public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into resource-store

Browse Source
This commit is contained in:
Ryan McKinley
2024-06-20 18:07:48 +03:00
parent a115bb6214 27e800768e
commit 83df3bdec8
51 changed files with 502 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/apiserver/auth/authenticator/signedinuser.go
+9 -9
View File
@@ -8,38 +8,38 @@ import (
k8suser "k8s.io/apiserver/pkg/authentication/user"
"k8s.io/klog/v2"
"github.com/grafana/grafana/pkg/infra/appcontext"
"github.com/grafana/grafana/pkg/apimachinery/identity"
)
var _ authenticator.RequestFunc = signedInUserAuthenticator
func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool, error) {
ctx := req.Context()
signedInUser, err := appcontext.User(ctx)
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
klog.V(5).Info("failed to get signed in user", "err", err)
return nil, false, nil
}
userInfo := &k8suser.DefaultInfo{
Name: signedInUser.Login,
UID: signedInUser.UserUID,
Name: signedInUser.GetLogin(),
UID: signedInUser.GetUID().ID(),
Groups: []string{},
// In order to faithfully round-trip through an impersonation flow, Extra keys MUST be lowercase.
// see: https://pkg.go.dev/k8s.io/apiserver@v0.27.1/pkg/authentication/user#Info
Extra: map[string][]string{},
}
for _, v := range signedInUser.Teams {
for _, v := range signedInUser.GetTeams() {
userInfo.Groups = append(userInfo.Groups, strconv.FormatInt(v, 10))
}
//
if signedInUser.IDToken != "" {
userInfo.Extra["id-token"] = []string{signedInUser.IDToken}
if signedInUser.GetIDToken() != "" {
userInfo.Extra["id-token"] = []string{signedInUser.GetIDToken()}
}
if signedInUser.OrgRole.IsValid() {
userInfo.Extra["user-instance-role"] = []string{string(signedInUser.OrgRole)}
if signedInUser.GetOrgRole().IsValid() {
userInfo.Extra["user-instance-role"] = []string{string(signedInUser.GetOrgRole())}
}
return &authenticator.Response{
pkg/services/apiserver/auth/authorizer/org_id.go
+9 -5
View File
@@ -6,7 +6,7 @@ import (
"k8s.io/apiserver/pkg/authorization/authorizer"
"github.com/grafana/grafana/pkg/infra/appcontext"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
grafanarequest "github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
"github.com/grafana/grafana/pkg/services/org"
@@ -27,7 +27,7 @@ func newOrgIDAuthorizer(orgService org.Service) *orgIDAuthorizer {
}
func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := appcontext.User(ctx)
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
}
@@ -51,12 +51,16 @@ func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attribut
}
// Quick check that the same org is used
if signedInUser.OrgID == info.OrgID {
if signedInUser.GetOrgID() == info.OrgID {
return authorizer.DecisionNoOpinion, "", nil
}
// Check if the user has access to the specified org
query := org.GetUserOrgListQuery{UserID: signedInUser.UserID}
userId, err := signedInUser.GetID().UserID()
if err != nil {
return authorizer.DecisionDeny, "unable to get userId", err
}
query := org.GetUserOrgListQuery{UserID: userId}
result, err := auth.org.GetUserOrgList(ctx, &query)
if err != nil {
return authorizer.DecisionDeny, "error getting user org list", err
@@ -68,5 +72,5 @@ func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attribut
}
}
return authorizer.DecisionDeny, fmt.Sprintf("user %d is not a member of org %d", signedInUser.UserID, info.OrgID), nil
return authorizer.DecisionDeny, fmt.Sprintf("user %d is not a member of org %d", userId, info.OrgID), nil
}
pkg/services/apiserver/auth/authorizer/org_role.go
+9 -8
View File
@@ -6,7 +6,7 @@ import (
"k8s.io/apiserver/pkg/authorization/authorizer"
"github.com/grafana/grafana/pkg/infra/appcontext"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
)
@@ -22,12 +22,13 @@ func newOrgRoleAuthorizer(orgService org.Service) *orgRoleAuthorizer {
}
func (auth orgRoleAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := appcontext.User(ctx)
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
}
switch signedInUser.OrgRole {
orgRole := signedInUser.GetOrgRole()
switch orgRole {
case org.RoleAdmin:
return authorizer.DecisionAllow, "", nil
case org.RoleEditor:
@@ -35,21 +36,21 @@ func (auth orgRoleAuthorizer) Authorize(ctx context.Context, a authorizer.Attrib
case "get", "list", "watch", "create", "update", "patch", "delete", "put", "post":
return authorizer.DecisionAllow, "", nil
default:
return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(string(signedInUser.OrgRole), a), nil
return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil
}
case org.RoleViewer:
switch a.GetVerb() {
case "get", "list", "watch":
return authorizer.DecisionAllow, "", nil
default:
return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(string(signedInUser.OrgRole), a), nil
return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil
}
case org.RoleNone:
return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(string(signedInUser.OrgRole), a), nil
return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil
}
return authorizer.DecisionDeny, "", nil
}
func errorMessageForGrafanaOrgRole(grafanaOrgRole string, a authorizer.Attributes) string {
return fmt.Sprintf("Grafana org role (%s) didn't allow %s access on requested resource=%s, path=%s", grafanaOrgRole, a.GetVerb(), a.GetResource(), a.GetPath())
func errorMessageForGrafanaOrgRole(orgRole identity.RoleType, a authorizer.Attributes) string {
return fmt.Sprintf("Grafana org role (%s) didn't allow %s access on requested resource=%s, path=%s", orgRole, a.GetVerb(), a.GetResource(), a.GetPath())
}
pkg/services/apiserver/auth/authorizer/stack_id.go
+3 -3
View File
@@ -6,7 +6,7 @@ import (
"k8s.io/apiserver/pkg/authorization/authorizer"
"github.com/grafana/grafana/pkg/infra/appcontext"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/log"
grafanarequest "github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
"github.com/grafana/grafana/pkg/setting"
@@ -27,7 +27,7 @@ func newStackIDAuthorizer(cfg *setting.Cfg) *stackIDAuthorizer {
}
func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
signedInUser, err := appcontext.User(ctx)
signedInUser, err := identity.GetRequester(ctx)
if err != nil {
return authorizer.DecisionDeny, fmt.Sprintf("error getting signed in user: %v", err), nil
}
@@ -48,7 +48,7 @@ func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attrib
if info.OrgID != 1 {
return authorizer.DecisionDeny, "cloud instance requires org 1", nil
}
if signedInUser.OrgID != 1 {
if signedInUser.GetOrgID() != 1 {
return authorizer.DecisionDeny, "user must be in org 1", nil
}
pkg/services/apiserver/endpoints/request/namespace.go
+3 -3
View File
@@ -8,7 +8,7 @@ import (
"k8s.io/apiserver/pkg/endpoints/request"
"github.com/grafana/grafana/pkg/infra/appcontext"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/setting"
)
@@ -82,9 +82,9 @@ func ParseNamespace(ns string) (NamespaceInfo, error) {
func OrgIDForList(ctx context.Context) (int64, error) {
ns := request.NamespaceValue(ctx)
if ns == "" {
user, err := appcontext.User(ctx)
user, err := identity.GetRequester(ctx)
if user != nil {
return user.OrgID, err
return user.GetOrgID(), err
}
return -1, err
}
pkg/services/apiserver/service.go
+5
View File
@@ -160,6 +160,11 @@ func ProvideService(
req.URL.Path = "/"
}
if c.SignedInUser != nil {
ctx := appcontext.WithUser(req.Context(), c.SignedInUser)
req = req.WithContext(ctx)
}
resp := responsewriter.WrapForHTTP1Or2(c.Resp)
s.handler.ServeHTTP(resp, req)
}