public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthZ service: Expand the logic to also evaluate action sets (#112124)

Browse Source 
* expand AuthZ service logic to also evaluate action sets

* handle folder creation

* fix test

* simplify mapper code

Co-authored-by: gamab <gabi.mabs@gmail.com>

* more accurate variable name Co-authored-by: gamab <gabi.mabs@gmail.com>

* break alerting import cycle

* Apply suggestion from @gamab

---------

Co-authored-by: gamab <gabi.mabs@gmail.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Ieva
2025-10-08 13:37:12 +01:00
committed by GitHub
co-authored by gamab Gabriel MABILLE
parent bb1d7d9070
commit acbbfde256
13 changed files with 359 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/ngalert/notifier/receiver_svc_test.go
+37 -37
View File
@@ -117,7 +117,7 @@ func TestIntegrationReceiverService_DecryptRedact(t *testing.T) {
Permissions: map[int64]map[string][]string{
1: {
accesscontrol.ActionAlertingNotificationsRead: nil,
accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll},
accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll},
},
},
}
@@ -343,7 +343,7 @@ func TestReceiverService_Create(t *testing.T) {
}}
decryptUser := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{
1: {
accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll},
accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll},
},
}}
@@ -556,7 +556,7 @@ func TestReceiverService_Update(t *testing.T) {
}}
decryptUser := &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{
1: {
accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll},
accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll},
},
}}
@@ -949,30 +949,30 @@ func TestReceiverServiceAC_Read(t *testing.T) {
},
{
name: "global receivers permissions - read all",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversRead: {ac.ScopeReceiversAll}},
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversRead: {models.ScopeReceiversAll}},
existing: allReceivers(),
visible: allReceivers(),
},
{
name: "single receivers permissions - read some",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversRead: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
}},
existing: allReceivers(),
visible: []models.Receiver{recv1, recv3},
},
{
name: "global receivers secret permissions - read all",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversReadSecrets: {ac.ScopeReceiversAll}},
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversReadSecrets: {models.ScopeReceiversAll}},
existing: allReceivers(),
visible: allReceivers(),
},
{
name: "single receivers secret permissions - read some",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversReadSecrets: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
}},
existing: allReceivers(),
visible: []models.Receiver{recv1, recv3},
@@ -1175,15 +1175,15 @@ func TestReceiverServiceAC_Update(t *testing.T) {
},
{
name: "global receivers permissions - not authorized without read",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {ac.ScopeReceiversAll}},
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {models.ScopeReceiversAll}},
existing: allReceivers(),
hasAccess: nil,
},
{
name: "single receivers permissions - not authorized without read",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
}},
existing: allReceivers(),
hasAccess: nil,
@@ -1196,7 +1196,7 @@ func TestReceiverServiceAC_Update(t *testing.T) {
},
{
name: "global receivers permissions - update all",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {ac.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {ac.ScopeReceiversAll}},
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversUpdate: {models.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {models.ScopeReceiversAll}},
existing: allReceivers(),
hasAccess: allReceivers(),
},
@@ -1204,12 +1204,12 @@ func TestReceiverServiceAC_Update(t *testing.T) {
name: "single receivers permissions - update some",
permissions: map[string][]string{
accesscontrol.ActionAlertingReceiversUpdate: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
accesscontrol.ActionAlertingReceiversRead: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
},
existing: allReceivers(),
@@ -1219,12 +1219,12 @@ func TestReceiverServiceAC_Update(t *testing.T) {
name: "single receivers mixed read permissions - update some",
permissions: map[string][]string{
accesscontrol.ActionAlertingReceiversUpdate: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
accesscontrol.ActionAlertingReceiversRead: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
},
existing: allReceivers(),
@@ -1234,8 +1234,8 @@ func TestReceiverServiceAC_Update(t *testing.T) {
name: "single receivers mixed global read permissions - update some",
permissions: map[string][]string{
accesscontrol.ActionAlertingReceiversUpdate: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
accesscontrol.ActionAlertingNotificationsRead: nil,
},
@@ -1327,15 +1327,15 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
},
{
name: "global receivers permissions - not authorized without read",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {ac.ScopeReceiversAll}},
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {models.ScopeReceiversAll}},
existing: allReceivers(),
hasAccess: nil,
},
{
name: "single receivers permissions - not authorized without read",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
}},
existing: allReceivers(),
hasAccess: nil,
@@ -1348,7 +1348,7 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
},
{
name: "global receivers permissions - delete all",
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {ac.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {ac.ScopeReceiversAll}},
permissions: map[string][]string{accesscontrol.ActionAlertingReceiversDelete: {models.ScopeReceiversAll}, accesscontrol.ActionAlertingReceiversRead: {models.ScopeReceiversAll}},
existing: allReceivers(),
hasAccess: allReceivers(),
},
@@ -1356,12 +1356,12 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
name: "single receivers permissions - delete some",
permissions: map[string][]string{
accesscontrol.ActionAlertingReceiversDelete: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
accesscontrol.ActionAlertingReceiversRead: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
},
existing: allReceivers(),
@@ -1371,12 +1371,12 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
name: "single receivers mixed read permissions - delete some",
permissions: map[string][]string{
accesscontrol.ActionAlertingReceiversDelete: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
accesscontrol.ActionAlertingReceiversRead: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv2.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
},
existing: allReceivers(),
@@ -1386,8 +1386,8 @@ func TestReceiverServiceAC_Delete(t *testing.T) {
name: "single receivers mixed global read permissions - delete some",
permissions: map[string][]string{
accesscontrol.ActionAlertingReceiversDelete: {
ac.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
ac.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv1.UID),
models.ScopeReceiversProvider.GetResourceScopeUID(recv3.UID),
},
accesscontrol.ActionAlertingNotificationsRead: nil,
},