public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Authlib: Use types package rather than claims (#99243)

Browse Source
This commit is contained in:
Ryan McKinley
2025-01-21 12:06:55 +03:00
committed by GitHub
parent b2d0359e72
commit 680e6bc1f8
149 changed files with 394 additions and 376 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/acimpl/service.go
+1 -1
View File
@@ -8,10 +8,10 @@ import (
"strings"
"time"
"github.com/grafana/authlib/claims"
"github.com/prometheus/client_golang/prometheus"
"go.opentelemetry.io/otel/attribute"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/db"
pkg/services/accesscontrol/api/api.go
+2 -1
View File
@@ -7,9 +7,10 @@ import (
"net/http"
"strconv"
"github.com/grafana/authlib/claims"
"go.opentelemetry.io/otel"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/middleware"
pkg/services/accesscontrol/authorize_in_org_test.go
+1 -1
View File
@@ -9,7 +9,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
pkg/services/accesscontrol/authorizer.go
+14 -15
View File
@@ -5,8 +5,7 @@ import (
"errors"
"fmt"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
)
@@ -45,7 +44,7 @@ type ResourceAuthorizerOptions struct {
Resolver ResourceResolver
}
var _ authz.AccessClient = (*LegacyAccessClient)(nil)
var _ claims.AccessClient = (*LegacyAccessClient)(nil)
func NewLegacyAccessClient(ac AccessControl, opts ...ResourceAuthorizerOptions) *LegacyAccessClient {
stored := map[string]ResourceAuthorizerOptions{}
@@ -85,34 +84,34 @@ type LegacyAccessClient struct {
opts map[string]ResourceAuthorizerOptions
}
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
ident, ok := id.(identity.Requester)
if !ok {
return authz.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
return claims.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
}
opts, ok := c.opts[req.Resource]
if !ok {
// For now we fallback to grafana admin if no options are found for resource.
if ident.GetIsGrafanaAdmin() {
return authz.CheckResponse{Allowed: true}, nil
return claims.CheckResponse{Allowed: true}, nil
}
return authz.CheckResponse{}, nil
return claims.CheckResponse{}, nil
}
skip := opts.Unchecked[req.Verb]
if skip {
return authz.CheckResponse{Allowed: true}, nil
return claims.CheckResponse{Allowed: true}, nil
}
action, ok := opts.Mapping[req.Verb]
if !ok {
return authz.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
return claims.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
}
ns, err := claims.ParseNamespace(req.Namespace)
if err != nil {
return authz.CheckResponse{}, err
return claims.CheckResponse{}, err
}
var eval Evaluator
@@ -120,7 +119,7 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
if opts.Resolver != nil {
scopes, err := opts.Resolver.Resolve(ctx, ns, req.Name)
if err != nil {
return authz.CheckResponse{}, err
return claims.CheckResponse{}, err
}
eval = EvalPermission(action, scopes...)
} else {
@@ -131,18 +130,18 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
eval = EvalPermission(action)
} else {
// Assuming that all non list request should have a valid name
return authz.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
return claims.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
}
allowed, err := c.ac.Evaluate(ctx, ident, eval)
if err != nil {
return authz.CheckResponse{}, err
return claims.CheckResponse{}, err
}
return authz.CheckResponse{Allowed: allowed}, nil
return claims.CheckResponse{Allowed: allowed}, nil
}
func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req claims.ListRequest) (claims.ItemChecker, error) {
ident, ok := id.(identity.Requester)
if !ok {
return nil, errors.New("expected identity.Requester for legacy access control")
pkg/services/accesscontrol/authorizer_test.go
+7 -8
View File
@@ -6,8 +6,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/grafana/authlib/authz"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
@@ -20,7 +19,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
t.Run("should reject when when no configuration for resource exist", func(t *testing.T) {
a := accesscontrol.NewLegacyAccessClient(ac)
res, err := a.Check(context.Background(), &identity.StaticRequester{}, authz.CheckRequest{
res, err := a.Check(context.Background(), &identity.StaticRequester{}, authlib.CheckRequest{
Verb: "get",
Resource: "dashboards",
Namespace: "default",
@@ -43,7 +42,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
accesscontrol.Permission{Action: "dashboards:read", Scope: "dashboards:uid:2"},
)
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "get",
Namespace: "default",
Resource: "dashboards",
@@ -67,7 +66,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
accesscontrol.Permission{Action: "dashboards:read"},
)
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "list",
Namespace: "default",
Resource: "dashboards",
@@ -90,7 +89,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
accesscontrol.Permission{Action: "dashboards:read", Scope: "dashboards:uid:1"},
)
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "get",
Namespace: "default",
Resource: "dashboards",
@@ -115,7 +114,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
ident := newIdent(accesscontrol.Permission{})
res, err := a.Check(context.Background(), ident, authz.CheckRequest{
res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "get",
Namespace: "default",
Resource: "dashboards",
@@ -125,7 +124,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, true, res.Allowed)
res, err = a.Check(context.Background(), ident, authz.CheckRequest{
res, err = a.Check(context.Background(), ident, authlib.CheckRequest{
Verb: "create",
Namespace: "default",
Resource: "dashboards",
pkg/services/accesscontrol/cacheutils_test.go
+1 -1
View File
@@ -6,7 +6,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
pkg/services/accesscontrol/dualwrite/reconciler.go
+2 -1
View File
@@ -6,9 +6,10 @@ import (
"strconv"
"time"
"github.com/grafana/authlib/claims"
"go.opentelemetry.io/otel"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/serverlock"
pkg/services/accesscontrol/dualwrite/resource_reconciler.go
+2 -1
View File
@@ -4,9 +4,10 @@ import (
"context"
"fmt"
"github.com/grafana/authlib/claims"
openfgav1 "github.com/openfga/api/proto/openfga/v1"
claims "github.com/grafana/authlib/types"
authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
"github.com/grafana/grafana/pkg/services/authz/zanzana"
)
pkg/services/accesscontrol/ossaccesscontrol/receivers.go
+1 -1
View File
@@ -3,7 +3,7 @@ package ossaccesscontrol
import (
"context"
"github.com/grafana/authlib/claims"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/apimachinery/identity"