AccessControl: Add accesscontrol metadata to datasources DTOs (#42675)

* AccessControl: Provide scope to frontend * Covering datasources with accesscontrol metadata * Write benchmark tests for GetResourcesMetadata * Add accesscontrol util and interface * Add the hasPermissionInMetadata function in the frontend access control code * Use IsDisabled rather that performing a feature toggle check Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2021-12-15 12:08:15 +01:00
parent 2b1ed43cb2
commit c7cabdfd6f
19 changed files with 364 additions and 71 deletions
@@ -0,0 +1,104 @@
+package accesscontrol
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetResourcesMetadata(t *testing.T) {
+	tests := []struct {
+		desc         string
+		resource     string
+		resourcesIDs map[string]bool
+		permissions  []*Permission
+		expected     map[string]Metadata
+	}{
+		{
+			desc:         "Should return no permission for resources 1,2,3 given the user has no permission",
+			resource:     "resources",
+			resourcesIDs: map[string]bool{"1": true, "2": true, "3": true},
+			expected:     map[string]Metadata{},
+		},
+		{
+			desc:     "Should return no permission for resources 1,2,3 given the user has permissions for 4 only",
+			resource: "resources",
+			permissions: []*Permission{
+				{Action: "resources:action1", Scope: Scope("resources", "id", "4")},
+				{Action: "resources:action2", Scope: Scope("resources", "id", "4")},
+				{Action: "resources:action3", Scope: Scope("resources", "id", "4")},
+			},
+			resourcesIDs: map[string]bool{"1": true, "2": true, "3": true},
+			expected:     map[string]Metadata{},
+		},
+		{
+			desc:     "Should only return permissions for resources 1 and 2, given the user has no permissions for 3",
+			resource: "resources",
+			permissions: []*Permission{
+				{Action: "resources:action1", Scope: Scope("resources", "id", "1")},
+				{Action: "resources:action2", Scope: Scope("resources", "id", "2")},
+				{Action: "resources:action3", Scope: Scope("resources", "id", "2")},
+			},
+			resourcesIDs: map[string]bool{"1": true, "2": true, "3": true},
+			expected: map[string]Metadata{
+				"1": {"resources:action1": true},
+				"2": {"resources:action2": true, "resources:action3": true},
+			},
+		},
+		{
+			desc:     "Should return permissions with global scopes for resources 1,2,3",
+			resource: "resources",
+			permissions: []*Permission{
+				{Action: "resources:action4", Scope: Scope("resources", "id", "*")},
+				{Action: "resources:action5", Scope: Scope("resources", "*")},
+				{Action: "resources:action6", Scope: "*"},
+				{Action: "resources:action1", Scope: Scope("resources", "id", "1")},
+				{Action: "resources:action2", Scope: Scope("resources", "id", "2")},
+				{Action: "resources:action3", Scope: Scope("resources", "id", "2")},
+			},
+			resourcesIDs: map[string]bool{"1": true, "2": true, "3": true},
+			expected: map[string]Metadata{
+				"1": {"resources:action1": true, "resources:action4": true, "resources:action5": true, "resources:action6": true},
+				"2": {"resources:action2": true, "resources:action3": true, "resources:action4": true, "resources:action5": true, "resources:action6": true},
+				"3": {"resources:action4": true, "resources:action5": true, "resources:action6": true},
+			},
+		},
+		{
+			desc:     "Should correctly filter out irrelevant permissions for resources 1,2,3",
+			resource: "resources",
+			permissions: []*Permission{
+				{Action: "resources:action1", Scope: Scope("resources", "id", "1")},
+				{Action: "otherresources:action1", Scope: Scope("resources", "id", "1")},
+				{Action: "resources:action2", Scope: Scope("otherresources", "id", "*")},
+				{Action: "otherresources:action1", Scope: Scope("otherresources", "id", "*")},
+			},
+			resourcesIDs: map[string]bool{"1": true, "2": true, "3": true},
+			expected: map[string]Metadata{
+				"1": {"resources:action1": true, "otherresources:action1": true},
+			},
+		},
+		{
+			desc:     "Should correctly handle permissions with multilayer scope",
+			resource: "resources:sub",
+			permissions: []*Permission{
+				{Action: "resources:action1", Scope: Scope("resources", "sub", "id", "1")},
+				{Action: "resources:action1", Scope: Scope("resources", "sub", "id", "123")},
+			},
+			resourcesIDs: map[string]bool{"1": true, "123": true},
+			expected: map[string]Metadata{
+				"1":   {"resources:action1": true},
+				"123": {"resources:action1": true},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			metadata, err := GetResourcesMetadata(context.Background(), tt.permissions, tt.resource, tt.resourcesIDs)
+			require.NoError(t, err)
+
+			assert.EqualValues(t, tt.expected, metadata)
+		})
+	}
+}