[v11.3.x] Alerting: Fix per-receiver RBAC for receivers with long names (#95165)

Alerting: Fix per-receiver RBAC for receivers with long names (#95084)

* Implement uidToResourceID

* add middleware

* Move uidToResourceID to alerting package

* Only hash uid if it's too long

* Use hashed uid in access control

* Move ReceiverUidToResourceId to ScopeProvider

* resolve uid in middleware only if param exists

* Tests

* Linting

---------

Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
(cherry picked from commit 4aad44e848)

Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>
This commit is contained in:
grafana-delivery-bot[bot]
2024-11-14 13:01:31 -05:00
committed by GitHub
co-authored by Matthew Jacobson
parent a6bc76df32
commit a09dcda92d
5 changed files with 74 additions and 11 deletions
@@ -479,6 +479,14 @@ func TestIntegrationAccessControl(t *testing.T) {
)...),
})
// Test receivers with uids longer than 40 characters. User name is used in receiver name.
adminLikeUserLongName := helper.CreateUser("adminLikeUserCreatingAReallyLongReceiverName", apis.Org1, org.RoleNone, []resourcepermissions.SetResourcePermissionCommand{
createWildcardPermission(append(
[]string{accesscontrol.ActionAlertingReceiversCreate},
ossaccesscontrol.ReceiversAdminActions...,
)...),
})
// endregion
testCases := []testCase{
@@ -553,6 +561,15 @@ func TestIntegrationAccessControl(t *testing.T) {
canAdmin: true,
canReadSecrets: true,
},
{
user: adminLikeUserLongName,
canRead: true,
canCreate: true,
canUpdate: true,
canDelete: true,
canAdmin: true,
canReadSecrets: true,
},
}
admin := org1.Admin