public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Extsvcacc: Split permission scope (#111491)

Browse Source 
* Extsvcacc: Split permission scope

* Fix integration test

* Trigger CI/CD pipeline

* Change extsvc permission comparing

* Recreate unsplit permissions
This commit is contained in:
Gabriel MABILLE
2025-09-24 13:25:44 +02:00
committed by GitHub
parent b63ba0269f
commit a98870f8f9
5 changed files with 125 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/database/externalservices_test.go
+92
View File
@@ -249,3 +249,95 @@ func TestIntegrationAccessControlStore_DeleteExternalServiceRole(t *testing.T) {
})
}
}
func Test_permissionDiff(t *testing.T) {
tests := []struct {
name string
previous []accesscontrol.Permission
new []accesscontrol.Permission
wantAdded []accesscontrol.Permission
wantRemoved []accesscontrol.Permission
}{
{
name: "no changes",
previous: []accesscontrol.Permission{
{ID: 1, Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
{ID: 2, Action: "users:write", Scope: "users:id:2", Kind: "users", Attribute: "id", Identifier: "2"},
},
new: []accesscontrol.Permission{
{Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
{Action: "users:write", Scope: "users:id:2", Kind: "users", Attribute: "id", Identifier: "2"},
},
wantAdded: []accesscontrol.Permission{},
wantRemoved: []accesscontrol.Permission{},
},
{
name: "add new permissions",
previous: []accesscontrol.Permission{
{ID: 1, Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
},
new: []accesscontrol.Permission{
{Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
{Action: "users:write", Scope: "users:id:2", Kind: "users", Attribute: "id", Identifier: "2"},
},
wantAdded: []accesscontrol.Permission{
{Action: "users:write", Scope: "users:id:2", Kind: "users", Attribute: "id", Identifier: "2"},
},
wantRemoved: []accesscontrol.Permission{},
},
{
name: "remove existing permissions",
previous: []accesscontrol.Permission{
{ID: 1, Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
{ID: 2, Action: "users:write", Scope: "users:id:2", Kind: "users", Attribute: "id", Identifier: "2"},
},
new: []accesscontrol.Permission{
{Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
},
wantAdded: []accesscontrol.Permission{},
wantRemoved: []accesscontrol.Permission{
{ID: 2, Action: "users:write", Scope: "users:id:2"},
},
},
{
name: "add and remove permissions",
previous: []accesscontrol.Permission{
{ID: 1, Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
{ID: 2, Action: "users:write", Scope: "users:id:2", Kind: "users", Attribute: "id", Identifier: "2"},
},
new: []accesscontrol.Permission{
{Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
{Action: "users:delete", Scope: "users:id:3", Kind: "users", Attribute: "id", Identifier: "3"},
},
wantAdded: []accesscontrol.Permission{
{Action: "users:delete", Scope: "users:id:3", Kind: "users", Attribute: "id", Identifier: "3"},
},
wantRemoved: []accesscontrol.Permission{
{ID: 2, Action: "users:write", Scope: "users:id:2"},
},
},
{
name: "recreate unsplit permissions",
previous: []accesscontrol.Permission{
{ID: 1, Action: "users:read", Scope: "users:id:1"},
},
new: []accesscontrol.Permission{
{Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
},
wantAdded: []accesscontrol.Permission{
{Action: "users:read", Scope: "users:id:1", Kind: "users", Attribute: "id", Identifier: "1"},
},
wantRemoved: []accesscontrol.Permission{
{ID: 1, Action: "users:read", Scope: "users:id:1"},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
gotAdded, gotRemoved := permissionDiff(tt.previous, tt.new)
require.ElementsMatch(t, tt.wantAdded, gotAdded, "added permissions do not match")
require.ElementsMatch(t, tt.wantRemoved, gotRemoved, "removed permissions do not match")
})
}
}