public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: remove simple RBAC disabled checks (#71137)

Browse Source 
* remove simple RBAC disabled checks

* fixing tests

* remove old AC tests
This commit is contained in:
Ieva
2023-07-10 15:14:21 +03:00
committed by GitHub
parent 8f2f6d63eb
commit a65cb4d808
16 changed files with 64 additions and 720 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/sync/permission_sync.go
+1 -1
View File
@@ -26,7 +26,7 @@ type PermissionsSync struct {
}
func (s *PermissionsSync) SyncPermissionsHook(ctx context.Context, identity *authn.Identity, _ *authn.Request) error {
if s.ac.IsDisabled() || !identity.ClientParams.SyncPermissions {
if !identity.ClientParams.SyncPermissions {
return nil
}
pkg/services/authn/authnimpl/sync/permission_sync_test.go
+8 -24
View File
@@ -17,56 +17,40 @@ func TestPermissionsSync_SyncPermission(t *testing.T) {
type testCase struct {
name string
identity *authn.Identity
rbacDisabled bool
expectedPermissions []accesscontrol.Permission
}
testCases := []testCase{
{
name: "enriches the identity successfully when SyncPermissions is true",
identity: &authn.Identity{ID: "user:2", OrgID: 1, ClientParams: authn.ClientParams{SyncPermissions: true}},
rbacDisabled: false,
name: "enriches the identity successfully when SyncPermissions is true",
identity: &authn.Identity{ID: "user:2", OrgID: 1, ClientParams: authn.ClientParams{SyncPermissions: true}},
expectedPermissions: []accesscontrol.Permission{
{Action: accesscontrol.ActionUsersRead},
},
},
{
name: "does not load the permissions when SyncPermissions is false",
identity: &authn.Identity{ID: "user:2", OrgID: 1, ClientParams: authn.ClientParams{SyncPermissions: true}},
rbacDisabled: false,
name: "does not load the permissions when SyncPermissions is false",
identity: &authn.Identity{ID: "user:2", OrgID: 1, ClientParams: authn.ClientParams{SyncPermissions: true}},
expectedPermissions: []accesscontrol.Permission{
{Action: accesscontrol.ActionUsersRead},
},
},
{
name: "does not load the permissions when RBAC is disabled",
rbacDisabled: true,
identity: &authn.Identity{ID: "user:2", OrgID: 1, ClientParams: authn.ClientParams{SyncPermissions: true}},
expectedPermissions: []accesscontrol.Permission{},
},
}
for _, tt := range testCases {
t.Run(tt.name, func(t *testing.T) {
s := setupTestEnv(tt.rbacDisabled)
s := setupTestEnv()
err := s.SyncPermissionsHook(context.Background(), tt.identity, &authn.Request{})
require.NoError(t, err)
if !tt.rbacDisabled {
assert.Equal(t, 1, len(tt.identity.Permissions))
assert.Equal(t, accesscontrol.GroupScopesByAction(tt.expectedPermissions), tt.identity.Permissions[tt.identity.OrgID])
} else {
assert.Equal(t, 0, len(tt.identity.Permissions))
}
assert.Equal(t, 1, len(tt.identity.Permissions))
assert.Equal(t, accesscontrol.GroupScopesByAction(tt.expectedPermissions), tt.identity.Permissions[tt.identity.OrgID])
})
}
}
func setupTestEnv(rbacDisabled bool) *PermissionsSync {
func setupTestEnv() *PermissionsSync {
acMock := &acmock.Mock{
IsDisabledFunc: func() bool {
return rbacDisabled
},
GetUserPermissionsFunc: func(ctx context.Context, siu *user.SignedInUser, o accesscontrol.Options) ([]accesscontrol.Permission, error) {
return []accesscontrol.Permission{
{Action: accesscontrol.ActionUsersRead},