwrite/reconciler.go
+2 -1
View File
@@ -6,9 +6,10 @@ import (
"strconv"
"time"
"github.com/grafana/authlib/claims"
"go.opentelemetry.io/otel"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/serverlock"
pkg/services/accesscontrol/dualwrite/resource_reconciler.go
+2 -1
View File
@@ -4,9 +4,10 @@ import (
"context"
"fmt"
"github.com/grafana/authlib/claims"
openfgav1 "github.com/openfga/api/proto/openfga/v1"
claims "github.com/grafana/authlib/types"
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
"github.com/grafana/grafana/pkg/services/authz/zanzana"
)
pkg/services/accesscontrol/ossaccesscontrol/receivers.go
+1 -1
View File
@@ -3,7 +3,7 @@ package ossaccesscontrol
import (
"context"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/apimachinery/identity"
pkg/services/anonymous/anonimpl/client.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"net/http"
"strings"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/anonymous"
pkg/services/anonymous/anonimpl/client_test.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/anonymous/anontest"
"github.com/grafana/grafana/pkg/services/authn"
pkg/services/apiserver/auth/authorizer/org_id.go
+3 -2
View File
@@ -4,11 +4,12 @@ import (
"context"
"fmt"
"github.com/grafana/authlib/claims"
"k8s.io/apiserver/pkg/authorization/authorizer"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
"k8s.io/apiserver/pkg/authorization/authorizer"
)
var _ authorizer.Authorizer = &orgIDAuthorizer{}
pkg/services/apiserver/auth/authorizer/resource.go
+6 -6
View File
@@ -4,18 +4,18 @@ import (
"context"
"errors"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
"k8s.io/apiserver/pkg/authorization/authorizer"
claims "github.com/grafana/authlib/types"
)
func NewResourceAuthorizer(c authz.AccessClient) authorizer.Authorizer {
func NewResourceAuthorizer(c claims.AccessClient) authorizer.Authorizer {
return ResourceAuthorizer{c}
}
// ResourceAuthorizer is used to translate authorizer.Authorizer calls to claims.AccessClient calls
type ResourceAuthorizer struct {
c authz.AccessClient
c claims.AccessClient
}
func (r ResourceAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error) {
@@ -23,12 +23,12 @@ func (r ResourceAuthorizer) Authorize(ctx context.Context, attr authorizer.Attri
return authorizer.DecisionNoOpinion, "", nil
}
ident, ok := claims.From(ctx)
ident, ok := claims.AuthInfoFrom(ctx)
if !ok {
return authorizer.DecisionDeny, "", errors.New("no identity found for request")
}
res, err := r.c.Check(ctx, ident, authz.CheckRequest{
res, err := r.c.Check(ctx, ident, claims.CheckRequest{
Verb: attr.GetVerb(),
Group: attr.GetAPIGroup(),
Resource: attr.GetResource(),
pkg/services/apiserver/auth/authorizer/stack_id.go
+3 -2
View File
@@ -5,11 +5,12 @@ import (
"fmt"
"strconv"
"github.com/grafana/authlib/claims"
"k8s.io/apiserver/pkg/authorization/authorizer"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/setting"
"k8s.io/apiserver/pkg/authorization/authorizer"
)
var _ authorizer.Authorizer = &stackIDAuthorizer{}
pkg/services/apiserver/endpoints/request/namespace.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"k8s.io/apiserver/pkg/endpoints/request"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/setting"
)
pkg/services/auth/idimpl/service.go
+3 -2
View File
@@ -7,11 +7,12 @@ import (
"time"
"github.com/go-jose/go-jose/v3/jwt"
authnlib "github.com/grafana/authlib/authn"
"github.com/grafana/authlib/claims"
"github.com/prometheus/client_golang/prometheus"
"golang.org/x/sync/singleflight"
authnlib "github.com/grafana/authlib/authn"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/remotecache"
pkg/services/auth/idimpl/service_test.go
+1 -1
View File
@@ -9,7 +9,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/remotecache"
"github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/auth/idtest"
pkg/services/authn/authn.go
+1 -1
View File
@@ -8,7 +8,7 @@ import (
"strconv"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/middleware/cookies"
pkg/services/authn/authnimpl/service.go
+2 -1
View File
@@ -7,12 +7,13 @@ import (
"strconv"
"strings"
"github.com/grafana/authlib/claims"
"github.com/prometheus/client_golang/prometheus"
"go.opentelemetry.io/otel/attribute"
"go.opentelemetry.io/otel/codes"
"go.opentelemetry.io/otel/trace"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
pkg/services/authn/authnimpl/service_test.go
+2 -1
View File
@@ -8,13 +8,14 @@ import (
"slices"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.opentelemetry.io/otel/codes"
sdktrace "go.opentelemetry.io/otel/sdk/trace"
"go.opentelemetry.io/otel/sdk/trace/tracetest"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
pkg/services/authn/authnimpl/sync/oauth_token_sync.go
+2 -1
View File
@@ -7,10 +7,11 @@ import (
"strings"
"time"
"github.com/grafana/authlib/claims"
"golang.org/x/oauth2"
"golang.org/x/sync/singleflight"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/localcache"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
pkg/services/authn/authnimpl/sync/oauth_token_sync_test.go
+2 -1
View File
@@ -6,11 +6,12 @@ import (
"testing"
"time"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"golang.org/x/oauth2"
"golang.org/x/sync/singleflight"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/localcache"
"github.com/grafana/grafana/pkg/infra/log"
pkg/services/authn/authnimpl/sync/org_sync.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"fmt"
"sort"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/accesscontrol"
pkg/services/authn/authnimpl/sync/org_sync_test.go
+2 -1
View File
@@ -5,10 +5,11 @@ import (
"fmt"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/mock"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
pkg/services/authn/authnimpl/sync/rbac_sync.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"golang.org/x/exp/maps"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
pkg/services/authn/authnimpl/sync/rbac_sync_test.go
+2 -1
View File
@@ -4,10 +4,11 @@ import (
"context"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
pkg/services/authn/authnimpl/sync/user_sync.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"fmt"
"strconv"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/infra/log"
pkg/services/authn/authnimpl/sync/user_sync_test.go
+2 -1
View File
@@ -4,10 +4,11 @@ import (
"context"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/featuremgmt"
pkg/services/authn/authntest/mock.go
+1 -1
View File
@@ -3,7 +3,7 @@ package authntest
import (
"context"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/models/usertoken"
"github.com/grafana/grafana/pkg/services/authn"
pkg/services/authn/clients/api_key.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"strings"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/components/apikeygen"
"github.com/grafana/grafana/pkg/components/satokengen"
pkg/services/authn/clients/api_key_test.go
+1 -1
View File
@@ -9,7 +9,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/components/apikeygen"
"github.com/grafana/grafana/pkg/components/satokengen"
"github.com/grafana/grafana/pkg/services/apikey"
pkg/services/authn/clients/basic_test.go
+2 -1
View File
@@ -5,9 +5,10 @@ import (
"net/http"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/authn/authntest"
)
pkg/services/authn/clients/ext_jwt.go
+2 -1
View File
@@ -7,8 +7,9 @@ import (
"strings"
"github.com/go-jose/go-jose/v3/jwt"
authlib "github.com/grafana/authlib/authn"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/infra/log"
pkg/services/authn/clients/ext_jwt_test.go
+3 -2
View File
@@ -11,11 +11,12 @@ import (
"github.com/go-jose/go-jose/v3"
"github.com/go-jose/go-jose/v3/jwt"
authnlib "github.com/grafana/authlib/authn"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
authnlib "github.com/grafana/authlib/authn"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/setting"
)
pkg/services/authn/clients/grafana.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"net/mail"
"strconv"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/org"
pkg/services/authn/clients/grafana_test.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/org"
pkg/services/authn/clients/oauth_test.go
+1 -1
View File
@@ -14,7 +14,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/login/social"
"github.com/grafana/grafana/pkg/login/social/socialtest"
pkg/services/authn/clients/password_test.go
+2 -1
View File
@@ -4,9 +4,10 @@ import (
"context"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/authn/authntest"
"github.com/grafana/grafana/pkg/services/loginattempt/loginattempttest"
pkg/services/authn/clients/passwordless.go
+1 -1
View File
@@ -9,7 +9,7 @@ import (
"strconv"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/remotecache"
pkg/services/authn/clients/passwordless_test.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/remotecache"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
pkg/services/authn/clients/proxy.go
+1 -1
View File
@@ -12,7 +12,7 @@ import (
"strings"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/infra/log"
pkg/services/authn/clients/proxy_test.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/authn/authntest"
"github.com/grafana/grafana/pkg/setting"
pkg/services/authn/clients/render.go
+1 -1
View File
@@ -5,7 +5,7 @@ import (
"strconv"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/errutil"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
pkg/services/authn/clients/render_test.go
+2 -1
View File
@@ -7,9 +7,10 @@ import (
"time"
"github.com/golang/mock/gomock"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/org"
pkg/services/authn/clients/session.go
+1 -1
View File
@@ -7,7 +7,7 @@ import (
"strconv"
"time"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/authn"
pkg/services/authn/clients/session_test.go
+2 -1
View File
@@ -6,10 +6,11 @@ import (
"testing"
"time"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/models/usertoken"
"github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/auth/authtest"
pkg/services/authn/identity.go
+3 -2
View File
@@ -5,10 +5,11 @@ import (
"strconv"
"time"
"github.com/grafana/authlib/authn"
"github.com/grafana/authlib/claims"
"golang.org/x/oauth2"
"github.com/grafana/authlib/authn"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/models/usertoken"
"github.com/grafana/grafana/pkg/services/login"
pkg/services/authz/client.go
+10 -10
View File
@@ -6,14 +6,14 @@ import (
"github.com/fullstorydev/grpchan"
"github.com/fullstorydev/grpchan/inprocgrpc"
authnlib "github.com/grafana/authlib/authn"
authzlib "github.com/grafana/authlib/authz"
authzv1 "github.com/grafana/authlib/authz/proto/v1"
"github.com/grafana/authlib/claims"
grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials/insecure"
authnlib "github.com/grafana/authlib/authn"
authzlib "github.com/grafana/authlib/authz"
authzv1 "github.com/grafana/authlib/authz/proto/v1"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
@@ -38,7 +38,7 @@ func ProvideAuthZClient(
tracer tracing.Tracer,
db db.DB,
acService accesscontrol.Service,
) (authzlib.AccessClient, error) {
) (authlib.AccessClient, error) {
authCfg, err := ReadCfg(cfg)
if err != nil {
return nil, err
@@ -76,7 +76,7 @@ func ProvideAuthZClient(
// You need to provide a remote address in the configuration
func ProvideStandaloneAuthZClient(
cfg *setting.Cfg, features featuremgmt.FeatureToggles, tracer tracing.Tracer,
) (authzlib.AccessClient, error) {
) (authlib.AccessClient, error) {
if !features.IsEnabledGlobally(featuremgmt.FlagAuthZGRPCServer) {
return nil, nil
}
@@ -92,10 +92,10 @@ func ProvideStandaloneAuthZClient(
return newCloudLegacyClient(authCfg, tracer)
}
func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authzlib.AccessClient, error) {
func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authlib.AccessClient, error) {
// For in-proc use-case authorize add fake service claims - it should be able to access every namespace, as there is only one
staticAuth := func(ctx context.Context) (context.Context, error) {
ctx = claims.WithClaims(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
ctx = authlib.WithAuthInfo(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
Rest: authnlib.AccessTokenClaims{
Namespace: "*",
},
@@ -121,7 +121,7 @@ func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authzli
)
}
func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessClient, error) {
func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authlib.AccessClient, error) {
// This client interceptor is a noop, as we don't send an access token
clientConfig := authnlib.GrpcClientConfig{}
clientInterceptor, err := authnlib.NewGrpcClientInterceptor(
@@ -151,7 +151,7 @@ func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessCl
return client, nil
}
func newCloudLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessClient, error) {
func newCloudLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authlib.AccessClient, error) {
grpcClientConfig := authnlib.GrpcClientConfig{
TokenClientConfig: &authnlib.TokenExchangeConfig{
Token: authCfg.token,
pkg/services/authz/rbac/models.go
+1 -1
View File
@@ -1,6 +1,6 @@
package rbac
import "github.com/grafana/authlib/claims"
import claims "github.com/grafana/authlib/types"
type CheckRequest struct {
Namespace claims.NamespaceInfo
pkg/services/authz/rbac/service.go
+4 -3
View File
@@ -7,8 +7,6 @@ import (
"strings"
"time"
authzv1 "github.com/grafana/authlib/authz/proto/v1"
"github.com/grafana/authlib/claims"
"go.opentelemetry.io/otel/attribute"
"go.opentelemetry.io/otel/trace"
"golang.org/x/sync/singleflight"
@@ -16,6 +14,9 @@ import (
"google.golang.org/grpc/status"
"k8s.io/apiserver/pkg/endpoints/request"
authzv1 "github.com/grafana/authlib/authz/proto/v1"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/localcache"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
@@ -200,7 +201,7 @@ func validateNamespace(ctx context.Context, nameSpace string) (claims.NamespaceI
if nameSpace == "" {
return claims.NamespaceInfo{}, status.Error(codes.InvalidArgument, "namespace is required")
}
authInfo, has := claims.From(ctx)
authInfo, has := claims.AuthInfoFrom(ctx)
if !has {
return claims.NamespaceInfo{}, status.Error(codes.Internal, "could not get auth info from context")
}
pkg/services/authz/rbac/service_test.go
+2 -1
View File
@@ -5,11 +5,12 @@ import (
"fmt"
"testing"
"github.com/grafana/authlib/claims"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"golang.org/x/sync/singleflight"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/localcache"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
pkg/services/authz/rbac/store/permission_store.go
+5 -6
View File
@@ -3,8 +3,7 @@ package store
import (
"context"
"github.com/grafana/authlib/claims"
"github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/storage/legacysql"
@@ -12,7 +11,7 @@ import (
)
type PermissionStore interface {
GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error)
GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error)
}
type PermissionsQuery struct {
@@ -63,7 +62,7 @@ func newGetPermissions(sql *legacysql.LegacyDatabaseHelper, q *PermissionsQuery)
}
}
func (s *SQLPermissionsStore) GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
func (s *SQLPermissionsStore) GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
ctx, span := s.tracer.Start(ctx, "authz_direct_db.database.GetUserPermissions")
defer span.End()
@@ -111,7 +110,7 @@ type StaticPermissionStore struct {
ac accesscontrol.Service
}
func (s *StaticPermissionStore) GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
func (s *StaticPermissionStore) GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
roles := []string{query.Role}
if query.IsServerAdmin {
roles = append(roles, "Grafana Admin")
@@ -146,7 +145,7 @@ type UnionPermissionStore struct {
stores []PermissionStore
}
func (u *UnionPermissionStore) GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
func (u *UnionPermissionStore) GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
var permissions []accesscontrol.Permission
for _, s := range u.stores {
result, err := s.GetUserPermissions(ctx, ns, query)
pkg/services/authz/rbac/store/store.go
+2 -1
View File
@@ -3,9 +3,10 @@ package store
import (
"fmt"
"github.com/grafana/authlib/claims"
"golang.org/x/net/context"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/storage/legacysql"
"github.com/grafana/grafana/pkg/storage/unified/sql/sqltemplate"

Some files were not shown because too many files have changed in this diff Show More