public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v11.3.x] Alerting: Fix per-receiver RBAC for receivers with long names (#95165)

Browse Source 
Alerting: Fix per-receiver RBAC for receivers with long names (#95084)

* Implement uidToResourceID

* add middleware

* Move uidToResourceID to alerting package

* Only hash uid if it's too long

* Use hashed uid in access control

* Move ReceiverUidToResourceId to ScopeProvider

* resolve uid in middleware only if param exists

* Tests

* Linting

---------

Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
(cherry picked from commit 4aad44e848)

Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>
This commit is contained in:
grafana-delivery-bot[bot]
2024-11-14 13:01:31 -05:00
committed by GitHub
co-authored by Matthew Jacobson
parent a6bc76df32
commit a09dcda92d
5 changed files with 74 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/ossaccesscontrol/receivers.go
+12 -5
View File
@@ -76,12 +76,13 @@ type ReceiverPermissionsService struct {
// SetDefaultPermissions sets the default permissions for a newly created receiver.
func (r ReceiverPermissionsService) SetDefaultPermissions(ctx context.Context, orgID int64, user identity.Requester, uid string) {
r.log.Debug("Setting default permissions for receiver", "receiver_uid", uid)
resourceId := alertingac.ScopeReceiversProvider.GetResourceIDFromUID(uid)
permissions := defaultPermissions()
clearCache := false
if user != nil && user.IsIdentityType(claims.TypeUser, claims.TypeServiceAccount) {
userID, err := user.GetInternalID()
if err != nil {
r.log.Error("Could not make user admin", "receiver_uid", uid, "id", user.GetID(), "error", err)
r.log.Error("Could not make user admin", "receiver_uid", uid, "resource_id", resourceId, "id", user.GetID(), "error", err)
} else {
permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{
UserID: userID, Permission: string(alertingac.ReceiverPermissionAdmin),
@@ -90,8 +91,8 @@ func (r ReceiverPermissionsService) SetDefaultPermissions(ctx context.Context, o
}
}
if _, err := r.SetPermissions(ctx, orgID, uid, permissions...); err != nil {
r.log.Error("Could not set default permissions", "receiver_uid", uid, "error", err)
if _, err := r.SetPermissions(ctx, orgID, resourceId, permissions...); err != nil {
r.log.Error("Could not set default permissions", "receiver_uid", uid, "resource_id", resourceId, "id", "error", err)
}
if clearCache {
@@ -120,13 +121,15 @@ func copyPermissionUser(orgID int64) identity.Requester {
// name.
func (r ReceiverPermissionsService) CopyPermissions(ctx context.Context, orgID int64, user identity.Requester, oldUID, newUID string) (int, error) {
r.log.Debug("Copying permissions from receiver", "old_uid", oldUID, "new_uid", newUID)
currentPermissions, err := r.GetPermissions(ctx, copyPermissionUser(orgID), oldUID)
oldResourceId := alertingac.ScopeReceiversProvider.GetResourceIDFromUID(oldUID)
newResourceId := alertingac.ScopeReceiversProvider.GetResourceIDFromUID(newUID)
currentPermissions, err := r.GetPermissions(ctx, copyPermissionUser(orgID), oldResourceId)
if err != nil {
return 0, err
}
setPermissionCommands := r.toSetResourcePermissionCommands(currentPermissions)
if _, err := r.SetPermissions(ctx, orgID, newUID, setPermissionCommands...); err != nil {
if _, err := r.SetPermissions(ctx, orgID, newResourceId, setPermissionCommands...); err != nil {
return 0, err
}
@@ -146,6 +149,10 @@ func (r ReceiverPermissionsService) CopyPermissions(ctx context.Context, orgID i
return countCustomPermissions(setPermissionCommands), nil
}
func (r ReceiverPermissionsService) DeleteResourcePermissions(ctx context.Context, orgID int64, uid string) error {
return r.Service.DeleteResourcePermissions(ctx, orgID, alertingac.ScopeReceiversProvider.GetResourceIDFromUID(uid))
}
// toSetResourcePermissionCommands converts a list of resource permissions to a list of set resource permission commands.
// Only includes managed permissions.
func (r ReceiverPermissionsService) toSetResourcePermissionCommands(permissions []accesscontrol.ResourcePermission) []accesscontrol.SetResourcePermissionCommand {