public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Access Control: Allow dashboard admins to query org users (#51695)

Browse Source 
* "Release: Updated versions in package to 8.5.6" (#370)

* allow dashboard admins to query org users

Co-authored-by: Grot (@grafanabot) <43478413+grafanabot@users.noreply.github.com>
This commit is contained in:
Ieva
2022-07-04 14:22:37 +01:00
committed by GitHub
co-authored by Grot
parent f7d9c401c2
commit 8a7fe0f49f
7 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/api.go
+2 -2
View File
@@ -29,7 +29,7 @@ func (hs *HTTPServer) registerRoutes() {
reqGrafanaAdmin := middleware.ReqGrafanaAdmin
reqEditorRole := middleware.ReqEditorRole
reqOrgAdmin := middleware.ReqOrgAdmin
reqOrgAdminFolderAdminOrTeamAdmin := middleware.OrgAdminFolderAdminOrTeamAdmin(hs.SQLStore)
reqOrgAdminDashOrFolderAdminOrTeamAdmin := middleware.OrgAdminDashOrFolderAdminOrTeamAdmin(hs.SQLStore)
reqCanAccessTeams := middleware.AdminOrEditorAndFeatureEnabled(hs.Cfg.EditorsCanAdmin)
reqSnapshotPublicModeOrSignedIn := middleware.SnapshotPublicModeOrSignedIn(hs.Cfg)
redirectFromLegacyPanelEditURL := middleware.RedirectFromLegacyPanelEditURL(hs.Cfg)
@@ -247,7 +247,7 @@ func (hs *HTTPServer) registerRoutes() {
// current org without requirement of user to be org admin
apiRoute.Group("/org", func(orgRoute routing.RouteRegister) {
orgRoute.Get("/users/lookup", authorize(reqOrgAdminFolderAdminOrTeamAdmin, ac.EvalPermission(ac.ActionOrgUsersRead)), routing.Wrap(hs.GetOrgUsersForCurrentOrgLookup))
orgRoute.Get("/users/lookup", authorize(reqOrgAdminDashOrFolderAdminOrTeamAdmin, ac.EvalPermission(ac.ActionOrgUsersRead)), routing.Wrap(hs.GetOrgUsersForCurrentOrgLookup))
})
// create new org
pkg/middleware/auth.go
+4 -4
View File
@@ -191,18 +191,18 @@ func shouldForceLogin(c *models.ReqContext) bool {
return forceLogin
}
func OrgAdminFolderAdminOrTeamAdmin(ss sqlstore.Store) func(c *models.ReqContext) {
func OrgAdminDashOrFolderAdminOrTeamAdmin(ss sqlstore.Store) func(c *models.ReqContext) {
return func(c *models.ReqContext) {
if c.OrgRole == models.ROLE_ADMIN {
return
}
hasAdminPermissionInFoldersQuery := models.HasAdminPermissionInFoldersQuery{SignedInUser: c.SignedInUser}
if err := ss.HasAdminPermissionInFolders(c.Req.Context(), &hasAdminPermissionInFoldersQuery); err != nil {
hasAdminPermissionInDashOrFoldersQuery := models.HasAdminPermissionInDashboardsOrFoldersQuery{SignedInUser: c.SignedInUser}
if err := ss.HasAdminPermissionInDashboardsOrFolders(c.Req.Context(), &hasAdminPermissionInDashOrFoldersQuery); err != nil {
c.JsonApiErr(500, "Failed to check if user is a folder admin", err)
}
if hasAdminPermissionInFoldersQuery.Result {
if hasAdminPermissionInDashOrFoldersQuery.Result {
return
}
pkg/models/folders.go
+1 -1
View File
@@ -109,7 +109,7 @@ type HasEditPermissionInFoldersQuery struct {
Result bool
}
type HasAdminPermissionInFoldersQuery struct {
type HasAdminPermissionInDashboardsOrFoldersQuery struct {
SignedInUser *SignedInUser
Result bool
}
pkg/services/dashboards/database/database_folder_test.go
+6 -6
View File
@@ -337,10 +337,10 @@ func TestDashboardFolderDataAccess(t *testing.T) {
})
t.Run("should have admin permission in folders", func(t *testing.T) {
query := &models.HasAdminPermissionInFoldersQuery{
query := &models.HasAdminPermissionInDashboardsOrFoldersQuery{
SignedInUser: &models.SignedInUser{UserId: adminUser.Id, OrgId: 1, OrgRole: models.ROLE_ADMIN},
}
err := sqlStore.HasAdminPermissionInFolders(context.Background(), query)
err := sqlStore.HasAdminPermissionInDashboardsOrFolders(context.Background(), query)
require.NoError(t, err)
require.True(t, query.Result)
})
@@ -403,10 +403,10 @@ func TestDashboardFolderDataAccess(t *testing.T) {
})
t.Run("should not have admin permission in folders", func(t *testing.T) {
query := &models.HasAdminPermissionInFoldersQuery{
query := &models.HasAdminPermissionInDashboardsOrFoldersQuery{
SignedInUser: &models.SignedInUser{UserId: adminUser.Id, OrgId: 1, OrgRole: models.ROLE_EDITOR},
}
err := sqlStore.HasAdminPermissionInFolders(context.Background(), query)
err := sqlStore.HasAdminPermissionInDashboardsOrFolders(context.Background(), query)
require.NoError(t, err)
require.False(t, query.Result)
})
@@ -471,10 +471,10 @@ func TestDashboardFolderDataAccess(t *testing.T) {
})
t.Run("should not have admin permission in folders", func(t *testing.T) {
query := &models.HasAdminPermissionInFoldersQuery{
query := &models.HasAdminPermissionInDashboardsOrFoldersQuery{
SignedInUser: &models.SignedInUser{UserId: adminUser.Id, OrgId: 1, OrgRole: models.ROLE_VIEWER},
}
err := sqlStore.HasAdminPermissionInFolders(context.Background(), query)
err := sqlStore.HasAdminPermissionInDashboardsOrFolders(context.Background(), query)
require.NoError(t, err)
require.False(t, query.Result)
})
pkg/services/sqlstore/dashboard.go
+2 -2
View File
@@ -376,7 +376,7 @@ func (ss *SQLStore) HasEditPermissionInFolders(ctx context.Context, query *model
})
}
func (ss *SQLStore) HasAdminPermissionInFolders(ctx context.Context, query *models.HasAdminPermissionInFoldersQuery) error {
func (ss *SQLStore) HasAdminPermissionInDashboardsOrFolders(ctx context.Context, query *models.HasAdminPermissionInDashboardsOrFoldersQuery) error {
return ss.WithDbSession(ctx, func(dbSession *DBSession) error {
if query.SignedInUser.HasRole(models.ROLE_ADMIN) {
query.Result = true
@@ -384,7 +384,7 @@ func (ss *SQLStore) HasAdminPermissionInFolders(ctx context.Context, query *mode
}
builder := &SQLBuilder{}
builder.Write("SELECT COUNT(dashboard.id) AS count FROM dashboard WHERE dashboard.org_id = ? AND dashboard.is_folder = ?", query.SignedInUser.OrgId, dialect.BooleanStr(true))
builder.Write("SELECT COUNT(dashboard.id) AS count FROM dashboard WHERE dashboard.org_id = ?", query.SignedInUser.OrgId)
builder.WriteDashboardPermissionFilter(query.SignedInUser, models.PERMISSION_ADMIN)
type folderCount struct {
pkg/services/sqlstore/mockstore/mockstore.go
+1 -1
View File
@@ -661,7 +661,7 @@ func (m *SQLStoreMock) SearchOrgs(ctx context.Context, query *models.SearchOrgsQ
return m.ExpectedError
}
func (m *SQLStoreMock) HasAdminPermissionInFolders(ctx context.Context, query *models.HasAdminPermissionInFoldersQuery) error {
func (m *SQLStoreMock) HasAdminPermissionInDashboardsOrFolders(ctx context.Context, query *models.HasAdminPermissionInDashboardsOrFoldersQuery) error {
return m.ExpectedError
}
pkg/services/sqlstore/store.go
+1 -1
View File
@@ -146,7 +146,7 @@ type Store interface {
ExpireOldUserInvites(ctx context.Context, cmd *models.ExpireTempUsersCommand) error
GetDBHealthQuery(ctx context.Context, query *models.GetDBHealthQuery) error
SearchOrgs(ctx context.Context, query *models.SearchOrgsQuery) error
HasAdminPermissionInFolders(ctx context.Context, query *models.HasAdminPermissionInFoldersQuery) error
HasAdminPermissionInDashboardsOrFolders(ctx context.Context, query *models.HasAdminPermissionInDashboardsOrFoldersQuery) error
GetDashboardPermissionsForUser(ctx context.Context, query *models.GetDashboardPermissionsForUserQuery) error
GetDashboardSlugById(ctx context.Context, query *models.GetDashboardSlugByIdQuery) error
}