public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AccessControl: FGAC permissions for orgs endpoint on frontend (#41050) (#41928)

Browse Source 
* AccessControl: FGAC permissions for orgs endpoint on frontend

Protect org update endpoints

add or refactor missing right messages

cover org page

* removing scopes from orgs

* Perform permission control with global org

* Perform the error handling in case of 403

* Simplify frontend code by requiring read access for sure

* Remove roles I added to decrease the number of changes

* Remove the check for server admin to reduce the number of changes

* change error message

* Cleaning todos

* Remove unecessary changes

* Fix tests

* Update test snapshot

* Update pkg/api/roles.go

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>

* Update public/app/features/admin/AdminEditOrgPage.tsx

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>

* Format AdminEditOrgPage for linting

* Update public/app/features/admin/AdminEditOrgPage.tsx

Co-authored-by: Vardan Torosyan <vardants@gmail.com>

* Update public/app/features/admin/AdminEditOrgPage.tsx

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Update public/app/features/admin/AdminListOrgsPage.tsx

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Commit suggestions

* Commit suggestion canRead canWrite

* fix typo

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
(cherry picked from commit 0ee0a0b7a0)

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Grot (@grafanabot)
2021-11-19 09:12:13 +01:00
committed by GitHub
co-authored by Gabriel MABILLE
parent cdd89d2945
commit c708c92593
14 changed files with 128 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/roles.go
+22
View File
@@ -231,3 +231,25 @@ var dataSourcesEditAccessEvaluator = accesscontrol.EvalAll(
accesscontrol.EvalPermission(ActionDatasourcesRead, ScopeDatasourcesAll),
accesscontrol.EvalPermission(ActionDatasourcesWrite),
)
// orgPreferencesAccessEvaluator is used to protect the "Configure > Preferences" page access
var orgPreferencesAccessEvaluator = accesscontrol.EvalAny(
accesscontrol.EvalAll(
accesscontrol.EvalPermission(ActionOrgsRead),
accesscontrol.EvalPermission(ActionOrgsWrite),
),
accesscontrol.EvalAll(
accesscontrol.EvalPermission(ActionOrgsPreferencesRead),
accesscontrol.EvalPermission(ActionOrgsPreferencesWrite),
),
)
// orgsAccessEvaluator is used to protect the "Server Admin > Orgs" page access
// (you need to have read access to update or delete orgs; read is the minimum)
var orgsAccessEvaluator = accesscontrol.EvalPermission(ActionOrgsRead)
// orgsCreateAccessEvaluator is used to protect the "Server Admin > Orgs > New Org" page access
var orgsCreateAccessEvaluator = accesscontrol.EvalAll(
accesscontrol.EvalPermission(ActionOrgsRead),
accesscontrol.EvalPermission(ActionOrgsCreate),
)