public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Move datasource access check to middleware (#50430)

Browse Source 
* Add datasource scopes to auth middleware

* Remove filter call from handlers, permission check is done by auth
middleware
This commit is contained in:
Karl Persson
2022-06-09 13:56:24 +02:00
committed by GitHub
parent 80a030605f
commit 7fad8d6171
2 changed files with 15 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/datasources.go
+3 -18
View File
@@ -92,12 +92,7 @@ func (hs *HTTPServer) GetDataSourceById(c *models.ReqContext) response.Response
return response.Error(500, "Failed to query datasources", err)
}
filtered, err := hs.filterDatasourcesByQueryPermission(c.Req.Context(), c.SignedInUser, []*models.DataSource{query.Result})
if err != nil || len(filtered) != 1 {
return response.Error(404, "Data source not found", err)
}
dto := hs.convertModelToDtos(c.Req.Context(), filtered[0])
dto := hs.convertModelToDtos(c.Req.Context(), query.Result)
// Add accesscontrol metadata
dto.AccessControl = hs.getAccessControlMetadata(c, c.OrgId, datasources.ScopePrefix, dto.UID)
@@ -151,12 +146,7 @@ func (hs *HTTPServer) GetDataSourceByUID(c *models.ReqContext) response.Response
return response.Error(http.StatusInternalServerError, "Failed to query datasource", err)
}
filtered, err := hs.filterDatasourcesByQueryPermission(c.Req.Context(), c.SignedInUser, []*models.DataSource{ds})
if err != nil || len(filtered) != 1 {
return response.Error(404, "Data source not found", err)
}
dto := hs.convertModelToDtos(c.Req.Context(), filtered[0])
dto := hs.convertModelToDtos(c.Req.Context(), ds)
// Add accesscontrol metadata
dto.AccessControl = hs.getAccessControlMetadata(c, c.OrgId, datasources.ScopePrefix, dto.UID)
@@ -397,12 +387,7 @@ func (hs *HTTPServer) GetDataSourceByName(c *models.ReqContext) response.Respons
return response.Error(500, "Failed to query datasources", err)
}
filtered, err := hs.filterDatasourcesByQueryPermission(c.Req.Context(), c.SignedInUser, []*models.DataSource{query.Result})
if err != nil || len(filtered) != 1 {
return response.Error(404, "Data source not found", err)
}
dto := hs.convertModelToDtos(c.Req.Context(), filtered[0])
dto := hs.convertModelToDtos(c.Req.Context(), query.Result)
return response.JSON(http.StatusOK, &dto)
}