public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AccessControl: Make the built-in role definitions public (#47525)

Browse Source 
* AccessControl: Make the built-in role definitions public

* Add context to RegisterFixedRoles

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Making BuiltInRolesWithParents public to the AccessControl package

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

Co-authored-by: Jguer <joao.guerreiro@grafana.com>
This commit is contained in:
Gabriel MABILLE
2022-04-12 09:53:43 +02:00
committed by GitHub
co-authored by Jguer
parent 0bf889e058
commit 8bd825e16c
7 changed files with 79 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go
+3 -51
View File
@@ -33,43 +33,6 @@ func ProvideService(features featuremgmt.FeatureToggles, usageStats usagestats.S
return s, errDeclareRoles
}
func macroRoles() map[string]*accesscontrol.RoleDTO {
return map[string]*accesscontrol.RoleDTO{
string(models.ROLE_ADMIN): {
Name: "fixed:builtins:admin",
DisplayName: string(models.ROLE_ADMIN),
Description: "Admin role",
Group: "Basic",
Version: 1,
Permissions: []accesscontrol.Permission{},
},
string(models.ROLE_EDITOR): {
Name: "fixed:builtins:editor",
DisplayName: string(models.ROLE_EDITOR),
Description: "Editor role",
Group: "Basic",
Version: 1,
Permissions: []accesscontrol.Permission{},
},
string(models.ROLE_VIEWER): {
Name: "fixed:builtins:viewer",
DisplayName: string(models.ROLE_VIEWER),
Description: "Viewer role",
Group: "Basic",
Version: 1,
Permissions: []accesscontrol.Permission{},
},
accesscontrol.RoleGrafanaAdmin: {
Name: "fixed:builtins:grafana_admin",
DisplayName: accesscontrol.RoleGrafanaAdmin,
Description: "Grafana Admin role",
Group: "Basic",
Version: 1,
Permissions: []accesscontrol.Permission{},
},
}
}
// ProvideOSSAccessControl creates an oss implementation of access control without usage stats registration
func ProvideOSSAccessControl(features featuremgmt.FeatureToggles, provider accesscontrol.PermissionsProvider) *OSSAccessControlService {
s := &OSSAccessControlService{
@@ -77,7 +40,7 @@ func ProvideOSSAccessControl(features featuremgmt.FeatureToggles, provider acces
provider: provider,
log: log.New("accesscontrol"),
scopeResolver: accesscontrol.NewScopeResolver(),
roles: macroRoles(),
roles: accesscontrol.BuildMacroRoleDefinitions(),
}
return s
@@ -211,7 +174,7 @@ func (ac *OSSAccessControlService) GetUserBuiltInRoles(user *models.SignedInUser
}
// RegisterFixedRoles registers all declared roles in RAM
func (ac *OSSAccessControlService) RegisterFixedRoles() error {
func (ac *OSSAccessControlService) RegisterFixedRoles(ctx context.Context) error {
// If accesscontrol is disabled no need to register roles
if ac.IsDisabled() {
return nil
@@ -225,18 +188,7 @@ func (ac *OSSAccessControlService) RegisterFixedRoles() error {
// RegisterFixedRole saves a fixed role and assigns it to built-in roles
func (ac *OSSAccessControlService) registerFixedRole(role accesscontrol.RoleDTO, builtInRoles []string) {
// Inheritance
brs := map[string]struct{}{}
for _, builtInRole := range builtInRoles {
brs[builtInRole] = struct{}{}
if builtInRole != accesscontrol.RoleGrafanaAdmin {
for _, parent := range models.RoleType(builtInRole).Parents() {
brs[string(parent)] = struct{}{}
}
}
}
for br := range brs {
for br := range accesscontrol.BuiltInRolesWithParents(builtInRoles) {
if macroRole, ok := ac.roles[br]; ok {
macroRole.Permissions = append(macroRole.Permissions, role.Permissions...)
} else {