public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ServiceAccounts: Remove permissions to service account when it is deleted (#93877)

Browse Source 
* Service account: clean up permissions related to service accounts when deleted

* Add migration for deleting orphaned service account permissions

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
This commit is contained in:
Karl Persson
2024-10-04 09:01:09 +02:00
committed by GitHub
co-authored by Ieva
parent 943525391e
commit c7ca2bfcf5
5 changed files with 114 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/serviceaccounts/manager/service.go
+12 -5
View File
@@ -26,7 +26,9 @@ const (
)
type ServiceAccountsService struct {
acService accesscontrol.Service
acService accesscontrol.Service
permissions accesscontrol.ServiceAccountPermissionsService
store store
log log.Logger
backgroundLog log.Logger
@@ -44,7 +46,8 @@ func ProvideServiceAccountsService(
kvStore kvstore.KVStore,
userService user.Service,
orgService org.Service,
accesscontrolService accesscontrol.Service,
acService accesscontrol.Service,
permissions accesscontrol.ServiceAccountPermissionsService,
) (*ServiceAccountsService, error) {
serviceAccountsStore := database.ProvideServiceAccountsStore(
cfg,
@@ -55,13 +58,14 @@ func ProvideServiceAccountsService(
orgService,
)
s := &ServiceAccountsService{
acService: accesscontrolService,
acService: acService,
permissions: permissions,
store: serviceAccountsStore,
log: log.New("serviceaccounts"),
backgroundLog: log.New("serviceaccounts.background"),
}
if err := RegisterRoles(accesscontrolService); err != nil {
if err := RegisterRoles(acService); err != nil {
s.log.Error("Failed to register roles", "error", err)
}
@@ -179,7 +183,10 @@ func (sa *ServiceAccountsService) DeleteServiceAccount(ctx context.Context, orgI
if err := sa.store.DeleteServiceAccount(ctx, orgID, serviceAccountID); err != nil {
return err
}
return sa.acService.DeleteUserPermissions(ctx, orgID, serviceAccountID)
if err := sa.acService.DeleteUserPermissions(ctx, orgID, serviceAccountID); err != nil {
return err
}
return sa.permissions.DeleteResourcePermissions(ctx, orgID, fmt.Sprintf("%d", serviceAccountID))
}
func (sa *ServiceAccountsService) EnableServiceAccount(ctx context.Context, orgID, serviceAccountID int64, enable bool) error {
pkg/services/serviceaccounts/manager/service_test.go
+2 -1
View File
@@ -119,7 +119,8 @@ func (f *SecretsCheckerFake) CheckTokens(ctx context.Context) error {
func TestProvideServiceAccount_DeleteServiceAccount(t *testing.T) {
storeMock := newServiceAccountStoreFake()
acSvc := actest.FakeService{}
svc := ServiceAccountsService{acSvc, storeMock, log.New("test"), log.New("background.test"), &SecretsCheckerFake{}, false, 0}
pSvc := &actest.FakePermissionsService{}
svc := ServiceAccountsService{acSvc, pSvc, storeMock, log.NewNopLogger(), log.NewNopLogger(), &SecretsCheckerFake{}, false, 0}
testOrgId := 1
t.Run("should create service account", func(t *testing.T) {
pkg/services/serviceaccounts/manager/stats_test.go
+2 -1
View File
@@ -14,8 +14,9 @@ import (
func Test_UsageStats(t *testing.T) {
acSvc := actest.FakeService{}
pSvc := actest.FakePermissionsService{}
storeMock := newServiceAccountStoreFake()
svc := ServiceAccountsService{acSvc, storeMock, log.New("test"), log.New("background-test"), &SecretsCheckerFake{}, true, 5}
svc := ServiceAccountsService{acSvc, &pSvc, storeMock, log.NewNopLogger(), log.NewNopLogger(), &SecretsCheckerFake{}, true, 5}
err := svc.DeleteServiceAccount(context.Background(), 1, 1)
require.NoError(t, err)