public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Allow passing in user UID when searching for user's permissions (#97125)

Browse Source 
* allow passing in user UID instead of ID when searching for user's permissions

* fix tests
This commit is contained in:
Ieva
2024-11-28 16:36:26 +00:00
committed by GitHub
parent 2fdac80488
commit cc0ec349a4
8 changed files with 109 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/database/database.go
+11 -23
View File
@@ -175,15 +175,6 @@ func (s *AccessControlStore) SearchUsersPermissions(ctx context.Context, orgID i
}
dbPerms := make([]UserRBACPermission, 0)
userID := int64(-1)
if options.TypedID != "" {
var err error
userID, err = options.ComputeUserID()
if err != nil {
return nil, err
}
}
if err := s.sql.WithDbSession(ctx, func(sess *db.Session) error {
roleNameFilterJoin := ""
if len(options.RolePrefixes) > 0 {
@@ -193,28 +184,25 @@ func (s *AccessControlStore) SearchUsersPermissions(ctx context.Context, orgID i
params := []any{}
direct := userAssignsSQL
if userID >= 0 {
direct += " WHERE ur.user_id = ?"
params = append(params, userID)
}
team := teamAssignsSQL
if userID >= 0 {
team += " WHERE tm.user_id = ?"
params = append(params, userID)
}
basic := basicRoleAssignsSQL
if userID >= 0 {
if options.UserID > 0 {
direct += " WHERE ur.user_id = ?"
params = append(params, options.UserID)
team += " WHERE tm.user_id = ?"
params = append(params, options.UserID)
basic += " WHERE ou.user_id = ?"
params = append(params, userID)
params = append(params, options.UserID)
}
grafanaAdmin := fmt.Sprintf(grafanaAdminAssignsSQL, s.sql.Quote("user"))
params = append(params, accesscontrol.RoleGrafanaAdmin)
if userID >= 0 {
if options.UserID > 0 {
grafanaAdmin += " AND sa.user_id = ?"
params = append(params, userID)
params = append(params, options.UserID)
}
// Find permissions
pkg/services/accesscontrol/database/database_test.go
+1 -2
View File
@@ -9,7 +9,6 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/authlib/claims"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/localcache"
"github.com/grafana/grafana/pkg/infra/tracing"
@@ -625,7 +624,7 @@ func TestIntegrationAccessControlStore_SearchUsersPermissions(t *testing.T) {
},
options: accesscontrol.SearchOptions{
ActionPrefix: "teams:",
TypedID: claims.NewTypeID(claims.TypeUser, "1"),
UserID: 1,
},
wantPerm: map[int64][]accesscontrol.Permission{
1: {{Action: "teams:read", Scope: "teams:id:1"}, {Action: "teams:read", Scope: "teams:id:10"},