Team LBAC: Add teamHeaders for datasource proxy requests (#76339)

* Add teamHeaders for datasource proxy requests * adds validation for the teamHeaders * added tests for applying teamHeaders * remove previous implementation * validation for header values being set to authproxy * removed unnecessary checks * newline * Add middleware for injecting headers on the data source backend * renamed feature toggle * Get user teams from context * Fix feature toggle name * added test for validation of the auth headers and fixed evaluation to cover headers * renaming of teamHeaders to teamHTTPHeaders * use of header set for non-existing header and add for existing headers * moves types into datasources * fixed unchecked errors * Refactor * Add tests for data model * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> Co-authored-by: Victor Cinaglia <victor@grafana.com>
2023-10-17 11:23:54 +01:00
parent 7d9b2c73c7
commit be5ba68132
14 changed files with 425 additions and 4 deletions
@@ -5,9 +5,11 @@ import (
 	"net"
 	"net/http"
 	"sort"
+	"strconv"
 	"strings"

 	"github.com/grafana/grafana/pkg/services/auth/identity"
+	"github.com/grafana/grafana/pkg/services/datasources"
 )

 const (
@@ -130,3 +132,58 @@ func ApplyForwardIDHeader(req *http.Request, user identity.Requester) {
 		req.Header.Set(IDHeaderName, token)
 	}
 }
+
+func ApplyTeamHTTPHeaders(req *http.Request, ds *datasources.DataSource, teams []int64) error {
+	headers, err := GetTeamHTTPHeaders(ds, teams)
+	if err != nil {
+		return err
+	}
+
+	for header, value := range headers {
+		// check if headerv is already set in req.Header
+		if req.Header.Get(header) != "" {
+			req.Header.Add(header, value)
+		} else {
+			req.Header.Set(header, value)
+		}
+	}
+
+	return nil
+}
+
+func GetTeamHTTPHeaders(ds *datasources.DataSource, teams []int64) (map[string]string, error) {
+	teamHTTPHeadersMap := make(map[string]string)
+	teamHTTPHeaders, err := ds.TeamHTTPHeaders()
+	if err != nil {
+		return nil, err
+	}
+
+	for teamID, headers := range teamHTTPHeaders {
+		id, err := strconv.ParseInt(teamID, 10, 64)
+		if err != nil {
+			// FIXME: logging here
+			continue
+		}
+
+		if !contains(teams, id) {
+			continue
+		}
+
+		for _, header := range headers {
+			// TODO: handle multiple header values
+			// add tests for these cases
+			teamHTTPHeadersMap[header.Header] = header.Value
+		}
+	}
+
+	return teamHTTPHeadersMap, nil
+}
+
+func contains(slice []int64, value int64) bool {
+	for _, v := range slice {
+		if v == value {
+			return true
+		}
+	}
+	return false
+}
@@ -6,6 +6,8 @@ import (

 	"github.com/stretchr/testify/require"

+	"github.com/grafana/grafana/pkg/components/simplejson"
+	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/user"
 )

@@ -203,3 +205,67 @@ func TestApplyUserHeader(t *testing.T) {
 		require.Equal(t, "admin", req.Header.Get("X-Grafana-User"))
 	})
 }
+
+func TestApplyteamHTTPHeaders(t *testing.T) {
+	t.Run("Should not apply team headers for users that are not part of the teams", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+		ds := &datasources.DataSource{
+			JsonData: simplejson.New(),
+		}
+		// add team headers
+		ds.JsonData.Set("teamHTTPHeaders", map[string]interface{}{
+			"1": []map[string]interface{}{
+				{
+					"header": "X-Team-Header",
+					"value":  "1",
+				},
+			},
+			"2": []map[string]interface{}{
+				{
+					"header": "X-Prom-Label-Policy",
+					"value":  "2",
+				},
+			},
+			// user is not part of this team
+			"3": []map[string]interface{}{
+				{
+					"header": "X-Custom-Label-Policy",
+					"value":  "3",
+				},
+			},
+		})
+
+		err = ApplyTeamHTTPHeaders(req, ds, []int64{1, 2})
+		require.NoError(t, err)
+		require.Contains(t, req.Header, "X-Team-Header")
+		require.Contains(t, req.Header, "X-Prom-Label-Policy")
+		require.NotContains(t, req.Header, "X-Custom-Label-Policy")
+	})
+	t.Run("Should apply team headers", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+		ds := &datasources.DataSource{
+			JsonData: simplejson.New(),
+		}
+		ds.JsonData.Set("teamHTTPHeaders", map[string]interface{}{
+			"1": []map[string]interface{}{
+				{
+					"header": "X-Team-Header",
+					"value":  "1",
+				},
+			},
+			"2": []map[string]interface{}{
+				{
+					"header": "X-Prom-Label-Policy",
+					"value":  "2",
+				},
+			},
+		})
+
+		err = ApplyTeamHTTPHeaders(req, ds, []int64{1, 2})
+		require.NoError(t, err)
+		require.Contains(t, req.Header, "X-Team-Header")
+		require.Contains(t, req.Header, "X-Prom-Label-Policy")
+	})
+}