public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Teams: Support team UIDs in APIs (#94011)

Browse Source 
* support team UIDs in APIs

* unify middleware logic and add team tests

* add UID test to resource permissions

* remove unused middleware
This commit is contained in:
Jo
2024-10-07 10:18:24 +02:00
committed by GitHub
parent 413548806d
commit acd13e05ef
13 changed files with 202 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/team/teamapi/api.go
+11 -10
View File
@@ -55,34 +55,35 @@ func ProvideTeamAPI(
func (tapi *TeamAPI) registerRoutes(router routing.RouteRegister, ac accesscontrol.AccessControl) {
authorize := accesscontrol.Middleware(ac)
teamResolver := team.MiddlewareTeamUIDResolver(tapi.teamService, ":teamId")
router.Group("/api", func(apiRoute routing.RouteRegister) {
// team (admin permission required)
apiRoute.Group("/teams", func(teamsRoute routing.RouteRegister) {
teamsRoute.Post("/", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsCreate)),
routing.Wrap(tapi.createTeam))
teamsRoute.Put("/:teamId", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsWrite,
teamsRoute.Put("/:teamId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsWrite,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.updateTeam))
teamsRoute.Delete("/:teamId", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsDelete,
teamsRoute.Delete("/:teamId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsDelete,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.deleteTeamByID))
teamsRoute.Get("/:teamId/members", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsRead,
teamsRoute.Get("/:teamId/members", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsRead,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.getTeamMembers))
teamsRoute.Post("/:teamId/members", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
teamsRoute.Post("/:teamId/members", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.addTeamMember))
teamsRoute.Put("/:teamId/members/:userId", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
teamsRoute.Put("/:teamId/members/:userId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.updateTeamMember))
teamsRoute.Put("/:teamId/members", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
teamsRoute.Put("/:teamId/members", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.setTeamMemberships))
teamsRoute.Delete("/:teamId/members/:userId", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
teamsRoute.Delete("/:teamId/members/:userId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.removeTeamMember))
teamsRoute.Get("/:teamId/preferences", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead,
teamsRoute.Get("/:teamId/preferences", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.getTeamPreferences))
teamsRoute.Put("/:teamId/preferences", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsWrite,
teamsRoute.Put("/:teamId/preferences", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsWrite,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.updateTeamPreferences))
}, requestmeta.SetOwner(requestmeta.TeamAuth))
// team without requirement of user to be org admin
apiRoute.Group("/teams", func(teamsRoute routing.RouteRegister) {
teamsRoute.Get("/:teamId", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead,
teamsRoute.Get("/:teamId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead,
accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.getTeamByID))
teamsRoute.Get("/search", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead)),
routing.Wrap(tapi.searchTeams))