public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Unfurl OrgID in pkg/api to allow using identity.Requester interface (#76108)

Browse Source 
Unfurl OrgID in pkg/api to allow using identity.Requester interface
This commit is contained in:
Jo
2023-10-06 11:34:36 +02:00
committed by GitHub
parent fb0ac351bc
commit 729dafaff9
21 changed files with 116 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/alerting.go
+17 -17
View File
@@ -38,7 +38,7 @@ func (hs *HTTPServer) ValidateOrgAlert(c *contextmodel.ReqContext) {
return
}
if c.OrgID != res.OrgID {
if c.SignedInUser.GetOrgID() != res.OrgID {
c.JsonApiErr(403, "You are not allowed to edit/view alert", nil)
return
}
@@ -61,7 +61,7 @@ func (hs *HTTPServer) GetAlertStatesForDashboard(c *contextmodel.ReqContext) res
}
query := alertmodels.GetAlertStatesForDashboardQuery{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
DashboardID: c.QueryInt64("dashboardId"),
}
@@ -109,7 +109,7 @@ func (hs *HTTPServer) GetAlerts(c *contextmodel.ReqContext) response.Response {
Tags: dashboardTags,
SignedInUser: c.SignedInUser,
Limit: 1000,
OrgId: c.OrgID,
OrgId: c.SignedInUser.GetOrgID(),
DashboardIds: dashboardIDs,
Type: string(model.DashHitDB),
FolderIds: folderIDs,
@@ -134,7 +134,7 @@ func (hs *HTTPServer) GetAlerts(c *contextmodel.ReqContext) response.Response {
}
query := alertmodels.GetAlertsQuery{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
DashboardIDs: dashboardIDs,
PanelID: c.QueryInt64("panelId"),
Limit: c.QueryInt64("limit"),
@@ -178,7 +178,7 @@ func (hs *HTTPServer) AlertTest(c *contextmodel.ReqContext) response.Response {
return response.Error(400, "The dashboard needs to be saved at least once before you can test an alert rule", nil)
}
res, err := hs.AlertEngine.AlertTest(c.OrgID, dto.Dashboard, dto.PanelId, c.SignedInUser)
res, err := hs.AlertEngine.AlertTest(c.SignedInUser.GetOrgID(), dto.Dashboard, dto.PanelId, c.SignedInUser)
if err != nil {
var validationErr alerting.ValidationError
if errors.As(err, &validationErr) {
@@ -302,7 +302,7 @@ func (hs *HTTPServer) GetAlertNotifications(c *contextmodel.ReqContext) response
}
func (hs *HTTPServer) getAlertNotificationsInternal(c *contextmodel.ReqContext) ([]*alertmodels.AlertNotification, error) {
query := &alertmodels.GetAllAlertNotificationsQuery{OrgID: c.OrgID}
query := &alertmodels.GetAllAlertNotificationsQuery{OrgID: c.SignedInUser.GetOrgID()}
return hs.AlertNotificationService.GetAllAlertNotifications(c.Req.Context(), query)
}
@@ -324,7 +324,7 @@ func (hs *HTTPServer) GetAlertNotificationByID(c *contextmodel.ReqContext) respo
return response.Error(http.StatusBadRequest, "notificationId is invalid", err)
}
query := &alertmodels.GetAlertNotificationsQuery{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
ID: notificationId,
}
@@ -358,7 +358,7 @@ func (hs *HTTPServer) GetAlertNotificationByID(c *contextmodel.ReqContext) respo
// 500: internalServerError
func (hs *HTTPServer) GetAlertNotificationByUID(c *contextmodel.ReqContext) response.Response {
query := &alertmodels.GetAlertNotificationsWithUidQuery{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
UID: web.Params(c.Req)[":uid"],
}
@@ -395,7 +395,7 @@ func (hs *HTTPServer) CreateAlertNotification(c *contextmodel.ReqContext) respon
if err := web.Bind(c.Req, &cmd); err != nil {
return response.Error(http.StatusBadRequest, "bad request data", err)
}
cmd.OrgID = c.OrgID
cmd.OrgID = c.SignedInUser.GetOrgID()
res, err := hs.AlertNotificationService.CreateAlertNotificationCommand(c.Req.Context(), &cmd)
if err != nil {
@@ -429,7 +429,7 @@ func (hs *HTTPServer) UpdateAlertNotification(c *contextmodel.ReqContext) respon
if err := web.Bind(c.Req, &cmd); err != nil {
return response.Error(http.StatusBadRequest, "bad request data", err)
}
cmd.OrgID = c.OrgID
cmd.OrgID = c.SignedInUser.GetOrgID()
err := hs.fillWithSecureSettingsData(c.Req.Context(), &cmd)
if err != nil {
@@ -448,7 +448,7 @@ func (hs *HTTPServer) UpdateAlertNotification(c *contextmodel.ReqContext) respon
}
query := alertmodels.GetAlertNotificationsQuery{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
ID: cmd.ID,
}
@@ -477,7 +477,7 @@ func (hs *HTTPServer) UpdateAlertNotificationByUID(c *contextmodel.ReqContext) r
if err := web.Bind(c.Req, &cmd); err != nil {
return response.Error(http.StatusBadRequest, "bad request data", err)
}
cmd.OrgID = c.OrgID
cmd.OrgID = c.SignedInUser.GetOrgID()
cmd.UID = web.Params(c.Req)[":uid"]
err := hs.fillWithSecureSettingsDataByUID(c.Req.Context(), &cmd)
@@ -582,7 +582,7 @@ func (hs *HTTPServer) DeleteAlertNotification(c *contextmodel.ReqContext) respon
}
cmd := alertmodels.DeleteAlertNotificationCommand{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
ID: notificationId,
}
@@ -610,7 +610,7 @@ func (hs *HTTPServer) DeleteAlertNotification(c *contextmodel.ReqContext) respon
// 500: internalServerError
func (hs *HTTPServer) DeleteAlertNotificationByUID(c *contextmodel.ReqContext) response.Response {
cmd := alertmodels.DeleteAlertNotificationWithUidCommand{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
UID: web.Params(c.Req)[":uid"],
}
@@ -646,7 +646,7 @@ func (hs *HTTPServer) NotificationTest(c *contextmodel.ReqContext) response.Resp
return response.Error(http.StatusBadRequest, "bad request data", err)
}
cmd := &alerting.NotificationTestCommand{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
ID: dto.ID,
Name: dto.Name,
Type: dto.Type,
@@ -704,7 +704,7 @@ func (hs *HTTPServer) PauseAlert(legacyAlertingEnabled *bool) func(c *contextmod
return response.Error(500, "Get Alert failed", err)
}
guardian, err := guardian.New(c.Req.Context(), res.DashboardID, c.OrgID, c.SignedInUser)
guardian, err := guardian.New(c.Req.Context(), res.DashboardID, c.SignedInUser.GetOrgID(), c.SignedInUser)
if err != nil {
return response.ErrOrFallback(http.StatusInternalServerError, "Error while creating permission guardian", err)
}
@@ -728,7 +728,7 @@ func (hs *HTTPServer) PauseAlert(legacyAlertingEnabled *bool) func(c *contextmod
}
cmd := alertmodels.PauseAlertCommand{
OrgID: c.OrgID,
OrgID: c.SignedInUser.GetOrgID(),
AlertIDs: []int64{alertID},
Paused: dto.Paused,
}