public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthZ: Improve getUserPermissions query (INNER JOIN, UNION ALL) (#102441)

Browse Source
This commit is contained in:
Gabriel MABILLE
2025-03-19 16:54:32 +01:00
committed by GitHub
parent 4c59219adb
commit 8767a8f9a1
16 changed files with 93 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/rbac/store/permission_query.sql
+15 -15
View File
@@ -1,21 +1,21 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM {{ .Ident .PermissionTable }} as p
INNER JOIN (
SELECT role_id FROM {{ .Ident .BuiltinRoleTable }} as br WHERE (br.role = {{ .Arg .Query.Role }} AND (br.org_id = {{ .Arg .Query.OrgID }} OR br.org_id = 0))
{{ if .Query.IsServerAdmin }}
OR (br.role = 'Grafana Admin')
{{ end }}
{{ if .Query.UserID }}
UNION ALL
SELECT role_id FROM {{ .Ident .UserRoleTable }} as ur WHERE ur.user_id = {{ .Arg .Query.UserID }} AND (ur.org_id = {{ .Arg .Query.OrgID }} OR ur.org_id = 0)
{{ end }}
{{ if .Query.TeamIDs }}
UNION ALL
SELECT role_id FROM {{ .Ident .TeamRoleTable }} as tr WHERE tr.team_id IN ({{ .ArgList .Query.TeamIDs }}) AND tr.org_id = {{ .Arg .Query.OrgID }}
{{ end }}
) as roles ON p.role_id = roles.role_id
WHERE
{{ if .Query.ActionSets }}
p.action IN ({{ .ArgList .Query.ActionSets }}, {{ .Arg .Query.Action }})
{{ else }}
p.action = {{ .Arg .Query.Action }}
{{ end }}
AND p.role_id IN (
SELECT role_id FROM {{ .Ident .BuiltinRoleTable }} as br WHERE (br.role = {{ .Arg .Query.Role }} AND (br.org_id = {{ .Arg .Query.OrgID }} OR br.org_id = 0))
{{ if .Query.IsServerAdmin }}
OR (br.role = 'Grafana Admin')
{{ end }}
{{ if .Query.UserID }}
UNION
SELECT role_id FROM {{ .Ident .UserRoleTable }} as ur WHERE ur.user_id = {{ .Arg .Query.UserID }} AND (ur.org_id = {{ .Arg .Query.OrgID }} OR ur.org_id = 0)
{{ end }}
{{ if .Query.TeamIDs }}
UNION
SELECT role_id FROM {{ .Ident .TeamRoleTable }} as tr WHERE tr.team_id IN ({{ .ArgList .Query.TeamIDs }}) AND tr.org_id = {{ .Arg .Query.OrgID }}
{{ end }}
)
{{ end }}
pkg/services/authz/rbac/store/testdata/mysql--permission_query-With_action_sets.sql
Vendored
+5 -5
View File
@@ -1,8 +1,8 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
INNER JOIN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action IN ('folders:edit', 'folders:admin', 'folders:create')
AND p.role_id IN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/mysql--permission_query-admin_user.sql
Vendored
+6 -6
View File
@@ -1,9 +1,9 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
INNER JOIN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
OR (br.role = 'Grafana Admin')
UNION ALL
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
OR (br.role = 'Grafana Admin')
UNION
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/mysql--permission_query-anonymous_user.sql
Vendored
+3 -3
View File
@@ -1,6 +1,6 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
INNER JOIN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
)
pkg/services/authz/rbac/store/testdata/mysql--permission_query-user_with_teams.sql
Vendored
+7 -7
View File
@@ -1,10 +1,10 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
INNER JOIN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
UNION ALL
SELECT role_id FROM `grafana`.`team_role` as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
UNION
SELECT role_id FROM `grafana`.`team_role` as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
)
pkg/services/authz/rbac/store/testdata/mysql--permission_query-viewer_user.sql
Vendored
+5 -5
View File
@@ -1,8 +1,8 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM `grafana`.`permission` as p
INNER JOIN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM `grafana`.`builtin_role` as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM `grafana`.`user_role` as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/postgres--permission_query-With_action_sets.sql
Vendored
+5 -5
View File
@@ -1,8 +1,8 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action IN ('folders:edit', 'folders:admin', 'folders:create')
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/postgres--permission_query-admin_user.sql
Vendored
+6 -6
View File
@@ -1,9 +1,9 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
OR (br.role = 'Grafana Admin')
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
OR (br.role = 'Grafana Admin')
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/postgres--permission_query-anonymous_user.sql
Vendored
+3 -3
View File
@@ -1,6 +1,6 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
)
pkg/services/authz/rbac/store/testdata/postgres--permission_query-user_with_teams.sql
Vendored
+7 -7
View File
@@ -1,10 +1,10 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
UNION ALL
SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
UNION
SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
)
pkg/services/authz/rbac/store/testdata/postgres--permission_query-viewer_user.sql
Vendored
+5 -5
View File
@@ -1,8 +1,8 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/sqlite--permission_query-With_action_sets.sql
Vendored
+5 -5
View File
@@ -1,8 +1,8 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action IN ('folders:edit', 'folders:admin', 'folders:create')
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/sqlite--permission_query-admin_user.sql
Vendored
+6 -6
View File
@@ -1,9 +1,9 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
OR (br.role = 'Grafana Admin')
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Admin' AND (br.org_id = 1 OR br.org_id = 0))
OR (br.role = 'Grafana Admin')
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)
pkg/services/authz/rbac/store/testdata/sqlite--permission_query-anonymous_user.sql
Vendored
+3 -3
View File
@@ -1,6 +1,6 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
)
pkg/services/authz/rbac/store/testdata/sqlite--permission_query-user_with_teams.sql
Vendored
+7 -7
View File
@@ -1,10 +1,10 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
UNION ALL
SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'None' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
UNION
SELECT role_id FROM "grafana"."team_role" as tr WHERE tr.team_id IN (1, 2) AND tr.org_id = 1
)
pkg/services/authz/rbac/store/testdata/sqlite--permission_query-viewer_user.sql
Vendored
+5 -5
View File
@@ -1,8 +1,8 @@
SELECT p.kind, p.attribute, p.identifier, p.scope FROM "grafana"."permission" as p
INNER JOIN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION ALL
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
) as roles ON p.role_id = roles.role_id
WHERE
p.action = 'folders:read'
AND p.role_id IN (
SELECT role_id FROM "grafana"."builtin_role" as br WHERE (br.role = 'Viewer' AND (br.org_id = 1 OR br.org_id = 0))
UNION
SELECT role_id FROM "grafana"."user_role" as ur WHERE ur.user_id = 1 AND (ur.org_id = 1 OR ur.org_id = 0)
)