diff --git a/pkg/api/api.go b/pkg/api/api.go index 651ec704ebf..5407314457f 100644 --- a/pkg/api/api.go +++ b/pkg/api/api.go @@ -29,7 +29,7 @@ func (hs *HTTPServer) registerRoutes() { reqGrafanaAdmin := middleware.ReqGrafanaAdmin reqEditorRole := middleware.ReqEditorRole reqOrgAdmin := middleware.ReqOrgAdmin - reqOrgAdminFolderAdminOrTeamAdmin := middleware.OrgAdminFolderAdminOrTeamAdmin(hs.SQLStore) + reqOrgAdminDashOrFolderAdminOrTeamAdmin := middleware.OrgAdminDashOrFolderAdminOrTeamAdmin(hs.SQLStore) reqCanAccessTeams := middleware.AdminOrEditorAndFeatureEnabled(hs.Cfg.EditorsCanAdmin) reqSnapshotPublicModeOrSignedIn := middleware.SnapshotPublicModeOrSignedIn(hs.Cfg) redirectFromLegacyPanelEditURL := middleware.RedirectFromLegacyPanelEditURL(hs.Cfg) @@ -247,7 +247,7 @@ func (hs *HTTPServer) registerRoutes() { // current org without requirement of user to be org admin apiRoute.Group("/org", func(orgRoute routing.RouteRegister) { - orgRoute.Get("/users/lookup", authorize(reqOrgAdminFolderAdminOrTeamAdmin, ac.EvalPermission(ac.ActionOrgUsersRead)), routing.Wrap(hs.GetOrgUsersForCurrentOrgLookup)) + orgRoute.Get("/users/lookup", authorize(reqOrgAdminDashOrFolderAdminOrTeamAdmin, ac.EvalPermission(ac.ActionOrgUsersRead)), routing.Wrap(hs.GetOrgUsersForCurrentOrgLookup)) }) // create new org diff --git a/pkg/middleware/auth.go b/pkg/middleware/auth.go index a3b2a2f2e89..b21a6a87e92 100644 --- a/pkg/middleware/auth.go +++ b/pkg/middleware/auth.go @@ -191,18 +191,18 @@ func shouldForceLogin(c *models.ReqContext) bool { return forceLogin } -func OrgAdminFolderAdminOrTeamAdmin(ss sqlstore.Store) func(c *models.ReqContext) { +func OrgAdminDashOrFolderAdminOrTeamAdmin(ss sqlstore.Store) func(c *models.ReqContext) { return func(c *models.ReqContext) { if c.OrgRole == models.ROLE_ADMIN { return } - hasAdminPermissionInFoldersQuery := models.HasAdminPermissionInFoldersQuery{SignedInUser: c.SignedInUser} - if err := ss.HasAdminPermissionInFolders(c.Req.Context(), &hasAdminPermissionInFoldersQuery); err != nil { + hasAdminPermissionInDashOrFoldersQuery := models.HasAdminPermissionInDashboardsOrFoldersQuery{SignedInUser: c.SignedInUser} + if err := ss.HasAdminPermissionInDashboardsOrFolders(c.Req.Context(), &hasAdminPermissionInDashOrFoldersQuery); err != nil { c.JsonApiErr(500, "Failed to check if user is a folder admin", err) } - if hasAdminPermissionInFoldersQuery.Result { + if hasAdminPermissionInDashOrFoldersQuery.Result { return } diff --git a/pkg/models/folders.go b/pkg/models/folders.go index 895cfea2a5c..046415a462a 100644 --- a/pkg/models/folders.go +++ b/pkg/models/folders.go @@ -109,7 +109,7 @@ type HasEditPermissionInFoldersQuery struct { Result bool } -type HasAdminPermissionInFoldersQuery struct { +type HasAdminPermissionInDashboardsOrFoldersQuery struct { SignedInUser *SignedInUser Result bool } diff --git a/pkg/services/dashboards/database/database_folder_test.go b/pkg/services/dashboards/database/database_folder_test.go index 34a8f674add..627b6cdaa7a 100644 --- a/pkg/services/dashboards/database/database_folder_test.go +++ b/pkg/services/dashboards/database/database_folder_test.go @@ -337,10 +337,10 @@ func TestDashboardFolderDataAccess(t *testing.T) { }) t.Run("should have admin permission in folders", func(t *testing.T) { - query := &models.HasAdminPermissionInFoldersQuery{ + query := &models.HasAdminPermissionInDashboardsOrFoldersQuery{ SignedInUser: &models.SignedInUser{UserId: adminUser.Id, OrgId: 1, OrgRole: models.ROLE_ADMIN}, } - err := sqlStore.HasAdminPermissionInFolders(context.Background(), query) + err := sqlStore.HasAdminPermissionInDashboardsOrFolders(context.Background(), query) require.NoError(t, err) require.True(t, query.Result) }) @@ -403,10 +403,10 @@ func TestDashboardFolderDataAccess(t *testing.T) { }) t.Run("should not have admin permission in folders", func(t *testing.T) { - query := &models.HasAdminPermissionInFoldersQuery{ + query := &models.HasAdminPermissionInDashboardsOrFoldersQuery{ SignedInUser: &models.SignedInUser{UserId: adminUser.Id, OrgId: 1, OrgRole: models.ROLE_EDITOR}, } - err := sqlStore.HasAdminPermissionInFolders(context.Background(), query) + err := sqlStore.HasAdminPermissionInDashboardsOrFolders(context.Background(), query) require.NoError(t, err) require.False(t, query.Result) }) @@ -471,10 +471,10 @@ func TestDashboardFolderDataAccess(t *testing.T) { }) t.Run("should not have admin permission in folders", func(t *testing.T) { - query := &models.HasAdminPermissionInFoldersQuery{ + query := &models.HasAdminPermissionInDashboardsOrFoldersQuery{ SignedInUser: &models.SignedInUser{UserId: adminUser.Id, OrgId: 1, OrgRole: models.ROLE_VIEWER}, } - err := sqlStore.HasAdminPermissionInFolders(context.Background(), query) + err := sqlStore.HasAdminPermissionInDashboardsOrFolders(context.Background(), query) require.NoError(t, err) require.False(t, query.Result) }) diff --git a/pkg/services/sqlstore/dashboard.go b/pkg/services/sqlstore/dashboard.go index 4f961ee2c92..8c062ca24d2 100644 --- a/pkg/services/sqlstore/dashboard.go +++ b/pkg/services/sqlstore/dashboard.go @@ -376,7 +376,7 @@ func (ss *SQLStore) HasEditPermissionInFolders(ctx context.Context, query *model }) } -func (ss *SQLStore) HasAdminPermissionInFolders(ctx context.Context, query *models.HasAdminPermissionInFoldersQuery) error { +func (ss *SQLStore) HasAdminPermissionInDashboardsOrFolders(ctx context.Context, query *models.HasAdminPermissionInDashboardsOrFoldersQuery) error { return ss.WithDbSession(ctx, func(dbSession *DBSession) error { if query.SignedInUser.HasRole(models.ROLE_ADMIN) { query.Result = true @@ -384,7 +384,7 @@ func (ss *SQLStore) HasAdminPermissionInFolders(ctx context.Context, query *mode } builder := &SQLBuilder{} - builder.Write("SELECT COUNT(dashboard.id) AS count FROM dashboard WHERE dashboard.org_id = ? AND dashboard.is_folder = ?", query.SignedInUser.OrgId, dialect.BooleanStr(true)) + builder.Write("SELECT COUNT(dashboard.id) AS count FROM dashboard WHERE dashboard.org_id = ?", query.SignedInUser.OrgId) builder.WriteDashboardPermissionFilter(query.SignedInUser, models.PERMISSION_ADMIN) type folderCount struct { diff --git a/pkg/services/sqlstore/mockstore/mockstore.go b/pkg/services/sqlstore/mockstore/mockstore.go index f66b16b723e..2754c83740c 100644 --- a/pkg/services/sqlstore/mockstore/mockstore.go +++ b/pkg/services/sqlstore/mockstore/mockstore.go @@ -661,7 +661,7 @@ func (m *SQLStoreMock) SearchOrgs(ctx context.Context, query *models.SearchOrgsQ return m.ExpectedError } -func (m *SQLStoreMock) HasAdminPermissionInFolders(ctx context.Context, query *models.HasAdminPermissionInFoldersQuery) error { +func (m *SQLStoreMock) HasAdminPermissionInDashboardsOrFolders(ctx context.Context, query *models.HasAdminPermissionInDashboardsOrFoldersQuery) error { return m.ExpectedError } diff --git a/pkg/services/sqlstore/store.go b/pkg/services/sqlstore/store.go index 35e66d58350..a7528a3dfb5 100644 --- a/pkg/services/sqlstore/store.go +++ b/pkg/services/sqlstore/store.go @@ -146,7 +146,7 @@ type Store interface { ExpireOldUserInvites(ctx context.Context, cmd *models.ExpireTempUsersCommand) error GetDBHealthQuery(ctx context.Context, query *models.GetDBHealthQuery) error SearchOrgs(ctx context.Context, query *models.SearchOrgsQuery) error - HasAdminPermissionInFolders(ctx context.Context, query *models.HasAdminPermissionInFoldersQuery) error + HasAdminPermissionInDashboardsOrFolders(ctx context.Context, query *models.HasAdminPermissionInDashboardsOrFoldersQuery) error GetDashboardPermissionsForUser(ctx context.Context, query *models.GetDashboardPermissionsForUserQuery) error GetDashboardSlugById(ctx context.Context, query *models.GetDashboardSlugByIdQuery) error }