public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

grafana-iam: Implement resourcepermission get (#110256)

Browse Source 
* resource permissions get

* address review feedback

* address comments
- read using rp name
- narrow by scope and actionsets
- update sql tests

* align with verb simplification

* keep original format to avoid conflicts

* add sqltests

* cleanup

* Remove unecessary errors

* Move query template to queries

* Use splitN to make sure we have three parts

* Revert user permission management for now. We don't need it

* Revert error change

* group permissions by resource

* extract parse scope

* Move sql_test

* Move & test parseScope

* Add tests to getResourcePermission

* Linting

* Use namespace

* Add test to the backend

* Ongoing tests

* Remove pagination, fix query boolean, insert basic role binding

* Linting

* Straightened the created and updated times

* error handling and uniformization with other backend

* Restore comments to avoid later conflicts

* Integration testing

* switch to function, no need to make it a method

* isServiceAccount should default to FALSE instead of TRUE :surprised:

* PR feedback

* Sort spec permissions

* Shouldn't happen but double proofing

---------

Co-authored-by: Gabriel Mabille <gabriel.mabille@grafana.com>
This commit is contained in:
mohammad-hamid
2025-09-04 17:14:15 +02:00
committed by GitHub
co-authored by Gabriel Mabille
parent 40bf167cb7
commit abcdf20105
16 changed files with 1075 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/iam/resourcepermission/testdata/mysql--resource_permission_query-basic_query.sql
Vendored Executable
+18
View File
@@ -0,0 +1,18 @@
SELECT
p.id, p.action, p.scope, p.created, p.updated,
r.name as role_name,
COALESCE(u.uid, t.uid, br.role) as subject_uid,
CASE WHEN u.uid IS NOT NULL THEN 'user'
WHEN t.uid IS NOT NULL THEN 'team'
ELSE 'builtin_role' END as subject_type,
COALESCE(u.is_service_account, FALSE) as is_service_account
FROM `grafana`.`permission` p
INNER JOIN `grafana`.`role` r ON p.role_id = r.id
LEFT JOIN `grafana`.`user_role` ur ON r.id = ur.role_id AND ur.org_id = r.org_id
LEFT JOIN `grafana`.`user` u ON ur.user_id = u.id
LEFT JOIN `grafana`.`team_role` tr ON r.id = tr.role_id AND tr.org_id = r.org_id
LEFT JOIN `grafana`.`team` t ON tr.team_id = t.id
LEFT JOIN `grafana`.`builtin_role` br ON r.id = br.role_id
WHERE r.name LIKE 'managed:%'
AND (u.uid IS NOT NULL OR t.uid IS NOT NULL OR br.role IS NOT NULL)
ORDER BY p.id
pkg/registry/apis/iam/resourcepermission/testdata/mysql--resource_permission_query-with_all_fields.sql
Vendored Executable
+21
View File
@@ -0,0 +1,21 @@
SELECT
p.id, p.action, p.scope, p.created, p.updated,
r.name as role_name,
COALESCE(u.uid, t.uid, br.role) as subject_uid,
CASE WHEN u.uid IS NOT NULL THEN 'user'
WHEN t.uid IS NOT NULL THEN 'team'
ELSE 'builtin_role' END as subject_type,
COALESCE(u.is_service_account, FALSE) as is_service_account
FROM `grafana`.`permission` p
INNER JOIN `grafana`.`role` r ON p.role_id = r.id
LEFT JOIN `grafana`.`user_role` ur ON r.id = ur.role_id AND ur.org_id = r.org_id
LEFT JOIN `grafana`.`user` u ON ur.user_id = u.id
LEFT JOIN `grafana`.`team_role` tr ON r.id = tr.role_id AND tr.org_id = r.org_id
LEFT JOIN `grafana`.`team` t ON tr.team_id = t.id
LEFT JOIN `grafana`.`builtin_role` br ON r.id = br.role_id
WHERE r.name LIKE 'managed:%'
AND p.action IN ('folders:admin', 'folders:edit', 'folders:view')
AND (u.uid IS NOT NULL OR t.uid IS NOT NULL OR br.role IS NOT NULL)
AND COALESCE(ur.org_id, tr.org_id, r.org_id) = 3
AND p.scope = '123'
ORDER BY p.id
pkg/registry/apis/iam/resourcepermission/testdata/postgres--resource_permission_query-basic_query.sql
Vendored Executable
+18
View File
@@ -0,0 +1,18 @@
SELECT
p.id, p.action, p.scope, p.created, p.updated,
r.name as role_name,
COALESCE(u.uid, t.uid, br.role) as subject_uid,
CASE WHEN u.uid IS NOT NULL THEN 'user'
WHEN t.uid IS NOT NULL THEN 'team'
ELSE 'builtin_role' END as subject_type,
COALESCE(u.is_service_account, FALSE) as is_service_account
FROM "grafana"."permission" p
INNER JOIN "grafana"."role" r ON p.role_id = r.id
LEFT JOIN "grafana"."user_role" ur ON r.id = ur.role_id AND ur.org_id = r.org_id
LEFT JOIN "grafana"."user" u ON ur.user_id = u.id
LEFT JOIN "grafana"."team_role" tr ON r.id = tr.role_id AND tr.org_id = r.org_id
LEFT JOIN "grafana"."team" t ON tr.team_id = t.id
LEFT JOIN "grafana"."builtin_role" br ON r.id = br.role_id
WHERE r.name LIKE 'managed:%'
AND (u.uid IS NOT NULL OR t.uid IS NOT NULL OR br.role IS NOT NULL)
ORDER BY p.id
pkg/registry/apis/iam/resourcepermission/testdata/postgres--resource_permission_query-with_all_fields.sql
Vendored Executable
+21
View File
@@ -0,0 +1,21 @@
SELECT
p.id, p.action, p.scope, p.created, p.updated,
r.name as role_name,
COALESCE(u.uid, t.uid, br.role) as subject_uid,
CASE WHEN u.uid IS NOT NULL THEN 'user'
WHEN t.uid IS NOT NULL THEN 'team'
ELSE 'builtin_role' END as subject_type,
COALESCE(u.is_service_account, FALSE) as is_service_account
FROM "grafana"."permission" p
INNER JOIN "grafana"."role" r ON p.role_id = r.id
LEFT JOIN "grafana"."user_role" ur ON r.id = ur.role_id AND ur.org_id = r.org_id
LEFT JOIN "grafana"."user" u ON ur.user_id = u.id
LEFT JOIN "grafana"."team_role" tr ON r.id = tr.role_id AND tr.org_id = r.org_id
LEFT JOIN "grafana"."team" t ON tr.team_id = t.id
LEFT JOIN "grafana"."builtin_role" br ON r.id = br.role_id
WHERE r.name LIKE 'managed:%'
AND p.action IN ('folders:admin', 'folders:edit', 'folders:view')
AND (u.uid IS NOT NULL OR t.uid IS NOT NULL OR br.role IS NOT NULL)
AND COALESCE(ur.org_id, tr.org_id, r.org_id) = 3
AND p.scope = '123'
ORDER BY p.id
pkg/registry/apis/iam/resourcepermission/testdata/sqlite--resource_permission_query-basic_query.sql
Vendored Executable
+18
View File
@@ -0,0 +1,18 @@
SELECT
p.id, p.action, p.scope, p.created, p.updated,
r.name as role_name,
COALESCE(u.uid, t.uid, br.role) as subject_uid,
CASE WHEN u.uid IS NOT NULL THEN 'user'
WHEN t.uid IS NOT NULL THEN 'team'
ELSE 'builtin_role' END as subject_type,
COALESCE(u.is_service_account, FALSE) as is_service_account
FROM "grafana"."permission" p
INNER JOIN "grafana"."role" r ON p.role_id = r.id
LEFT JOIN "grafana"."user_role" ur ON r.id = ur.role_id AND ur.org_id = r.org_id
LEFT JOIN "grafana"."user" u ON ur.user_id = u.id
LEFT JOIN "grafana"."team_role" tr ON r.id = tr.role_id AND tr.org_id = r.org_id
LEFT JOIN "grafana"."team" t ON tr.team_id = t.id
LEFT JOIN "grafana"."builtin_role" br ON r.id = br.role_id
WHERE r.name LIKE 'managed:%'
AND (u.uid IS NOT NULL OR t.uid IS NOT NULL OR br.role IS NOT NULL)
ORDER BY p.id
pkg/registry/apis/iam/resourcepermission/testdata/sqlite--resource_permission_query-with_all_fields.sql
Vendored Executable
+21
View File
@@ -0,0 +1,21 @@
SELECT
p.id, p.action, p.scope, p.created, p.updated,
r.name as role_name,
COALESCE(u.uid, t.uid, br.role) as subject_uid,
CASE WHEN u.uid IS NOT NULL THEN 'user'
WHEN t.uid IS NOT NULL THEN 'team'
ELSE 'builtin_role' END as subject_type,
COALESCE(u.is_service_account, FALSE) as is_service_account
FROM "grafana"."permission" p
INNER JOIN "grafana"."role" r ON p.role_id = r.id
LEFT JOIN "grafana"."user_role" ur ON r.id = ur.role_id AND ur.org_id = r.org_id
LEFT JOIN "grafana"."user" u ON ur.user_id = u.id
LEFT JOIN "grafana"."team_role" tr ON r.id = tr.role_id AND tr.org_id = r.org_id
LEFT JOIN "grafana"."team" t ON tr.team_id = t.id
LEFT JOIN "grafana"."builtin_role" br ON r.id = br.role_id
WHERE r.name LIKE 'managed:%'
AND p.action IN ('folders:admin', 'folders:edit', 'folders:view')
AND (u.uid IS NOT NULL OR t.uid IS NOT NULL OR br.role IS NOT NULL)
AND COALESCE(ur.org_id, tr.org_id, r.org_id) = 3
AND p.scope = '123'
ORDER BY p.id