diff --git a/pkg/api/roles.go b/pkg/api/roles.go index 6f09f1de1c9..f73b13bfb0b 100644 --- a/pkg/api/roles.go +++ b/pkg/api/roles.go @@ -46,10 +46,11 @@ var ( func (hs *HTTPServer) declareFixedRoles() error { provisioningWriterRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 2, + Version: 3, Name: "fixed:provisioning:writer", DisplayName: "Provisioning writer", Description: "Reload provisioning.", + Group: "Provisioning", Permissions: []accesscontrol.Permission{ { Action: ActionProvisioningReload, @@ -62,10 +63,11 @@ func (hs *HTTPServer) declareFixedRoles() error { datasourcesReaderRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 2, + Version: 3, Name: "fixed:datasources:reader", DisplayName: "Data source reader", Description: "Read and query all data sources.", + Group: "Data sources", Permissions: []accesscontrol.Permission{ { Action: ActionDatasourcesRead, @@ -82,10 +84,11 @@ func (hs *HTTPServer) declareFixedRoles() error { datasourcesWriterRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 2, + Version: 3, Name: "fixed:datasources:writer", DisplayName: "Data source writer", Description: "Create, update, delete, read, or query data sources.", + Group: "Data sources", Permissions: accesscontrol.ConcatPermissions(datasourcesReaderRole.Role.Permissions, []accesscontrol.Permission{ { Action: ActionDatasourcesWrite, @@ -105,10 +108,11 @@ func (hs *HTTPServer) declareFixedRoles() error { datasourcesIdReaderRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 3, + Version: 4, Name: "fixed:datasources.id:reader", DisplayName: "Data source ID reader", Description: "Read the ID of a data source based on its name.", + Group: "Infrequently used", Permissions: []accesscontrol.Permission{ { Action: ActionDatasourcesIDRead, @@ -121,10 +125,11 @@ func (hs *HTTPServer) declareFixedRoles() error { datasourcesCompatibilityReaderRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 2, + Version: 3, Name: "fixed:datasources:compatibility:querier", DisplayName: "Data source compatibility querier", Description: "Only used for open source compatibility. Query data sources.", + Group: "Infrequently used", Permissions: []accesscontrol.Permission{ {Action: ActionDatasourcesQuery}, }, @@ -134,10 +139,11 @@ func (hs *HTTPServer) declareFixedRoles() error { currentOrgReaderRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 3, + Version: 4, Name: "fixed:current.org:reader", DisplayName: "Current Organization reader", Description: "Read the current organization, such as its ID, name, address, or quotas.", + Group: "Organizations", Permissions: []accesscontrol.Permission{ {Action: ActionOrgsRead}, {Action: ActionOrgsQuotasRead}, @@ -148,10 +154,11 @@ func (hs *HTTPServer) declareFixedRoles() error { currentOrgWriterRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 3, + Version: 4, Name: "fixed:current.org:writer", DisplayName: "Current Organization writer", Description: "Read the current organization, its quotas, or its preferences. Update the current organization properties, or its preferences.", + Group: "Organizations", Permissions: accesscontrol.ConcatPermissions(currentOrgReaderRole.Role.Permissions, []accesscontrol.Permission{ {Action: ActionOrgsPreferencesRead}, {Action: ActionOrgsWrite}, @@ -163,10 +170,11 @@ func (hs *HTTPServer) declareFixedRoles() error { orgReaderRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 1, + Version: 2, Name: "fixed:orgs:reader", DisplayName: "Organization reader", Description: "Read the organization and its quotas.", + Group: "Organizations", Permissions: []accesscontrol.Permission{ {Action: ActionOrgsRead}, {Action: ActionOrgsQuotasRead}, @@ -177,10 +185,11 @@ func (hs *HTTPServer) declareFixedRoles() error { orgWriterRole := accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 3, + Version: 4, Name: "fixed:orgs:writer", DisplayName: "Organization writer", Description: "Create, read, write, or delete an organization. Read or write an organization's quotas.", + Group: "Organizations", Permissions: accesscontrol.ConcatPermissions(orgReaderRole.Role.Permissions, []accesscontrol.Permission{ {Action: ActionOrgsCreate}, {Action: ActionOrgsWrite}, diff --git a/pkg/services/accesscontrol/roles.go b/pkg/services/accesscontrol/roles.go index 53442e3edd6..6e1107faf3d 100644 --- a/pkg/services/accesscontrol/roles.go +++ b/pkg/services/accesscontrol/roles.go @@ -16,10 +16,11 @@ type RoleRegistry interface { // Roles definition var ( datasourcesExplorerRole = RoleDTO{ - Version: 2, + Version: 3, Name: datasourcesExplorer, DisplayName: "Data source explorer", Description: "Enable the Explore feature. Data source permissions still apply; you can only query data sources for which you have query permissions.", + Group: "Data sources", Permissions: []Permission{ { Action: ActionDatasourcesExplore, @@ -31,7 +32,8 @@ var ( Name: ldapReader, DisplayName: "LDAP reader", Description: "Read LDAP configuration and status.", - Version: 2, + Group: "LDAP", + Version: 3, Permissions: []Permission{ { Action: ActionLDAPUsersRead, @@ -46,7 +48,8 @@ var ( Name: ldapWriter, DisplayName: "LDAP writer", Description: "Read and update LDAP configuration and read LDAP status.", - Version: 3, + Group: "LDAP", + Version: 4, Permissions: ConcatPermissions(ldapReaderRole.Permissions, []Permission{ { Action: ActionLDAPUsersSync, @@ -61,7 +64,8 @@ var ( Name: orgUsersWriter, DisplayName: "Organization user writer", Description: "Within a single organization, add a user, invite a user, read information about a user and their role, remove a user from that organization, or change the role of a user.", - Version: 2, + Group: "User administration (organizational)", + Version: 3, Permissions: ConcatPermissions(orgUsersReaderRole.Permissions, []Permission{ { Action: ActionOrgUsersAdd, @@ -82,7 +86,8 @@ var ( Name: orgUsersReader, DisplayName: "Organization user reader", Description: "Read users within a single organization.", - Version: 2, + Group: "User administration (organizational)", + Version: 3, Permissions: []Permission{ { Action: ActionOrgUsersRead, @@ -92,9 +97,10 @@ var ( } settingsReaderRole = RoleDTO{ - Version: 3, + Version: 4, DisplayName: "Setting reader", Description: "Read Grafana instance settings.", + Group: "Settings", Name: settingsReader, Permissions: []Permission{ { @@ -105,10 +111,11 @@ var ( } statsReaderRole = RoleDTO{ - Version: 2, + Version: 3, Name: statsReader, DisplayName: "Statistics reader", Description: "Read Grafana instance statistics.", + Group: "Statistics", Permissions: []Permission{ { Action: ActionServerStatsRead, @@ -120,7 +127,8 @@ var ( Name: usersReader, DisplayName: "User reader", Description: "Read all users and their information, such as team memberships, authentication tokens, and quotas.", - Version: 2, + Group: "User administration (global)", + Version: 3, Permissions: []Permission{ { Action: ActionUsersRead, @@ -145,7 +153,8 @@ var ( Name: usersWriter, DisplayName: "User writer", Description: "Read and update all attributes and settings for all users in Grafana: update user information, read user information, create or enable or disable a user, make a user a Grafana administrator, sign out a user, update a user’s authentication token, or update quotas for all users.", - Version: 2, + Group: "User administration (global)", + Version: 3, Permissions: ConcatPermissions(usersReaderRole.Permissions, []Permission{ { Action: ActionUsersPasswordUpdate, diff --git a/pkg/services/serviceaccounts/manager/roles.go b/pkg/services/serviceaccounts/manager/roles.go index 2c1d9a8b6f4..ffc4eb4ed53 100644 --- a/pkg/services/serviceaccounts/manager/roles.go +++ b/pkg/services/serviceaccounts/manager/roles.go @@ -8,9 +8,10 @@ import ( var ( role = accesscontrol.RoleRegistration{ Role: accesscontrol.RoleDTO{ - Version: 1, + Version: 2, Name: "fixed:serviceaccounts:writer", Description: "", + Group: "Service accounts", Permissions: []accesscontrol.Permission{ { Action: serviceaccounts.ActionDelete,