public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Add userLogin filter to the permission search endpoint (#81137)

Browse Source 
* RBAC: Search add user login filter

* Switch to a userService resolving instead

* Remove unused error

* Fallback to use the cache

* account for userID filter

* Account for the error

* snake case

* Add test cases

* Add api tests

* Fix return on error

* Re-order imports
This commit is contained in:
Gabriel MABILLE
2024-01-26 09:43:16 +01:00
committed by GitHub
parent 2e352ba4d6
commit 722b78f3e0
11 changed files with 246 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/api/api.go
+18 -4
View File
@@ -69,17 +69,31 @@ func (api *AccessControlAPI) getUserPermissions(c *contextmodel.ReqContext) resp
return response.JSON(http.StatusOK, ac.GroupScopesByAction(permissions))
}
// GET /api/access-control/users/permissions
// GET /api/access-control/users/permissions/search
func (api *AccessControlAPI) searchUsersPermissions(c *contextmodel.ReqContext) response.Response {
userIDString := c.Query("userId")
userID, err := strconv.ParseInt(userIDString, 10, 64)
if err != nil {
return response.Error(http.StatusBadRequest, "user ID is invalid", err)
}
searchOptions := ac.SearchOptions{
UserLogin: c.Query("userLogin"),
ActionPrefix: c.Query("actionPrefix"),
Action: c.Query("action"),
Scope: c.Query("scope"),
}
searchOptions.UserID = userID
// Validate inputs
if (searchOptions.ActionPrefix != "") == (searchOptions.Action != "") {
return response.JSON(http.StatusBadRequest, "provide one of 'action' or 'actionPrefix'")
if (searchOptions.ActionPrefix != "") && (searchOptions.Action != "") {
return response.JSON(http.StatusBadRequest, "'action' and 'actionPrefix' are mutually exclusive")
}
if (searchOptions.UserLogin != "") && (searchOptions.UserID > 0) {
return response.JSON(http.StatusBadRequest, "'userId' and 'userLogin' are mutually exclusive")
}
if searchOptions.UserID <= 0 && searchOptions.UserLogin == "" &&
searchOptions.ActionPrefix == "" && searchOptions.Action == "" {
return response.JSON(http.StatusBadRequest, "at least one search option must be provided")
}
// Compute metadata
@@ -101,7 +115,7 @@ func (api *AccessControlAPI) searchUserPermissions(c *contextmodel.ReqContext) r
userIDString := web.Params(c.Req)[":userID"]
userID, err := strconv.ParseInt(userIDString, 10, 64)
if err != nil {
response.Error(http.StatusBadRequest, "user ID is invalid", err)
return response.Error(http.StatusBadRequest, "user ID is invalid", err)
}
searchOptions := ac.SearchOptions{