public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: only query folder service when fetching parent folders (#99893)

Browse Source 
* only query folder service when fetching parent folders
* Perform validation and inehrited scopes solvers as service instead of caller
This commit is contained in:
Karl Persson
2025-02-03 13:56:25 +01:00
committed by GitHub
parent a0901456ae
commit c85a175212
4 changed files with 19 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/ossaccesscontrol/dashboard.go
+8 -13
View File
@@ -5,6 +5,7 @@ import (
"errors"
"github.com/grafana/grafana/pkg/api/routing"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/metrics"
"github.com/grafana/grafana/pkg/services/accesscontrol"
@@ -117,6 +118,7 @@ func ProvideDashboardPermissions(
ctx, span := tracer.Start(ctx, "accesscontrol.ossaccesscontrol.ProvideDashboardPermissions.ResourceValidator")
defer span.End()
ctx, _ = identity.WithServiceIdentitiy(ctx, orgID)
dashboard, err := getDashboard(ctx, orgID, resourceID)
if err != nil {
return err
@@ -129,32 +131,25 @@ func ProvideDashboardPermissions(
return nil
},
InheritedScopesSolver: func(ctx context.Context, orgID int64, resourceID string) ([]string, error) {
wildcards := accesscontrol.WildcardsFromPrefix(dashboards.ScopeFoldersPrefix)
scopes := []string(wildcards)
ctx, _ = identity.WithServiceIdentitiy(ctx, orgID)
dashboard, err := getDashboard(ctx, orgID, resourceID)
if err != nil {
return nil, err
}
scopes := []string(accesscontrol.WildcardsFromPrefix(dashboards.ScopeFoldersPrefix))
metrics.MFolderIDsServiceCount.WithLabelValues(metrics.AccessControl).Inc()
// nolint:staticcheck
if dashboard.FolderUID != "" {
query := &dashboards.GetDashboardQuery{UID: dashboard.FolderUID, OrgID: orgID}
queryResult, err := dashboardService.GetDashboard(ctx, query)
if err != nil {
return nil, err
}
parentScope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(queryResult.UID)
nestedScopes, err := dashboards.GetInheritedScopes(ctx, orgID, queryResult.UID, folderService)
nestedScopes, err := dashboards.GetInheritedScopes(ctx, orgID, dashboard.FolderUID, folderService)
if err != nil {
return nil, err
}
scopes = append(scopes, parentScope)
scopes = append(scopes, dashboards.ScopeFoldersProvider.GetResourceScopeUID(dashboard.FolderUID))
scopes = append(scopes, nestedScopes...)
return scopes, nil
}
return append(scopes, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folder.GeneralFolderUID)), nil
},
Assignments: resourcepermissions.Assignments{