RBAC: Add option to skip rbac check for specified verbs (#93654)

* Add option to skip rbac check for specified verbs

pkg/services/accesscontrol/authorizer.go

@@ -27,6 +27,9 @@ func (r ResourceResolverFunc) Resolve(ctx context.Context, ns claims.NamespaceIn
 type ResourceAuthorizerOptions struct {
 	// Resource is the resource name in plural.
 	Resource string
+	// Unchecked is used to skip authorization checks for specified verbs.
+	// This takes precedence over configured Mapping
+	Unchecked map[string]bool
 	// Attr is attribute used for resource scope. It's usually 'id' or 'uid'
 	// depending on what is stored for the resource.
 	Attr string
@@ -45,6 +48,9 @@ func NewLegacyAccessClient(ac AccessControl, opts ...ResourceAuthorizerOptions)
 	stored := map[string]ResourceAuthorizerOptions{}
 
 	for _, o := range opts {
+		if o.Unchecked == nil {
+			o.Unchecked = map[string]bool{}
+		}
 		if o.Mapping == nil {
 			o.Mapping = map[string]string{}
 		}
@@ -75,6 +81,11 @@ func (c *LegacyAccessClient) HasAccess(ctx context.Context, id claims.AuthInfo,
 		return false, nil
 	}
 
+	skip := opts.Unchecked[req.Verb]
+	if skip {
+		return true, nil
+	}
+
 	action, ok := opts.Mapping[req.Verb]
 	if !ok {
 		return false, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)

pkg/services/accesscontrol/authorizer_test.go

@@ -103,6 +103,41 @@ func TestResourceAuthorizer_HasAccess(t *testing.T) {
 		assert.NoError(t, err)
 		assert.Equal(t, true, ok)
 	})
+
+	t.Run("should skip authorization for configured verb", func(t *testing.T) {
+		a := accesscontrol.NewLegacyAccessClient(ac, accesscontrol.ResourceAuthorizerOptions{
+			Resource: "dashboards",
+			Attr:     "uid",
+			Unchecked: map[string]bool{
+				"get": true,
+			},
+			Mapping: map[string]string{
+				"create": "dashboards:create",
+			},
+		})
+
+		ident := newIdent(accesscontrol.Permission{})
+
+		ok, err := a.HasAccess(context.Background(), ident, claims.AccessRequest{
+			Verb:      "get",
+			Namespace: "default",
+			Resource:  "dashboards",
+			Name:      "1",
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, true, ok)
+
+		ok, err = a.HasAccess(context.Background(), ident, claims.AccessRequest{
+			Verb:      "create",
+			Namespace: "default",
+			Resource:  "dashboards",
+			Name:      "1",
+		})
+
+		assert.NoError(t, err)
+		assert.Equal(t, false, ok)
+	})
 }
 
 func newIdent(permissions ...accesscontrol.Permission) *identity.StaticRequester {