public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AccessControl: FGAC permissions for orgs endpoint on frontend (#41050) (#41928)

Browse Source 
* AccessControl: FGAC permissions for orgs endpoint on frontend

Protect org update endpoints

add or refactor missing right messages

cover org page

* removing scopes from orgs

* Perform permission control with global org

* Perform the error handling in case of 403

* Simplify frontend code by requiring read access for sure

* Remove roles I added to decrease the number of changes

* Remove the check for server admin to reduce the number of changes

* change error message

* Cleaning todos

* Remove unecessary changes

* Fix tests

* Update test snapshot

* Update pkg/api/roles.go

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>

* Update public/app/features/admin/AdminEditOrgPage.tsx

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>

* Format AdminEditOrgPage for linting

* Update public/app/features/admin/AdminEditOrgPage.tsx

Co-authored-by: Vardan Torosyan <vardants@gmail.com>

* Update public/app/features/admin/AdminEditOrgPage.tsx

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Update public/app/features/admin/AdminListOrgsPage.tsx

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Commit suggestions

* Commit suggestion canRead canWrite

* fix typo

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
(cherry picked from commit 0ee0a0b7a0)

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Grot (@grafanabot)
2021-11-19 09:12:13 +01:00
committed by GitHub
co-authored by Gabriel MABILLE
parent cdd89d2945
commit c708c92593
14 changed files with 128 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/api.go
+4 -4
View File
@@ -52,8 +52,8 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/profile/password", reqSignedInNoAnonymous, hs.Index)
r.Get("/.well-known/change-password", redirectToChangePassword)
r.Get("/profile/switch-org/:id", reqSignedInNoAnonymous, hs.ChangeActiveOrgAndRedirectToHome)
r.Get("/org/", reqOrgAdmin, hs.Index)
r.Get("/org/new", reqGrafanaAdmin, hs.Index)
r.Get("/org/", authorize(reqOrgAdmin, orgPreferencesAccessEvaluator), hs.Index)
r.Get("/org/new", authorizeInOrg(reqGrafanaAdmin, acmiddleware.UseGlobalOrg, orgsCreateAccessEvaluator), hs.Index)
r.Get("/datasources/", authorize(reqOrgAdmin, dataSourcesConfigurationAccessEvaluator), hs.Index)
r.Get("/datasources/new", authorize(reqOrgAdmin, dataSourcesNewAccessEvaluator), hs.Index)
r.Get("/datasources/edit/*", authorize(reqOrgAdmin, dataSourcesEditAccessEvaluator), hs.Index)
@@ -70,8 +70,8 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/admin/users", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionUsersRead, ac.ScopeGlobalUsersAll)), hs.Index)
r.Get("/admin/users/create", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionUsersCreate)), hs.Index)
r.Get("/admin/users/edit/:id", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionUsersRead)), hs.Index)
r.Get("/admin/orgs", reqGrafanaAdmin, hs.Index)
r.Get("/admin/orgs/edit/:id", reqGrafanaAdmin, hs.Index)
r.Get("/admin/orgs", authorizeInOrg(reqGrafanaAdmin, acmiddleware.UseGlobalOrg, orgsAccessEvaluator), hs.Index)
r.Get("/admin/orgs/edit/:id", authorizeInOrg(reqGrafanaAdmin, acmiddleware.UseGlobalOrg, orgsAccessEvaluator), hs.Index)
r.Get("/admin/stats", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionServerStatsRead)), hs.Index)
r.Get("/admin/ldap", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPStatusRead)), hs.Index)
r.Get("/styleguide", reqSignedIn, hs.Index)