public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Chore: Remove dashboard ACL from models (#61749)

Browse Source 
* Remove dashboard ACL from models

* Remove unused comment
This commit is contained in:
idafurjes
2023-01-20 14:58:47 +01:00
committed by GitHub
parent c106c7700b
commit 68445a7c77
34 changed files with 452 additions and 451 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/dashboards/dashboard.go
+4 -4
View File
@@ -16,7 +16,7 @@ type DashboardService interface {
DeleteDashboard(ctx context.Context, dashboardId int64, orgId int64) error
FindDashboards(ctx context.Context, query *models.FindPersistedDashboardsQuery) ([]DashboardSearchProjection, error)
GetDashboard(ctx context.Context, query *GetDashboardQuery) error
GetDashboardACLInfoList(ctx context.Context, query *models.GetDashboardACLInfoListQuery) error
GetDashboardACLInfoList(ctx context.Context, query *GetDashboardACLInfoListQuery) error
GetDashboards(ctx context.Context, query *GetDashboardsQuery) error
GetDashboardTags(ctx context.Context, query *GetDashboardTagsQuery) error
GetDashboardUIDByID(ctx context.Context, query *GetDashboardRefByIDQuery) error
@@ -26,7 +26,7 @@ type DashboardService interface {
MakeUserAdmin(ctx context.Context, orgID int64, userID, dashboardID int64, setViewAndEditPermissions bool) error
SaveDashboard(ctx context.Context, dto *SaveDashboardDTO, allowUiUpdate bool) (*Dashboard, error)
SearchDashboards(ctx context.Context, query *models.FindPersistedDashboardsQuery) error
UpdateDashboardACL(ctx context.Context, uid int64, items []*models.DashboardACL) error
UpdateDashboardACL(ctx context.Context, uid int64, items []*DashboardACL) error
DeleteACLByUser(ctx context.Context, userID int64) error
CountDashboardsInFolder(ctx context.Context, query *CountDashboardsInFolderQuery) (int64, error)
}
@@ -58,7 +58,7 @@ type Store interface {
DeleteOrphanedProvisionedDashboards(ctx context.Context, cmd *DeleteOrphanedProvisionedDashboardsCommand) error
FindDashboards(ctx context.Context, query *models.FindPersistedDashboardsQuery) ([]DashboardSearchProjection, error)
GetDashboard(ctx context.Context, query *GetDashboardQuery) (*Dashboard, error)
GetDashboardACLInfoList(ctx context.Context, query *models.GetDashboardACLInfoListQuery) error
GetDashboardACLInfoList(ctx context.Context, query *GetDashboardACLInfoListQuery) error
GetDashboardUIDByID(ctx context.Context, query *GetDashboardRefByIDQuery) error
GetDashboards(ctx context.Context, query *GetDashboardsQuery) error
// GetDashboardsByPluginID retrieves dashboards identified by plugin.
@@ -74,7 +74,7 @@ type Store interface {
SaveDashboard(ctx context.Context, cmd SaveDashboardCommand) (*Dashboard, error)
SaveProvisionedDashboard(ctx context.Context, cmd SaveDashboardCommand, provisioning *DashboardProvisioning) (*Dashboard, error)
UnprovisionDashboard(ctx context.Context, id int64) error
UpdateDashboardACL(ctx context.Context, uid int64, items []*models.DashboardACL) error
UpdateDashboardACL(ctx context.Context, uid int64, items []*DashboardACL) error
// ValidateDashboardBeforeSave validates a dashboard before save.
ValidateDashboardBeforeSave(ctx context.Context, dashboard *Dashboard, overwrite bool) (bool, error)
DeleteACLByUser(context.Context, int64) error
pkg/services/dashboards/dashboard_service_mock.go
+4 -4
View File
@@ -124,11 +124,11 @@ func (_m *FakeDashboardService) GetDashboard(ctx context.Context, query *GetDash
}
// GetDashboardACLInfoList provides a mock function with given fields: ctx, query
func (_m *FakeDashboardService) GetDashboardACLInfoList(ctx context.Context, query *models.GetDashboardACLInfoListQuery) error {
func (_m *FakeDashboardService) GetDashboardACLInfoList(ctx context.Context, query *GetDashboardACLInfoListQuery) error {
ret := _m.Called(ctx, query)
var r0 error
if rf, ok := ret.Get(0).(func(context.Context, *models.GetDashboardACLInfoListQuery) error); ok {
if rf, ok := ret.Get(0).(func(context.Context, *GetDashboardACLInfoListQuery) error); ok {
r0 = rf(ctx, query)
} else {
r0 = ret.Error(0)
@@ -282,11 +282,11 @@ func (_m *FakeDashboardService) SearchDashboards(ctx context.Context, query *mod
}
// UpdateDashboardACL provides a mock function with given fields: ctx, uid, items
func (_m *FakeDashboardService) UpdateDashboardACL(ctx context.Context, uid int64, items []*models.DashboardACL) error {
func (_m *FakeDashboardService) UpdateDashboardACL(ctx context.Context, uid int64, items []*DashboardACL) error {
ret := _m.Called(ctx, uid, items)
var r0 error
if rf, ok := ret.Get(0).(func(context.Context, int64, []*models.DashboardACL) error); ok {
if rf, ok := ret.Get(0).(func(context.Context, int64, []*DashboardACL) error); ok {
r0 = rf(ctx, uid, items)
} else {
r0 = ret.Error(0)
pkg/services/dashboards/database/acl.go
+3 -2
View File
@@ -5,6 +5,7 @@ import (
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/org"
)
@@ -13,9 +14,9 @@ import (
// 1) Permissions for the dashboard
// 2) permissions for its parent folder
// 3) if no specific permissions have been set for the dashboard or its parent folder then get the default permissions
func (d *DashboardStore) GetDashboardACLInfoList(ctx context.Context, query *models.GetDashboardACLInfoListQuery) error {
func (d *DashboardStore) GetDashboardACLInfoList(ctx context.Context, query *dashboards.GetDashboardACLInfoListQuery) error {
outerErr := d.store.WithDbSession(ctx, func(dbSession *db.Session) error {
query.Result = make([]*models.DashboardACLInfoDTO, 0)
query.Result = make([]*dashboards.DashboardACLInfoDTO, 0)
falseStr := d.store.GetDialect().BooleanStr(false)
if query.DashboardID == 0 {
pkg/services/dashboards/database/acl_test.go
+36 -36
View File
@@ -42,7 +42,7 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
t.Run("Dashboard permission with userId and teamId set to 0", func(t *testing.T) {
setup(t)
err := updateDashboardACL(t, dashboardStore, savedFolder.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, savedFolder.ID, dashboards.DashboardACL{
OrgID: 1,
DashboardID: savedFolder.ID,
Permission: models.PERMISSION_EDIT,
@@ -52,34 +52,34 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
t.Run("Folder acl should include default acl", func(t *testing.T) {
setup(t)
query := models.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
query := dashboards.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
err := dashboardStore.GetDashboardACLInfoList(context.Background(), &query)
require.Nil(t, err)
require.Equal(t, 2, len(query.Result))
defaultPermissionsId := int64(-1)
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardID)
require.Equal(t, org.RoleViewer, *query.Result[0].Role)
require.False(t, query.Result[0].Inherited)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardID)
require.Equal(t, org.RoleEditor, *query.Result[1].Role)
require.False(t, query.Result[1].Inherited)
})
t.Run("Dashboard acl should include acl for parent folder", func(t *testing.T) {
setup(t)
query := models.GetDashboardACLInfoListQuery{DashboardID: childDash.ID, OrgID: 1}
query := dashboards.GetDashboardACLInfoListQuery{DashboardID: childDash.ID, OrgID: 1}
err := dashboardStore.GetDashboardACLInfoList(context.Background(), &query)
require.Nil(t, err)
require.Equal(t, 2, len(query.Result))
defaultPermissionsId := int64(-1)
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardID)
require.Equal(t, org.RoleViewer, *query.Result[0].Role)
require.True(t, query.Result[0].Inherited)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardID)
require.Equal(t, org.RoleEditor, *query.Result[1].Role)
require.True(t, query.Result[1].Inherited)
})
@@ -89,7 +89,7 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
err := dashboardStore.UpdateDashboardACL(context.Background(), savedFolder.ID, nil)
require.Nil(t, err)
query := models.GetDashboardACLInfoListQuery{DashboardID: childDash.ID, OrgID: 1}
query := dashboards.GetDashboardACLInfoListQuery{DashboardID: childDash.ID, OrgID: 1}
err = dashboardStore.GetDashboardACLInfoList(context.Background(), &query)
require.Nil(t, err)
@@ -99,7 +99,7 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
t.Run("Given a dashboard folder and a user", func(t *testing.T) {
t.Run("Given dashboard folder permission", func(t *testing.T) {
setup(t)
err := updateDashboardACL(t, dashboardStore, savedFolder.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, savedFolder.ID, dashboards.DashboardACL{
OrgID: 1,
UserID: currentUser.ID,
DashboardID: savedFolder.ID,
@@ -108,17 +108,17 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
require.Nil(t, err)
t.Run("When reading dashboard acl should include acl for parent folder", func(t *testing.T) {
query := models.GetDashboardACLInfoListQuery{DashboardID: childDash.ID, OrgID: 1}
query := dashboards.GetDashboardACLInfoListQuery{DashboardID: childDash.ID, OrgID: 1}
err := dashboardStore.GetDashboardACLInfoList(context.Background(), &query)
require.Nil(t, err)
require.Equal(t, 1, len(query.Result))
require.Equal(t, savedFolder.ID, query.Result[0].DashboardId)
require.Equal(t, savedFolder.ID, query.Result[0].DashboardID)
})
t.Run("Given child dashboard permission", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, childDash.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, childDash.ID, dashboards.DashboardACL{
OrgID: 1,
UserID: currentUser.ID,
DashboardID: childDash.ID,
@@ -127,15 +127,15 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
require.Nil(t, err)
t.Run("When reading dashboard acl should include acl for parent folder and child", func(t *testing.T) {
query := models.GetDashboardACLInfoListQuery{OrgID: 1, DashboardID: childDash.ID}
query := dashboards.GetDashboardACLInfoListQuery{OrgID: 1, DashboardID: childDash.ID}
err := dashboardStore.GetDashboardACLInfoList(context.Background(), &query)
require.Nil(t, err)
require.Equal(t, 2, len(query.Result))
require.Equal(t, savedFolder.ID, query.Result[0].DashboardId)
require.Equal(t, savedFolder.ID, query.Result[0].DashboardID)
require.True(t, query.Result[0].Inherited)
require.Equal(t, childDash.ID, query.Result[1].DashboardId)
require.Equal(t, childDash.ID, query.Result[1].DashboardID)
require.False(t, query.Result[1].Inherited)
})
})
@@ -143,7 +143,7 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
t.Run("Reading dashboard acl should include default acl for parent folder and the child acl", func(t *testing.T) {
setup(t)
err := updateDashboardACL(t, dashboardStore, childDash.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, childDash.ID, dashboards.DashboardACL{
OrgID: 1,
UserID: currentUser.ID,
DashboardID: childDash.ID,
@@ -151,26 +151,26 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
})
require.Nil(t, err)
query := models.GetDashboardACLInfoListQuery{OrgID: 1, DashboardID: childDash.ID}
query := dashboards.GetDashboardACLInfoListQuery{OrgID: 1, DashboardID: childDash.ID}
err = dashboardStore.GetDashboardACLInfoList(context.Background(), &query)
require.Nil(t, err)
defaultPermissionsId := int64(-1)
require.Equal(t, 3, len(query.Result))
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardID)
require.Equal(t, org.RoleViewer, *query.Result[0].Role)
require.True(t, query.Result[0].Inherited)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardID)
require.Equal(t, org.RoleEditor, *query.Result[1].Role)
require.True(t, query.Result[1].Inherited)
require.Equal(t, childDash.ID, query.Result[2].DashboardId)
require.Equal(t, childDash.ID, query.Result[2].DashboardID)
require.False(t, query.Result[2].Inherited)
})
t.Run("Add and delete dashboard permission", func(t *testing.T) {
setup(t)
err := updateDashboardACL(t, dashboardStore, savedFolder.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, savedFolder.ID, dashboards.DashboardACL{
OrgID: 1,
UserID: currentUser.ID,
DashboardID: savedFolder.ID,
@@ -178,21 +178,21 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
})
require.Nil(t, err)
q1 := &models.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
q1 := &dashboards.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
err = dashboardStore.GetDashboardACLInfoList(context.Background(), q1)
require.Nil(t, err)
require.Equal(t, savedFolder.ID, q1.Result[0].DashboardId)
require.Equal(t, savedFolder.ID, q1.Result[0].DashboardID)
require.Equal(t, models.PERMISSION_EDIT, q1.Result[0].Permission)
require.Equal(t, "Edit", q1.Result[0].PermissionName)
require.Equal(t, currentUser.ID, q1.Result[0].UserId)
require.Equal(t, currentUser.ID, q1.Result[0].UserID)
require.Equal(t, currentUser.Login, q1.Result[0].UserLogin)
require.Equal(t, currentUser.Email, q1.Result[0].UserEmail)
err = updateDashboardACL(t, dashboardStore, savedFolder.ID)
require.Nil(t, err)
q3 := &models.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
q3 := &dashboards.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
err = dashboardStore.GetDashboardACLInfoList(context.Background(), q3)
require.Nil(t, err)
require.Equal(t, 0, len(q3.Result))
@@ -204,7 +204,7 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
team1, err := teamSvc.CreateTeam("group1 name", "", 1)
require.Nil(t, err)
err = updateDashboardACL(t, dashboardStore, savedFolder.ID, models.DashboardACL{
err = updateDashboardACL(t, dashboardStore, savedFolder.ID, dashboards.DashboardACL{
OrgID: 1,
TeamID: team1.ID,
DashboardID: savedFolder.ID,
@@ -212,12 +212,12 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
})
require.Nil(t, err)
q1 := &models.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
q1 := &dashboards.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
err = dashboardStore.GetDashboardACLInfoList(context.Background(), q1)
require.Nil(t, err)
require.Equal(t, savedFolder.ID, q1.Result[0].DashboardId)
require.Equal(t, savedFolder.ID, q1.Result[0].DashboardID)
require.Equal(t, models.PERMISSION_EDIT, q1.Result[0].Permission)
require.Equal(t, team1.ID, q1.Result[0].TeamId)
require.Equal(t, team1.ID, q1.Result[0].TeamID)
})
t.Run("Should be able to update an existing permission for a team", func(t *testing.T) {
@@ -225,7 +225,7 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
teamSvc := teamimpl.ProvideService(sqlStore, sqlStore.Cfg)
team1, err := teamSvc.CreateTeam("group1 name", "", 1)
require.Nil(t, err)
err = updateDashboardACL(t, dashboardStore, savedFolder.ID, models.DashboardACL{
err = updateDashboardACL(t, dashboardStore, savedFolder.ID, dashboards.DashboardACL{
OrgID: 1,
TeamID: team1.ID,
DashboardID: savedFolder.ID,
@@ -233,13 +233,13 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
})
require.Nil(t, err)
q3 := &models.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
q3 := &dashboards.GetDashboardACLInfoListQuery{DashboardID: savedFolder.ID, OrgID: 1}
err = dashboardStore.GetDashboardACLInfoList(context.Background(), q3)
require.Nil(t, err)
require.Equal(t, 1, len(q3.Result))
require.Equal(t, savedFolder.ID, q3.Result[0].DashboardId)
require.Equal(t, savedFolder.ID, q3.Result[0].DashboardID)
require.Equal(t, models.PERMISSION_ADMIN, q3.Result[0].Permission)
require.Equal(t, team1.ID, q3.Result[0].TeamId)
require.Equal(t, team1.ID, q3.Result[0].TeamID)
})
})
@@ -248,17 +248,17 @@ func TestIntegrationDashboardACLDataAccess(t *testing.T) {
var rootFolderId int64 = 0
//sqlStore := db.InitTestDB(t)
query := models.GetDashboardACLInfoListQuery{DashboardID: rootFolderId, OrgID: 1}
query := dashboards.GetDashboardACLInfoListQuery{DashboardID: rootFolderId, OrgID: 1}
err := dashboardStore.GetDashboardACLInfoList(context.Background(), &query)
require.Nil(t, err)
require.Equal(t, 2, len(query.Result))
defaultPermissionsId := int64(-1)
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[0].DashboardID)
require.Equal(t, org.RoleViewer, *query.Result[0].Role)
require.False(t, query.Result[0].Inherited)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardId)
require.Equal(t, defaultPermissionsId, query.Result[1].DashboardID)
require.Equal(t, org.RoleEditor, *query.Result[1].Role)
require.False(t, query.Result[1].Inherited)
})
pkg/services/dashboards/database/database.go
+1 -1
View File
@@ -227,7 +227,7 @@ func (d *DashboardStore) SaveDashboard(ctx context.Context, cmd dashboards.SaveD
return cmd.Result, err
}
func (d *DashboardStore) UpdateDashboardACL(ctx context.Context, dashboardID int64, items []*models.DashboardACL) error {
func (d *DashboardStore) UpdateDashboardACL(ctx context.Context, dashboardID int64, items []*dashboards.DashboardACL) error {
return d.store.WithTransactionalDbSession(ctx, func(sess *db.Session) error {
// delete existing items
_, err := sess.Exec("DELETE FROM dashboard_acl WHERE dashboard_id=?", dashboardID)
pkg/services/dashboards/database/database_folder_test.go
+10 -10
View File
@@ -65,7 +65,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
t.Run("and acl is set for dashboard folder", func(t *testing.T) {
var otherUser int64 = 999
err := updateDashboardACL(t, dashboardStore, folder.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, folder.ID, dashboards.DashboardACL{
DashboardID: folder.ID,
OrgID: 1,
UserID: otherUser,
@@ -86,7 +86,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
})
t.Run("when the user is given permission", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, folder.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, folder.ID, dashboards.DashboardACL{
DashboardID: folder.ID, OrgID: 1, UserID: currentUser.ID, Permission: models.PERMISSION_EDIT,
})
require.NoError(t, err)
@@ -129,7 +129,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
var otherUser int64 = 999
err := updateDashboardACL(t, dashboardStore, folder.ID)
require.NoError(t, err)
err = updateDashboardACL(t, dashboardStore, childDash.ID, models.DashboardACL{
err = updateDashboardACL(t, dashboardStore, childDash.ID, dashboards.DashboardACL{
DashboardID: folder.ID, OrgID: 1, UserID: otherUser, Permission: models.PERMISSION_EDIT,
})
require.NoError(t, err)
@@ -145,7 +145,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
})
t.Run("when the user is given permission to child", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, childDash.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, childDash.ID, dashboards.DashboardACL{
DashboardID: childDash.ID, OrgID: 1, UserID: currentUser.ID, Permission: models.PERMISSION_EDIT,
})
require.NoError(t, err)
@@ -224,7 +224,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
t.Run("and acl is set for one dashboard folder", func(t *testing.T) {
const otherUser int64 = 999
err := updateDashboardACL(t, dashboardStore, folder1.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, folder1.ID, dashboards.DashboardACL{
DashboardID: folder1.ID, OrgID: 1, UserID: otherUser, Permission: models.PERMISSION_EDIT,
})
require.NoError(t, err)
@@ -265,7 +265,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
})
t.Run("and a dashboard with an acl is moved to the folder without an acl", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, childDash1.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, childDash1.ID, dashboards.DashboardACL{
DashboardID: childDash1.ID, OrgID: 1, UserID: otherUser, Permission: models.PERMISSION_EDIT,
})
require.NoError(t, err)
@@ -363,7 +363,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
})
t.Run("Should have write access to one dashboard folder if default role changed to view for one folder", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, folder1.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, folder1.ID, dashboards.DashboardACL{
DashboardID: folder1.ID, OrgID: 1, UserID: editorUser.ID, Permission: models.PERMISSION_VIEW,
})
require.NoError(t, err)
@@ -409,7 +409,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
})
t.Run("Should be able to get one dashboard folder if default role changed to edit for one folder", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, folder1.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, folder1.ID, dashboards.DashboardACL{
DashboardID: folder1.ID, OrgID: 1, UserID: viewerUser.ID, Permission: models.PERMISSION_EDIT,
})
require.NoError(t, err)
@@ -442,7 +442,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
})
t.Run("and admin permission is given for user with org role viewer in one dashboard folder", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, folder1.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, folder1.ID, dashboards.DashboardACL{
DashboardID: folder1.ID, OrgID: 1, UserID: viewerUser.ID, Permission: models.PERMISSION_ADMIN,
})
require.NoError(t, err)
@@ -458,7 +458,7 @@ func TestIntegrationDashboardFolderDataAccess(t *testing.T) {
})
t.Run("and edit permission is given for user with org role viewer in one dashboard folder", func(t *testing.T) {
err := updateDashboardACL(t, dashboardStore, folder1.ID, models.DashboardACL{
err := updateDashboardACL(t, dashboardStore, folder1.ID, dashboards.DashboardACL{
DashboardID: folder1.ID, OrgID: 1, UserID: viewerUser.ID, Permission: models.PERMISSION_EDIT,
})
require.NoError(t, err)
pkg/services/dashboards/database/database_test.go
+2 -2
View File
@@ -824,10 +824,10 @@ func insertTestDashboardForPlugin(t *testing.T, dashboardStore *DashboardStore,
}
func updateDashboardACL(t *testing.T, dashboardStore *DashboardStore, dashboardID int64,
items ...models.DashboardACL) error {
items ...dashboards.DashboardACL) error {
t.Helper()
var itemPtrs []*models.DashboardACL
var itemPtrs []*dashboards.DashboardACL
for _, it := range items {
item := it
item.Created = time.Now()
pkg/services/dashboards/models.go
+77
View File
@@ -8,6 +8,7 @@ import (
"github.com/grafana/grafana/pkg/infra/slugify"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/folder"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/quota"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/setting"
@@ -343,3 +344,79 @@ func FromDashboard(dash *Dashboard) *folder.Folder {
UpdatedBy: dash.UpdatedBy,
}
}
//
// DASHBOARD ACL
//
// Dashboard ACL model
type DashboardACL struct {
ID int64 `xorm:"pk autoincr 'id'"`
OrgID int64 `xorm:"org_id"`
DashboardID int64 `xorm:"dashboard_id"`
UserID int64 `xorm:"user_id"`
TeamID int64 `xorm:"team_id"`
Role *org.RoleType // pointer to be nullable
Permission models.PermissionType
Created time.Time
Updated time.Time
}
func (p DashboardACL) TableName() string { return "dashboard_acl" }
type DashboardACLInfoDTO struct {
OrgID int64 `json:"-" xorm:"org_id"`
DashboardID int64 `json:"dashboardId,omitempty" xorm:"dashboard_id"`
FolderID int64 `json:"folderId,omitempty" xorm:"folder_id"`
Created time.Time `json:"created"`
Updated time.Time `json:"updated"`
UserID int64 `json:"userId" xorm:"user_id"`
UserLogin string `json:"userLogin"`
UserEmail string `json:"userEmail"`
UserAvatarURL string `json:"userAvatarUrl" xorm:"user_avatar_url"`
TeamID int64 `json:"teamId" xorm:"team_id"`
TeamEmail string `json:"teamEmail"`
TeamAvatarURL string `json:"teamAvatarUrl" xorm:"team_avatar_url"`
Team string `json:"team"`
Role *org.RoleType `json:"role,omitempty"`
Permission models.PermissionType `json:"permission"`
PermissionName string `json:"permissionName"`
UID string `json:"uid" xorm:"uid"`
Title string `json:"title"`
Slug string `json:"slug"`
IsFolder bool `json:"isFolder"`
URL string `json:"url" xorm:"url"`
Inherited bool `json:"inherited"`
}
func (dto *DashboardACLInfoDTO) hasSameRoleAs(other *DashboardACLInfoDTO) bool {
if dto.Role == nil || other.Role == nil {
return false
}
return dto.UserID <= 0 && dto.TeamID <= 0 && dto.UserID == other.UserID && dto.TeamID == other.TeamID && *dto.Role == *other.Role
}
func (dto *DashboardACLInfoDTO) hasSameUserAs(other *DashboardACLInfoDTO) bool {
return dto.UserID > 0 && dto.UserID == other.UserID
}
func (dto *DashboardACLInfoDTO) hasSameTeamAs(other *DashboardACLInfoDTO) bool {
return dto.TeamID > 0 && dto.TeamID == other.TeamID
}
// IsDuplicateOf returns true if other item has same role, same user or same team
func (dto *DashboardACLInfoDTO) IsDuplicateOf(other *DashboardACLInfoDTO) bool {
return dto.hasSameRoleAs(other) || dto.hasSameUserAs(other) || dto.hasSameTeamAs(other)
}
// QUERIES
type GetDashboardACLInfoListQuery struct {
DashboardID int64
OrgID int64
Result []*DashboardACLInfoDTO
}
pkg/services/dashboards/service/dashboard_service.go
+5 -5
View File
@@ -184,7 +184,7 @@ func (dr *DashboardServiceImpl) BuildSaveDashboardCommand(ctx context.Context, d
return cmd, nil
}
func (dr *DashboardServiceImpl) UpdateDashboardACL(ctx context.Context, uid int64, items []*models.DashboardACL) error {
func (dr *DashboardServiceImpl) UpdateDashboardACL(ctx context.Context, uid int64, items []*dashboards.DashboardACL) error {
return dr.dashboardStore.UpdateDashboardACL(ctx, uid, items)
}
@@ -391,7 +391,7 @@ func (dr *DashboardServiceImpl) MakeUserAdmin(ctx context.Context, orgID int64,
rtEditor := org.RoleEditor
rtViewer := org.RoleViewer
items := []*models.DashboardACL{
items := []*dashboards.DashboardACL{
{
OrgID: orgID,
DashboardID: dashboardID,
@@ -404,7 +404,7 @@ func (dr *DashboardServiceImpl) MakeUserAdmin(ctx context.Context, orgID int64,
if setViewAndEditPermissions {
items = append(items,
&models.DashboardACL{
&dashboards.DashboardACL{
OrgID: orgID,
DashboardID: dashboardID,
Role: &rtEditor,
@@ -412,7 +412,7 @@ func (dr *DashboardServiceImpl) MakeUserAdmin(ctx context.Context, orgID int64,
Created: time.Now(),
Updated: time.Now(),
},
&models.DashboardACL{
&dashboards.DashboardACL{
OrgID: orgID,
DashboardID: dashboardID,
Role: &rtViewer,
@@ -598,7 +598,7 @@ func makeQueryResult(query *models.FindPersistedDashboardsQuery, res []dashboard
}
}
func (dr *DashboardServiceImpl) GetDashboardACLInfoList(ctx context.Context, query *models.GetDashboardACLInfoListQuery) error {
func (dr *DashboardServiceImpl) GetDashboardACLInfoList(ctx context.Context, query *dashboards.GetDashboardACLInfoListQuery) error {
return dr.dashboardStore.GetDashboardACLInfoList(ctx, query)
}
pkg/services/dashboards/service/dashboard_service_integration_test.go
+10 -10
View File
@@ -109,7 +109,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
assert.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, "", sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -129,7 +129,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
require.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.otherSavedFolder.ID, sc.dashboardGuardianMock.DashID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -149,7 +149,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
require.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -170,7 +170,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
require.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -191,7 +191,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
assert.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInGeneralFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -212,7 +212,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
require.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -233,7 +233,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
require.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInGeneralFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -254,7 +254,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
assert.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -275,7 +275,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
require.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInGeneralFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
@@ -296,7 +296,7 @@ func TestIntegrationIntegratedDashboardService(t *testing.T) {
require.Equal(t, dashboards.ErrDashboardUpdateAccessDenied, err)
assert.Equal(t, sc.savedDashInFolder.UID, sc.dashboardGuardianMock.DashUID)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgId)
assert.Equal(t, cmd.OrgID, sc.dashboardGuardianMock.OrgID)
assert.Equal(t, cmd.UserID, sc.dashboardGuardianMock.User.UserID)
})
})
pkg/services/dashboards/service/dashboard_service_test.go
+4 -5
View File
@@ -12,7 +12,6 @@ import (
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/infra/appcontext"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/folder"
"github.com/grafana/grafana/pkg/services/guardian"
@@ -261,9 +260,9 @@ func TestDashboardService(t *testing.T) {
t.Run("When org user is deleted", func(t *testing.T) {
fakeStore := dashboards.FakeDashboardStore{}
fakeStore.On("GetDashboardACLInfoList", mock.Anything, mock.AnythingOfType("*models.GetDashboardACLInfoListQuery")).Return(nil)
fakeStore.On("GetDashboardACLInfoList", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardACLInfoListQuery")).Return(nil)
t.Run("Should remove dependent permissions for deleted org user", func(t *testing.T) {
permQuery := &models.GetDashboardACLInfoListQuery{DashboardID: 1, OrgID: 1, Result: nil}
permQuery := &dashboards.GetDashboardACLInfoListQuery{DashboardID: 1, OrgID: 1, Result: nil}
err := fakeStore.GetDashboardACLInfoList(context.Background(), permQuery)
require.NoError(t, err)
@@ -273,8 +272,8 @@ func TestDashboardService(t *testing.T) {
t.Run("Should not remove dashboard permissions for same user in another org", func(t *testing.T) {
fakeStore := dashboards.FakeDashboardStore{}
fakeStore.On("GetDashboardACLInfoList", mock.Anything, mock.AnythingOfType("*models.GetDashboardACLInfoListQuery")).Return(nil)
permQuery := &models.GetDashboardACLInfoListQuery{DashboardID: 2, OrgID: 3}
fakeStore.On("GetDashboardACLInfoList", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardACLInfoListQuery")).Return(nil)
permQuery := &dashboards.GetDashboardACLInfoListQuery{DashboardID: 2, OrgID: 3}
err := fakeStore.GetDashboardACLInfoList(context.Background(), permQuery)
require.NoError(t, err)
pkg/services/dashboards/store_mock.go
+4 -4
View File
@@ -149,11 +149,11 @@ func (_m *FakeDashboardStore) GetDashboard(ctx context.Context, query *GetDashbo
}
// GetDashboardACLInfoList provides a mock function with given fields: ctx, query
func (_m *FakeDashboardStore) GetDashboardACLInfoList(ctx context.Context, query *models.GetDashboardACLInfoListQuery) error {
func (_m *FakeDashboardStore) GetDashboardACLInfoList(ctx context.Context, query *GetDashboardACLInfoListQuery) error {
ret := _m.Called(ctx, query)
var r0 error
if rf, ok := ret.Get(0).(func(context.Context, *models.GetDashboardACLInfoListQuery) error); ok {
if rf, ok := ret.Get(0).(func(context.Context, *GetDashboardACLInfoListQuery) error); ok {
r0 = rf(ctx, query)
} else {
r0 = ret.Error(0)
@@ -390,11 +390,11 @@ func (_m *FakeDashboardStore) UnprovisionDashboard(ctx context.Context, id int64
}
// UpdateDashboardACL provides a mock function with given fields: ctx, uid, items
func (_m *FakeDashboardStore) UpdateDashboardACL(ctx context.Context, uid int64, items []*models.DashboardACL) error {
func (_m *FakeDashboardStore) UpdateDashboardACL(ctx context.Context, uid int64, items []*DashboardACL) error {
ret := _m.Called(ctx, uid, items)
var r0 error
if rf, ok := ret.Get(0).(func(context.Context, int64, []*models.DashboardACL) error); ok {
if rf, ok := ret.Get(0).(func(context.Context, int64, []*DashboardACL) error); ok {
r0 = rf(ctx, uid, items)
} else {
r0 = ret.Error(0)