public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(unified-storage): use contextual logger for permissions (#110455)

Browse Source
This commit is contained in:
Jean-Philippe Quéméner
2025-09-02 15:53:37 +02:00
committed by GitHub
parent 5fb72d1b04
commit 6d5fe47790
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/storage/unified/search/bleve.go
+7 -6
View File
@@ -1617,6 +1617,8 @@ func newPermissionScopedQuery(q query.Query, checkers map[string]authlib.ItemChe
}
func (q *permissionScopedQuery) Searcher(ctx context.Context, i index.IndexReader, m mapping.IndexMapping, options search.SearcherOptions) (search.Searcher, error) {
// Get a new logger from context, to pass traceIDs etc.
logger := q.log.FromContext(ctx)
searcher, err := q.Query.Searcher(ctx, i, m, options)
if err != nil {
return nil, err
@@ -1625,7 +1627,6 @@ func (q *permissionScopedQuery) Searcher(ctx context.Context, i index.IndexReade
if err != nil {
return nil, err
}
filteringSearcher := bleveSearch.NewFilteringSearcher(ctx, searcher, func(d *search.DocumentMatch) bool {
// The doc ID has the format: <namespace>/<group>/<resourceType>/<name>
// IndexInternalID will be the same as the doc ID when using an in-memory index, but when using a file-based
@@ -1633,14 +1634,14 @@ func (q *permissionScopedQuery) Searcher(ctx context.Context, i index.IndexReade
// correct doc ID regardless of the index type.
d.ID, err = i.ExternalID(d.IndexInternalID)
if err != nil {
q.log.Debug("Error getting external ID", "error", err)
logger.Debug("Error getting external ID", "error", err)
return false
}
parts := strings.Split(d.ID, "/")
// Exclude doc if id isn't expected format
if len(parts) != 4 {
q.log.Debug("Unexpected document ID format", "id", d.ID)
logger.Debug("Unexpected document ID format", "id", d.ID)
return false
}
ns := parts[0]
@@ -1653,16 +1654,16 @@ func (q *permissionScopedQuery) Searcher(ctx context.Context, i index.IndexReade
}
})
if err != nil {
q.log.Debug("Error reading doc values", "error", err)
logger.Debug("Error reading doc values", "error", err)
return false
}
if _, ok := q.checkers[resource]; !ok {
q.log.Debug("No resource checker found", "resource", resource)
logger.Debug("No resource checker found", "resource", resource)
return false
}
allowed := q.checkers[resource](name, folder)
if !allowed {
q.log.Debug("Denying access", "ns", ns, "name", name, "folder", folder)
logger.Debug("Denying access", "ns", ns, "name", name, "folder", folder)
}
return allowed
})