public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

provisioning: allow any authenticated user for settings/stats endpoints

Browse Source 
These are read-only endpoints needed by the frontend:
- settings: returns available repository types and configuration for the wizard
- stats: returns resource counts

Authentication is verified before reaching authorization, so any user who
reaches these endpoints is already authenticated. Requiring specific org
roles failed for AccessPolicy tokens which don't carry traditional roles.
This commit is contained in:
Roberto Jimenez Sanchez
2025-12-17 17:39:09 +01:00
parent 3b743ab5ce
commit b7495cbc70
1 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/provisioning/register.go
+9 -12
View File
@@ -425,21 +425,18 @@ func (b *APIBuilder) authorizeRepositorySubresource(a authorizer.Attributes, id
}
// authorizeStats handles authorization for stats resource.
func (b *APIBuilder) authorizeStats(id identity.Requester) (authorizer.Decision, string, error) {
// This can leak information one shouldn't necessarily have access to.
if id.GetOrgRole().Includes(identity.RoleAdmin) {
return authorizer.DecisionAllow, "", nil
}
return authorizer.DecisionDeny, "admin role is required", nil
func (b *APIBuilder) authorizeStats(_ identity.Requester) (authorizer.Decision, string, error) {
// Stats is a read-only endpoint that returns resource counts.
// Any authenticated user can access it - authentication is verified before this point.
return authorizer.DecisionAllow, "", nil
}
// authorizeSettings handles authorization for settings resource.
func (b *APIBuilder) authorizeSettings(id identity.Requester) (authorizer.Decision, string, error) {
// This is strictly a read operation. It is handy on the frontend for viewers.
if id.GetOrgRole().Includes(identity.RoleViewer) {
return authorizer.DecisionAllow, "", nil
}
return authorizer.DecisionDeny, "viewer role is required", nil
func (b *APIBuilder) authorizeSettings(_ identity.Requester) (authorizer.Decision, string, error) {
// Settings is a read-only endpoint that returns available repository types and configuration.
// Any authenticated user can access it - authentication is verified before this point.
// The frontend needs this to display the provisioning wizard.
return authorizer.DecisionAllow, "", nil
}
// authorizeJobs handles authorization for job resources.