AccessControl: Use UIDs for Resource permissions frontend (#95552)
* frontend can use uids to set resource permissions * lint * add uids to folder acl * Update public/app/core/components/Select/UserPicker.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * simplify conditions --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
This commit is contained in:
Jo
Ieva
@@ -234,10 +234,12 @@ type ResourcePermission struct {
|
||||
RoleName string
|
||||
Actions []string
|
||||
Scope string
|
||||
UserId int64
|
||||
UserID int64
|
||||
UserUID string
|
||||
UserLogin string
|
||||
UserEmail string
|
||||
TeamId int64
|
||||
TeamID int64
|
||||
TeamUID string
|
||||
TeamEmail string
|
||||
Team string
|
||||
BuiltInRole string
|
||||
|
||||
@@ -171,8 +171,8 @@ func (r ReceiverPermissionsService) toSetResourcePermissionCommands(permissions
|
||||
cmds = append(cmds, accesscontrol.SetResourcePermissionCommand{
|
||||
Permission: permission,
|
||||
BuiltinRole: p.BuiltInRole,
|
||||
TeamID: p.TeamId,
|
||||
UserID: p.UserId,
|
||||
TeamID: p.TeamID,
|
||||
UserID: p.UserID,
|
||||
})
|
||||
}
|
||||
return cmds
|
||||
|
||||
@@ -134,10 +134,12 @@ type resourcePermissionDTO struct {
|
||||
IsInherited bool `json:"isInherited"`
|
||||
IsServiceAccount bool `json:"isServiceAccount"`
|
||||
UserID int64 `json:"userId,omitempty"`
|
||||
UserUID string `json:"userUid,omitempty"`
|
||||
UserLogin string `json:"userLogin,omitempty"`
|
||||
UserAvatarUrl string `json:"userAvatarUrl,omitempty"`
|
||||
Team string `json:"team,omitempty"`
|
||||
TeamID int64 `json:"teamId,omitempty"`
|
||||
TeamUID string `json:"teamUid,omitempty"`
|
||||
TeamAvatarUrl string `json:"teamAvatarUrl,omitempty"`
|
||||
BuiltInRole string `json:"builtInRole,omitempty"`
|
||||
Actions []string `json:"actions"`
|
||||
@@ -191,18 +193,20 @@ func (a *api) getPermissions(c *contextmodel.ReqContext) response.Response {
|
||||
for _, p := range permissions {
|
||||
if permission := a.service.MapActions(p); permission != "" {
|
||||
teamAvatarUrl := ""
|
||||
if p.TeamId != 0 {
|
||||
if p.TeamID != 0 {
|
||||
teamAvatarUrl = dtos.GetGravatarUrlWithDefault(a.cfg, p.TeamEmail, p.Team)
|
||||
}
|
||||
|
||||
dto = append(dto, resourcePermissionDTO{
|
||||
ID: p.ID,
|
||||
RoleName: p.RoleName,
|
||||
UserID: p.UserId,
|
||||
UserID: p.UserID,
|
||||
UserUID: p.UserUID,
|
||||
UserLogin: p.UserLogin,
|
||||
UserAvatarUrl: dtos.GetGravatarUrl(a.cfg, p.UserEmail),
|
||||
Team: p.Team,
|
||||
TeamID: p.TeamId,
|
||||
TeamID: p.TeamID,
|
||||
TeamUID: p.TeamUID,
|
||||
TeamAvatarUrl: teamAvatarUrl,
|
||||
BuiltInRole: p.BuiltInRole,
|
||||
Actions: p.Actions,
|
||||
|
||||
@@ -35,9 +35,11 @@ type flatResourcePermission struct {
|
||||
Action string
|
||||
Scope string
|
||||
UserId int64
|
||||
UserUid string
|
||||
UserLogin string
|
||||
UserEmail string
|
||||
TeamId int64
|
||||
TeamUid string
|
||||
TeamEmail string
|
||||
Team string
|
||||
BuiltInRole string
|
||||
@@ -331,10 +333,12 @@ func (s *store) getResourcePermissions(sess *db.Session, orgID int64, query GetR
|
||||
userSelect := rawSelect + `
|
||||
ur.user_id AS user_id,
|
||||
u.login AS user_login,
|
||||
u.uid AS user_uid,
|
||||
u.is_service_account AS is_service_account,
|
||||
u.email AS user_email,
|
||||
0 AS team_id,
|
||||
'' AS team,
|
||||
'' AS team_uid,
|
||||
'' AS team_email,
|
||||
'' AS built_in_role
|
||||
`
|
||||
@@ -342,10 +346,12 @@ func (s *store) getResourcePermissions(sess *db.Session, orgID int64, query GetR
|
||||
teamSelect := rawSelect + `
|
||||
0 AS user_id,
|
||||
'' AS user_login,
|
||||
'' AS user_uid,
|
||||
` + s.sql.GetDialect().BooleanStr(false) + ` AS is_service_account,
|
||||
'' AS user_email,
|
||||
tr.team_id AS team_id,
|
||||
t.name AS team,
|
||||
t.uid AS team_uid,
|
||||
t.email AS team_email,
|
||||
'' AS built_in_role
|
||||
`
|
||||
@@ -353,10 +359,12 @@ func (s *store) getResourcePermissions(sess *db.Session, orgID int64, query GetR
|
||||
builtinSelect := rawSelect + `
|
||||
0 AS user_id,
|
||||
'' AS user_login,
|
||||
'' AS user_uid,
|
||||
` + s.sql.GetDialect().BooleanStr(false) + ` AS is_service_account,
|
||||
'' AS user_email,
|
||||
0 as team_id,
|
||||
'' AS team,
|
||||
'' AS team_uid,
|
||||
'' AS team_email,
|
||||
br.role AS built_in_role
|
||||
`
|
||||
@@ -522,10 +530,12 @@ func flatPermissionsToResourcePermission(scope string, permissions []flatResourc
|
||||
RoleName: first.RoleName,
|
||||
Actions: actions,
|
||||
Scope: first.Scope,
|
||||
UserId: first.UserId,
|
||||
UserID: first.UserId,
|
||||
UserUID: first.UserUid,
|
||||
UserLogin: first.UserLogin,
|
||||
UserEmail: first.UserEmail,
|
||||
TeamId: first.TeamId,
|
||||
TeamID: first.TeamId,
|
||||
TeamUID: first.TeamUid,
|
||||
TeamEmail: first.TeamEmail,
|
||||
Team: first.Team,
|
||||
BuiltInRole: first.BuiltInRole,
|
||||
|
||||
@@ -351,8 +351,8 @@ func TestIntegrationStore_SetResourcePermissions(t *testing.T) {
|
||||
assert.Equal(t, accesscontrol.ResourcePermission{}, permissions[i])
|
||||
} else {
|
||||
assert.Len(t, permissions[i].Actions, len(c.Actions))
|
||||
assert.Equal(t, c.TeamID, permissions[i].TeamId)
|
||||
assert.Equal(t, c.User.ID, permissions[i].UserId)
|
||||
assert.Equal(t, c.TeamID, permissions[i].TeamID)
|
||||
assert.Equal(t, c.User.ID, permissions[i].UserID)
|
||||
assert.Equal(t, c.BuiltinRole, permissions[i].BuiltInRole)
|
||||
assert.Equal(t, accesscontrol.Scope(c.Resource, tt.resourceAttribute, c.ResourceID), permissions[i].Scope)
|
||||
}
|
||||
|
||||
@@ -388,10 +388,12 @@ type DashboardACLInfoDTO struct {
|
||||
Updated time.Time `json:"updated"`
|
||||
|
||||
UserID int64 `json:"userId" xorm:"user_id"`
|
||||
UserUID string `json:"userUid"`
|
||||
UserLogin string `json:"userLogin"`
|
||||
UserEmail string `json:"userEmail"`
|
||||
UserAvatarURL string `json:"userAvatarUrl" xorm:"user_avatar_url"`
|
||||
TeamID int64 `json:"teamId" xorm:"team_id"`
|
||||
TeamUID string `json:"teamUid"`
|
||||
TeamEmail string `json:"teamEmail"`
|
||||
TeamAvatarURL string `json:"teamAvatarUrl" xorm:"team_avatar_url"`
|
||||
Team string `json:"team"`
|
||||
|
||||
@@ -143,6 +143,7 @@ type UpdateOrgUserCommand struct {
|
||||
type OrgUserDTO struct {
|
||||
OrgID int64 `json:"orgId" xorm:"org_id"`
|
||||
UserID int64 `json:"userId" xorm:"user_id"`
|
||||
UID string `json:"uid" xorm:"uid"`
|
||||
Email string `json:"email"`
|
||||
Name string `json:"name"`
|
||||
AvatarURL string `json:"avatarUrl" xorm:"avatar_url"`
|
||||
|
||||
@@ -602,6 +602,7 @@ func (ss *sqlStore) SearchOrgUsers(ctx context.Context, query *org.SearchOrgUser
|
||||
"org_user.org_id",
|
||||
"org_user.user_id",
|
||||
"u.email",
|
||||
"u.uid",
|
||||
"u.name",
|
||||
"u.login",
|
||||
"org_user.role",
|
||||
|
||||
Reference in New Issue
Block a user