public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Authlib: Use types package rather than claims (#99243)

Browse Source
This commit is contained in:
Ryan McKinley
2025-01-21 12:06:55 +03:00
committed by GitHub
parent b2d0359e72
commit 680e6bc1f8
149 changed files with 394 additions and 376 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/storage/unified/resource/access.go
+13 -31
View File
@@ -7,34 +7,16 @@ import (
"sync"
"time"
"github.com/grafana/authlib/authz"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/authn/grpcutils"
"github.com/prometheus/client_golang/prometheus"
"go.opentelemetry.io/otel/attribute"
"go.opentelemetry.io/otel/trace"
"go.opentelemetry.io/otel/trace/noop"
claims "github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/services/authn/grpcutils"
)
type staticAuthzClient struct {
allowed bool
}
// Check implements authz.AccessClient.
func (c *staticAuthzClient) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
return authz.CheckResponse{Allowed: c.allowed}, nil
}
// Compile implements authz.AccessClient.
func (c *staticAuthzClient) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
return func(namespace string, name, folder string) bool {
return c.allowed
}, nil
}
var _ authz.AccessClient = &staticAuthzClient{}
type groupResource map[string]map[string]interface{}
const (
@@ -91,7 +73,7 @@ func newMetrics(reg prometheus.Registerer) *accessMetrics {
// The authz service will be responsible for enforcing RBAC.
// For now, it makes one call to the authz service for each list items. This is known to be inefficient.
type authzLimitedClient struct {
client authz.AccessClient
client claims.AccessClient
// allowlist is a map of group to resources that are compatible with RBAC.
allowlist groupResource
logger *slog.Logger
@@ -105,7 +87,7 @@ type AuthzOptions struct {
}
// NewAuthzLimitedClient creates a new authzLimitedClient.
func NewAuthzLimitedClient(client authz.AccessClient, opts AuthzOptions) authz.AccessClient {
func NewAuthzLimitedClient(client claims.AccessClient, opts AuthzOptions) claims.AccessClient {
logger := slog.Default().With("logger", "limited-authz-client")
if opts.Tracer == nil {
opts.Tracer = noop.NewTracerProvider().Tracer("limited-authz-client")
@@ -125,8 +107,8 @@ func NewAuthzLimitedClient(client authz.AccessClient, opts AuthzOptions) authz.A
}
}
// Check implements authz.AccessClient.
func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
// Check implements claims.AccessClient.
func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
t := time.Now()
ctx, span := c.tracer.Start(ctx, "authzLimitedClient.Check", trace.WithAttributes(
attribute.String("group", req.Group),
@@ -140,11 +122,11 @@ func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req a
defer span.End()
if grpcutils.FallbackUsed(ctx) {
span.SetAttributes(attribute.Bool("allowed", true))
return authz.CheckResponse{Allowed: true}, nil
return claims.CheckResponse{Allowed: true}, nil
}
if !c.IsCompatibleWithRBAC(req.Group, req.Resource) {
span.SetAttributes(attribute.Bool("allowed", true))
return authz.CheckResponse{Allowed: true}, nil
return claims.CheckResponse{Allowed: true}, nil
}
resp, err := c.client.Check(ctx, id, req)
if err != nil {
@@ -158,8 +140,8 @@ func (c authzLimitedClient) Check(ctx context.Context, id claims.AuthInfo, req a
return resp, nil
}
// Compile implements authz.AccessClient.
func (c authzLimitedClient) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
// Compile implements claims.AccessClient.
func (c authzLimitedClient) Compile(ctx context.Context, id claims.AuthInfo, req claims.ListRequest) (claims.ItemChecker, error) {
t := time.Now()
fallbackUsed := grpcutils.FallbackUsed(ctx)
ctx, span := c.tracer.Start(ctx, "authzLimitedClient.Compile", trace.WithAttributes(
@@ -195,4 +177,4 @@ func (c authzLimitedClient) IsCompatibleWithRBAC(group, resource string) bool {
return false
}
var _ authz.AccessClient = &authzLimitedClient{}
var _ claims.AccessClient = &authzLimitedClient{}