AuthZ service: Expand the logic to also evaluate action sets (#112124)
* expand AuthZ service logic to also evaluate action sets * handle folder creation * fix test * simplify mapper code Co-authored-by: gamab <gabi.mabs@gmail.com> * more accurate variable name Co-authored-by: gamab <gabi.mabs@gmail.com> * break alerting import cycle * Apply suggestion from @gamab --------- Co-authored-by: gamab <gabi.mabs@gmail.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Ieva
co-authored by
gamab
Gabriel MABILLE
gamab
Gabriel MABILLE
parent
bb1d7d9070
commit
acbbfde256
@@ -5,19 +5,17 @@ import (
|
||||
"github.com/grafana/grafana/pkg/services/dashboards"
|
||||
"github.com/grafana/grafana/pkg/services/datasources"
|
||||
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
||||
ac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
|
||||
"github.com/grafana/grafana/pkg/services/ngalert/models"
|
||||
"github.com/grafana/grafana/pkg/services/org"
|
||||
)
|
||||
|
||||
const AlertRolesGroup = "Alerting"
|
||||
|
||||
var (
|
||||
rulesReaderRole = accesscontrol.RoleRegistration{
|
||||
Role: accesscontrol.RoleDTO{
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.rules:reader",
|
||||
DisplayName: "Rules Reader",
|
||||
Description: "Read alert rules in all Grafana folders and external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingRuleRead,
|
||||
@@ -47,7 +45,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.rules:writer",
|
||||
DisplayName: "Rules Writer",
|
||||
Description: "Add, update, and delete rules in any Grafana folder and external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(rulesReaderRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingRuleCreate,
|
||||
@@ -82,7 +80,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.instances:reader",
|
||||
DisplayName: "Instances and Silences Reader",
|
||||
Description: "Read instances and silences of Grafana and external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingInstanceRead,
|
||||
@@ -100,7 +98,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.instances:writer",
|
||||
DisplayName: "Silences Writer",
|
||||
Description: "Add and update silences in Grafana and external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(instancesReaderRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingInstanceCreate,
|
||||
@@ -121,9 +119,9 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.receivers:reader",
|
||||
DisplayName: "Contact Point Reader",
|
||||
Description: "Read all contact points in Grafana",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingReceiversRead, Scope: ac.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversRead, Scope: models.ScopeReceiversAll},
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -133,7 +131,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.receivers:creator",
|
||||
DisplayName: "Contact Point Creator",
|
||||
Description: "Create new contact points in Grafana",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingReceiversCreate},
|
||||
{Action: accesscontrol.ActionAlertingReceiversTest},
|
||||
@@ -146,10 +144,10 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.receivers:writer",
|
||||
DisplayName: "Contact Point Writer",
|
||||
Description: "Create, update, and delete all contact points in Grafana",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(receiversReaderRole.Role.Permissions, receiversCreatorRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingReceiversUpdate, Scope: ac.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversDelete, Scope: ac.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversAll},
|
||||
}),
|
||||
},
|
||||
}
|
||||
@@ -159,7 +157,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.templates:reader",
|
||||
DisplayName: "Templates Reader",
|
||||
Description: "Read all templates in Grafana alerting",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingNotificationsTemplatesRead},
|
||||
},
|
||||
@@ -171,7 +169,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.templates:writer",
|
||||
DisplayName: "Templates Writer",
|
||||
Description: "Create, update, and delete all templates in Grafana alerting",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(templatesReaderRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingNotificationsTemplatesWrite},
|
||||
{Action: accesscontrol.ActionAlertingNotificationsTemplatesDelete},
|
||||
@@ -184,7 +182,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.time-intervals:reader",
|
||||
DisplayName: "Time Intervals Reader",
|
||||
Description: "Read all time intervals in Grafana alerting",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingNotificationsTimeIntervalsRead},
|
||||
},
|
||||
@@ -196,7 +194,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.time-intervals:writer",
|
||||
DisplayName: "Time Intervals Writer",
|
||||
Description: "Create, update, and delete all time intervals in Grafana alerting",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(timeIntervalsReaderRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingNotificationsTimeIntervalsWrite},
|
||||
{Action: accesscontrol.ActionAlertingNotificationsTimeIntervalsDelete},
|
||||
@@ -209,7 +207,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.routes:reader",
|
||||
DisplayName: "Notification Policies Reader",
|
||||
Description: "Read all notification policies in Grafana alerting",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions([]accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingRoutesRead},
|
||||
}),
|
||||
@@ -221,7 +219,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.routes:writer",
|
||||
DisplayName: "Notification Policies Writer",
|
||||
Description: "Update and reset notification policies in Grafana alerting",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(routesReaderRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingRoutesWrite},
|
||||
}),
|
||||
@@ -233,7 +231,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.notifications:reader",
|
||||
DisplayName: "Notifications Reader",
|
||||
Description: "Read notification policies and contact points in Grafana and external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(receiversReaderRole.Role.Permissions, templatesReaderRole.Role.Permissions, timeIntervalsReaderRole.Role.Permissions, routesReaderRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingNotificationsRead, // TODO remove when we decide tò limit access to raw config API
|
||||
@@ -251,7 +249,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.notifications:writer",
|
||||
DisplayName: "Notifications Writer",
|
||||
Description: "Add, update, and delete contact points and notification policies in Grafana and external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(notificationsReaderRole.Role.Permissions, receiversWriterRole.Role.Permissions, templatesWriterRole.Role.Permissions, timeIntervalsWriterRole.Role.Permissions, routesWriterRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingNotificationsWrite, // TODO remove when we decide tò limit access to raw config API
|
||||
@@ -269,7 +267,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting:reader",
|
||||
DisplayName: "Full read-only access",
|
||||
Description: "Read alert rules, instances, silences, contact points, and notification policies in Grafana and all external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(rulesReaderRole.Role.Permissions, instancesReaderRole.Role.Permissions, notificationsReaderRole.Role.Permissions),
|
||||
},
|
||||
Grants: []string{string(org.RoleViewer)},
|
||||
@@ -280,7 +278,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting:writer",
|
||||
DisplayName: "Full write access",
|
||||
Description: "Add, update and delete alert rules, instances, silences, contact points, and notification policies in Grafana and all external providers",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(rulesWriterRole.Role.Permissions, instancesWriterRole.Role.Permissions, notificationsWriterRole.Role.Permissions),
|
||||
},
|
||||
Grants: []string{string(org.RoleEditor)},
|
||||
@@ -291,11 +289,11 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting:admin",
|
||||
DisplayName: "Full admin access",
|
||||
Description: "Full write access in Grafana and all external providers, including their permissions and secrets",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: accesscontrol.ConcatPermissions(alertingWriterRole.Role.Permissions, []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionAlertingReceiversPermissionsRead, Scope: ac.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversPermissionsWrite, Scope: ac.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversReadSecrets, Scope: ac.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversPermissionsRead, Scope: models.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversPermissionsWrite, Scope: models.ScopeReceiversAll},
|
||||
{Action: accesscontrol.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversAll},
|
||||
}),
|
||||
},
|
||||
Grants: []string{string(org.RoleAdmin)},
|
||||
@@ -306,7 +304,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.provisioning:writer",
|
||||
DisplayName: "Access to alert rules provisioning API",
|
||||
Description: "Manage all alert rules, contact points, notification policies, silences, etc. in the organization via provisioning API.",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingProvisioningRead, // organization scope
|
||||
@@ -340,7 +338,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.provisioning.secrets:reader",
|
||||
DisplayName: "Read via Provisioning API + Export Secrets",
|
||||
Description: "Read all alert rules, contact points, notification policies, silences, etc. in the organization via provisioning API and use export with decrypted secrets",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingProvisioningReadSecrets, // organization scope
|
||||
@@ -364,7 +362,7 @@ var (
|
||||
Name: accesscontrol.FixedRolePrefix + "alerting.provisioning.provenance:writer",
|
||||
DisplayName: "Set provisioning status",
|
||||
Description: "Set provisioning status for alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer)",
|
||||
Group: AlertRolesGroup,
|
||||
Group: models.AlertRolesGroup,
|
||||
Permissions: []accesscontrol.Permission{
|
||||
{
|
||||
Action: accesscontrol.ActionAlertingProvisioningSetStatus, // organization scope
|
||||
|
||||
@@ -2,52 +2,10 @@ package accesscontrol
|
||||
|
||||
import (
|
||||
"context"
|
||||
// #nosec G505 Used only for shortening the uid, not for security purposes.
|
||||
"crypto/sha1"
|
||||
"encoding/hex"
|
||||
|
||||
"github.com/grafana/grafana/pkg/apimachinery/identity"
|
||||
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
|
||||
"github.com/grafana/grafana/pkg/services/ngalert/models"
|
||||
"github.com/grafana/grafana/pkg/util"
|
||||
)
|
||||
|
||||
const (
|
||||
ScopeReceiversRoot = "receivers"
|
||||
)
|
||||
|
||||
var (
|
||||
ScopeReceiversProvider = ReceiverScopeProvider{ac.NewScopeProvider(ScopeReceiversRoot)}
|
||||
ScopeReceiversAll = ScopeReceiversProvider.GetResourceAllScope()
|
||||
)
|
||||
|
||||
type ReceiverScopeProvider struct {
|
||||
ac.ScopeProvider
|
||||
}
|
||||
|
||||
func (p ReceiverScopeProvider) GetResourceScopeUID(uid string) string {
|
||||
return ScopeReceiversProvider.ScopeProvider.GetResourceScopeUID(p.GetResourceIDFromUID(uid))
|
||||
}
|
||||
|
||||
// GetResourceIDFromUID converts a receiver uid to a resource id. This is necessary as resource ids are limited to 40 characters.
|
||||
// If the uid is already less than or equal to 40 characters, it is returned as is.
|
||||
func (p ReceiverScopeProvider) GetResourceIDFromUID(uid string) string {
|
||||
if len(uid) <= util.MaxUIDLength {
|
||||
return uid
|
||||
}
|
||||
// #nosec G505 Used only for shortening the uid, not for security purposes.
|
||||
h := sha1.New()
|
||||
h.Write([]byte(uid))
|
||||
return hex.EncodeToString(h.Sum(nil))
|
||||
}
|
||||
|
||||
// ReceiverPermission is a type for representing a receiver permission.
|
||||
type ReceiverPermission string
|
||||
|
||||
const (
|
||||
ReceiverPermissionView ReceiverPermission = "View"
|
||||
ReceiverPermissionEdit ReceiverPermission = "Edit"
|
||||
ReceiverPermissionAdmin ReceiverPermission = "Admin"
|
||||
)
|
||||
|
||||
var (
|
||||
@@ -65,19 +23,19 @@ var (
|
||||
// Asserts read-only access to all redacted receivers.
|
||||
readRedactedAllReceiversEval = ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingNotificationsRead),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversRead, ScopeReceiversAll),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversRead, models.ScopeReceiversAll),
|
||||
readDecryptedAllReceiversEval,
|
||||
)
|
||||
// Asserts read-only access to all decrypted receivers.
|
||||
readDecryptedAllReceiversEval = ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversReadSecrets, ScopeReceiversAll),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversReadSecrets, models.ScopeReceiversAll),
|
||||
)
|
||||
|
||||
// Asserts read-only access to a specific redacted receiver.
|
||||
readRedactedReceiverEval = func(uid string) ac.Evaluator {
|
||||
return ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingNotificationsRead),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversRead, ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversRead, models.ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
readDecryptedReceiverEval(uid),
|
||||
)
|
||||
}
|
||||
@@ -85,7 +43,7 @@ var (
|
||||
// Asserts read-only access to a specific decrypted receiver.
|
||||
readDecryptedReceiverEval = func(uid string) ac.Evaluator {
|
||||
return ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversReadSecrets, ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversReadSecrets, models.ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
)
|
||||
}
|
||||
|
||||
@@ -126,14 +84,14 @@ var (
|
||||
// Asserts update access to all receivers.
|
||||
updateAllReceiversEval = ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingNotificationsWrite),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversUpdate, ScopeReceiversAll),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversUpdate, models.ScopeReceiversAll),
|
||||
)
|
||||
|
||||
// Asserts update access to a specific receiver.
|
||||
updateReceiverEval = func(uid string) ac.Evaluator {
|
||||
return ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingNotificationsWrite),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversUpdate, ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversUpdate, models.ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
)
|
||||
}
|
||||
|
||||
@@ -148,14 +106,14 @@ var (
|
||||
// Asserts delete access to all receivers.
|
||||
deleteAllReceiversEval = ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingNotificationsWrite),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversDelete, ScopeReceiversAll),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversDelete, models.ScopeReceiversAll),
|
||||
)
|
||||
|
||||
// Asserts delete access to a specific receiver.
|
||||
deleteReceiverEval = func(uid string) ac.Evaluator {
|
||||
return ac.EvalAny(
|
||||
ac.EvalPermission(ac.ActionAlertingNotificationsWrite),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversDelete, ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversDelete, models.ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
)
|
||||
}
|
||||
|
||||
@@ -169,15 +127,15 @@ var (
|
||||
|
||||
// Asserts resource permissions access to all receivers.
|
||||
permissionsAllReceiversEval = ac.EvalAll(
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsRead, ScopeReceiversAll),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsWrite, ScopeReceiversAll),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsRead, models.ScopeReceiversAll),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsWrite, models.ScopeReceiversAll),
|
||||
)
|
||||
|
||||
// Asserts resource permissions access to a specific receiver.
|
||||
permissionsReceiverEval = func(uid string) ac.Evaluator {
|
||||
return ac.EvalAll(
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsRead, ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsWrite, ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsRead, models.ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
ac.EvalPermission(ac.ActionAlertingReceiversPermissionsWrite, models.ScopeReceiversProvider.GetResourceScopeUID(uid)),
|
||||
)
|
||||
}
|
||||
)
|
||||
|
||||
@@ -85,7 +85,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
// Receiver read.
|
||||
{
|
||||
name: "global receiver reader should have no elevated permissions",
|
||||
user: newEmptyUser(ac.Permission{Action: ac.ActionAlertingReceiversRead, Scope: ScopeReceiversAll}),
|
||||
user: newEmptyUser(ac.Permission{Action: ac.ActionAlertingReceiversRead, Scope: models.ScopeReceiversAll}),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
recv2.UID: permissions(),
|
||||
@@ -94,7 +94,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
},
|
||||
{
|
||||
name: "global receiver secret reader should have secret permissions",
|
||||
user: newEmptyUser(ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversAll}),
|
||||
user: newEmptyUser(ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversAll}),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionReadSecret),
|
||||
recv2.UID: permissions(models.ReceiverPermissionReadSecret),
|
||||
@@ -104,8 +104,8 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "per-receiver secret reader should have per-receiver",
|
||||
user: newEmptyUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionReadSecret),
|
||||
@@ -173,7 +173,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
// Receiver update.
|
||||
{
|
||||
name: "global receiver update should have write but no delete",
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversAll}),
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversAll}),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionWrite),
|
||||
recv2.UID: permissions(models.ReceiverPermissionWrite),
|
||||
@@ -183,8 +183,8 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "per-receiver update should have per-receiver write but no delete",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionWrite),
|
||||
@@ -195,8 +195,8 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "per-receiver update should require read",
|
||||
user: newEmptyUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
@@ -207,7 +207,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
// Receiver delete.
|
||||
{
|
||||
name: "global receiver delete should have delete but no write",
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversAll}),
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversAll}),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionDelete),
|
||||
recv2.UID: permissions(models.ReceiverPermissionDelete),
|
||||
@@ -217,8 +217,8 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "per-receiver delete should have per-receiver delete but no write",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionDelete),
|
||||
@@ -229,8 +229,8 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "per-receiver delete should require read",
|
||||
user: newEmptyUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
@@ -241,7 +241,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
// Receiver admin.
|
||||
{
|
||||
name: "receiver read permissions alone can't admin",
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: ScopeReceiversAll}),
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: models.ScopeReceiversAll}),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
recv2.UID: permissions(),
|
||||
@@ -250,7 +250,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
},
|
||||
{
|
||||
name: "receiver write permissions alone can't admin",
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: ScopeReceiversAll}),
|
||||
user: newViewUser(ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: models.ScopeReceiversAll}),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
recv2.UID: permissions(),
|
||||
@@ -260,8 +260,8 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "global receiver read + write permissions can admin",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: ScopeReceiversAll},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: ScopeReceiversAll},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: models.ScopeReceiversAll},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: models.ScopeReceiversAll},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionAdmin),
|
||||
@@ -272,10 +272,10 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "per-receiver read + write permissions should have per-receiver admin",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionAdmin),
|
||||
@@ -286,10 +286,10 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "per-receiver admin should require read",
|
||||
user: newEmptyUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsRead, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversPermissionsWrite, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
@@ -302,7 +302,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
name: "legacy provisioning secret read, receiver write",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingProvisioningReadSecrets},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
@@ -319,7 +319,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
name: "legacy provisioning secret read, receiver delete",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingProvisioningReadSecrets},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(),
|
||||
@@ -336,7 +336,7 @@ func TestReceiverAccess(t *testing.T) {
|
||||
name: "legacy write, receiver secret",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingNotificationsWrite},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionWrite, models.ReceiverPermissionDelete),
|
||||
@@ -347,12 +347,12 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "mixed secret / delete / write",
|
||||
user: newViewUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionReadSecret, models.ReceiverPermissionWrite),
|
||||
@@ -363,12 +363,12 @@ func TestReceiverAccess(t *testing.T) {
|
||||
{
|
||||
name: "mixed requires read",
|
||||
user: newEmptyUser(
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversReadSecrets, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversUpdate, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID)},
|
||||
ac.Permission{Action: ac.ActionAlertingReceiversDelete, Scope: models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID)},
|
||||
),
|
||||
expected: map[string]models.ReceiverPermissionSet{
|
||||
recv1.UID: permissions(models.ReceiverPermissionReadSecret, models.ReceiverPermissionWrite),
|
||||
@@ -404,7 +404,7 @@ func newEmptyUser(permissions ...ac.Permission) identity.Requester {
|
||||
|
||||
func newViewUser(permissions ...ac.Permission) identity.Requester {
|
||||
return ac.BackgroundUser("test", orgID, org.RoleNone, append([]ac.Permission{
|
||||
{Action: ac.ActionAlertingReceiversRead, Scope: ScopeReceiversAll},
|
||||
{Action: ac.ActionAlertingReceiversRead, Scope: models.ScopeReceiversAll},
|
||||
{Action: ac.ActionAlertingNotificationsRead},
|
||||
}, permissions...))
|
||||
}
|
||||
|
||||
@@ -85,7 +85,7 @@ func getReceiverScopesForRules(rules models.RulesGroup) []string {
|
||||
var result []string
|
||||
for _, rule := range rules {
|
||||
for _, ns := range rule.NotificationSettings {
|
||||
scope := ScopeReceiversProvider.GetResourceScopeUID(legacy_storage.NameToUid(ns.Receiver))
|
||||
scope := models.ScopeReceiversProvider.GetResourceScopeUID(legacy_storage.NameToUid(ns.Receiver))
|
||||
if _, ok := scopesMap[scope]; ok {
|
||||
continue
|
||||
}
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
package models
|
||||
|
||||
import (
|
||||
// #nosec G505 Used only for shortening the uid, not for security purposes.
|
||||
"crypto/sha1"
|
||||
"encoding/hex"
|
||||
|
||||
"github.com/grafana/grafana/pkg/services/accesscontrol"
|
||||
"github.com/grafana/grafana/pkg/util"
|
||||
)
|
||||
|
||||
const (
|
||||
ScopeReceiversRoot = "receivers"
|
||||
AlertRolesGroup = "Alerting"
|
||||
|
||||
PermissionView ReceiverPermission = "View"
|
||||
PermissionEdit ReceiverPermission = "Edit"
|
||||
PermissionAdmin ReceiverPermission = "Admin"
|
||||
)
|
||||
|
||||
var (
|
||||
ScopeReceiversProvider = ReceiverScopeProvider{accesscontrol.NewScopeProvider(ScopeReceiversRoot)}
|
||||
ScopeReceiversAll = ScopeReceiversProvider.GetResourceAllScope()
|
||||
)
|
||||
|
||||
type ReceiverScopeProvider struct {
|
||||
accesscontrol.ScopeProvider
|
||||
}
|
||||
|
||||
func (p ReceiverScopeProvider) GetResourceScopeUID(uid string) string {
|
||||
return ScopeReceiversProvider.ScopeProvider.GetResourceScopeUID(p.GetResourceIDFromUID(uid))
|
||||
}
|
||||
|
||||
// GetResourceIDFromUID converts a receiver uid to a resource id. This is necessary as resource ids are limited to 40 characters.
|
||||
// If the uid is already less than or equal to 40 characters, it is returned as is.
|
||||
func (p ReceiverScopeProvider) GetResourceIDFromUID(uid string) string {
|
||||
if len(uid) <= util.MaxUIDLength {
|
||||
return uid
|
||||
}
|
||||
// #nosec G505 Used only for shortening the uid, not for security purposes.
|
||||
h := sha1.New()
|
||||
h.Write([]byte(uid))
|
||||
return hex.EncodeToString(h.Sum(nil))
|
||||
}
|
||||
@@ -117,7 +117,7 @@ func TestIntegrationReceiverService_DecryptRedact(t *testing.T) {
|
||||
Permissions: map[int64]map[string][]string{
|
||||
1: {
|
||||
accesscontrol.ActionAlertingNotificationsRead: nil,
|
||||
accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll},
|
||||
accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll},
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -343,7 +343,7 @@ func TestReceiverService_Create(t *testing.T) {
|
||||
}}
|
||||
decryptUser := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{
|
||||
1: {
|
||||
accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll},
|
||||
accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll},
|
||||
},
|
||||
}}
|
||||
|
||||
@@ -556,7 +556,7 @@ func TestReceiverService_Update(t *testing.T) {
|
||||
}}
|
||||
decryptUser := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{
|
||||
1: {
|
||||
accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll},
|
||||
accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll},
|
||||
},
|
||||
}}
|
||||
|
||||
@@ -949,30 +949,30 @@ func TestReceiverServiceAC_Read(t *testing.T) {
|
||||
},
|
||||
{
|
||||
name: "global receivers permissions - read all",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversRead: {ac.ScopeReceiversAll}},
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversRead: {models.ScopeReceiversAll}},
|
||||
existing: allReceivers(),
|
||||
visible: allReceivers(),
|
||||
},
|
||||
{
|
||||
name: "single receivers permissions - read some",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversRead: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
}},
|
||||
existing: allReceivers(),
|
||||
visible: []models.Receiver{recv1, recv3},
|
||||
},
|
||||
{
|
||||
name: "global receivers secret permissions - read all",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll}},
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll}},
|
||||
existing: allReceivers(),
|
||||
visible: allReceivers(),
|
||||
},
|
||||
{
|
||||
name: "single receivers secret permissions - read some",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversReadSecrets: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
}},
|
||||
existing: allReceivers(),
|
||||
visible: []models.Receiver{recv1, recv3},
|
||||
@@ -1175,15 +1175,15 @@ func TestReceiverServiceAC_Update(t *testing.T) {
|
||||
},
|
||||
{
|
||||
name: "global receivers permissions - not authorized without read",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {ac.ScopeReceiversAll}},
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {models.ScopeReceiversAll}},
|
||||
existing: allReceivers(),
|
||||
hasAccess: nil,
|
||||
},
|
||||
{
|
||||
name: "single receivers permissions - not authorized without read",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
}},
|
||||
existing: allReceivers(),
|
||||
hasAccess: nil,
|
||||
@@ -1196,7 +1196,7 @@ func TestReceiverServiceAC_Update(t *testing.T) {
|
||||
},
|
||||
{
|
||||
name: "global receivers permissions - update all",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {ac.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {ac.ScopeReceiversAll}},
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {models.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {models.ScopeReceiversAll}},
|
||||
existing: allReceivers(),
|
||||
hasAccess: allReceivers(),
|
||||
},
|
||||
@@ -1204,12 +1204,12 @@ func TestReceiverServiceAC_Update(t *testing.T) {
|
||||
name: "single receivers permissions - update some",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAlertingReceiversUpdate: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
accesscontrol.ActionAlertingReceiversRead: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
},
|
||||
existing: allReceivers(),
|
||||
@@ -1219,12 +1219,12 @@ func TestReceiverServiceAC_Update(t *testing.T) {
|
||||
name: "single receivers mixed read permissions - update some",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAlertingReceiversUpdate: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
accesscontrol.ActionAlertingReceiversRead: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
},
|
||||
existing: allReceivers(),
|
||||
@@ -1234,8 +1234,8 @@ func TestReceiverServiceAC_Update(t *testing.T) {
|
||||
name: "single receivers mixed global read permissions - update some",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAlertingReceiversUpdate: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
accesscontrol.ActionAlertingNotificationsRead: nil,
|
||||
},
|
||||
@@ -1327,15 +1327,15 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
|
||||
},
|
||||
{
|
||||
name: "global receivers permissions - not authorized without read",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {ac.ScopeReceiversAll}},
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {models.ScopeReceiversAll}},
|
||||
existing: allReceivers(),
|
||||
hasAccess: nil,
|
||||
},
|
||||
{
|
||||
name: "single receivers permissions - not authorized without read",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
}},
|
||||
existing: allReceivers(),
|
||||
hasAccess: nil,
|
||||
@@ -1348,7 +1348,7 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
|
||||
},
|
||||
{
|
||||
name: "global receivers permissions - delete all",
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {ac.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {ac.ScopeReceiversAll}},
|
||||
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {models.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {models.ScopeReceiversAll}},
|
||||
existing: allReceivers(),
|
||||
hasAccess: allReceivers(),
|
||||
},
|
||||
@@ -1356,12 +1356,12 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
|
||||
name: "single receivers permissions - delete some",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAlertingReceiversDelete: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
accesscontrol.ActionAlertingReceiversRead: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
},
|
||||
existing: allReceivers(),
|
||||
@@ -1371,12 +1371,12 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
|
||||
name: "single receivers mixed read permissions - delete some",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAlertingReceiversDelete: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
accesscontrol.ActionAlertingReceiversRead: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
},
|
||||
existing: allReceivers(),
|
||||
@@ -1386,8 +1386,8 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
|
||||
name: "single receivers mixed global read permissions - delete some",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAlertingReceiversDelete: {
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
|
||||
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
|
||||
},
|
||||
accesscontrol.ActionAlertingNotificationsRead: nil,
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user