public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: generated prefixed uids for external service role (#76601)

Browse Source 
* Replace FixedRoleUID function with a common function to generate these prefixes

* Use common function to generate prefixed uid for external service accounts

Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com>

---------

Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com>
This commit is contained in:
Karl Persson
2023-10-16 13:12:16 +02:00
committed by GitHub
co-authored by Gabriel MABILLE
parent bc98f3d139
commit ae5e03034b
4 changed files with 35 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/database/externalservices_test.go
+4 -12
View File
@@ -3,10 +3,8 @@ package database
import (
"context"
// #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes
"crypto/sha1"
"encoding/hex"
"errors"
"fmt"
"testing"
"github.com/grafana/grafana/pkg/infra/db"
@@ -166,7 +164,7 @@ func TestAccessControlStore_SaveExternalServiceRole(t *testing.T) {
require.NoError(t, err)
errDBSession := s.sql.WithDbSession(ctx, func(sess *db.Session) error {
storedRole, err := getRoleByUID(ctx, sess, sha1Hash(fmt.Sprintf("externalservice_%s_permissions", tt.runs[i].cmd.ExternalServiceID)))
storedRole, err := getRoleByUID(ctx, sess, accesscontrol.PrefixedRoleUID(extServiceRoleName(tt.runs[i].cmd.ExternalServiceID)))
require.NoError(t, err)
require.NotNil(t, storedRole)
require.Equal(t, tt.runs[i].cmd.Global, storedRole.Global(), "Incorrect global state of the role")
@@ -253,7 +251,7 @@ func TestAccessControlStore_DeleteExternalServiceRole(t *testing.T) {
}
roleID := int64(-1)
err := s.sql.WithDbSession(ctx, func(sess *db.Session) error {
role, err := getRoleByUID(ctx, sess, extServiceRoleUID(tt.id))
role, err := getRoleByUID(ctx, sess, accesscontrol.PrefixedRoleUID(extServiceRoleName(tt.id)))
if err != nil && !errors.Is(err, accesscontrol.ErrRoleNotFound) {
return err
}
@@ -295,7 +293,7 @@ func TestAccessControlStore_DeleteExternalServiceRole(t *testing.T) {
// Role should be deleted
_ = s.sql.WithDbSession(ctx, func(sess *db.Session) error {
storedRole, err := getRoleByUID(ctx, sess, extServiceRoleUID(tt.id))
storedRole, err := getRoleByUID(ctx, sess, accesscontrol.PrefixedRoleUID(extServiceRoleName(tt.id)))
require.ErrorIs(t, err, accesscontrol.ErrRoleNotFound)
require.Nil(t, storedRole)
return nil
@@ -303,9 +301,3 @@ func TestAccessControlStore_DeleteExternalServiceRole(t *testing.T) {
})
}
}
func sha1Hash(text string) string {
h := sha1.New()
_, _ = h.Write([]byte(text))
return hex.EncodeToString(h.Sum(nil))
}