RBAC: Don't additionally cache all users permissions (#105607)
* RBAC: Don't additionally cache all users permissions * remove unused tests
This commit is contained in:
@@ -6,78 +6,12 @@ import (
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
claims "github.com/grafana/authlib/types"
|
||||
|
||||
"github.com/grafana/grafana/pkg/infra/log"
|
||||
"github.com/grafana/grafana/pkg/services/org"
|
||||
"github.com/grafana/grafana/pkg/services/user"
|
||||
)
|
||||
|
||||
var testLogger = log.New("test")
|
||||
|
||||
func TestPermissionCacheKey(t *testing.T) {
|
||||
testcases := []struct {
|
||||
name string
|
||||
signedInUser *user.SignedInUser
|
||||
expected string
|
||||
}{
|
||||
{
|
||||
name: "should return correct key for user",
|
||||
signedInUser: &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
UserID: 1,
|
||||
FallbackType: claims.TypeUser,
|
||||
},
|
||||
expected: "rbac-permissions-1-user-1",
|
||||
},
|
||||
{
|
||||
name: "should return correct key for api key",
|
||||
signedInUser: &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
ApiKeyID: 1,
|
||||
IsServiceAccount: false,
|
||||
FallbackType: claims.TypeUser,
|
||||
},
|
||||
expected: "rbac-permissions-1-api-key-1",
|
||||
},
|
||||
{
|
||||
name: "should return correct key for service account",
|
||||
signedInUser: &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
UserID: 1,
|
||||
IsServiceAccount: true,
|
||||
FallbackType: claims.TypeUser,
|
||||
},
|
||||
expected: "rbac-permissions-1-service-account-1",
|
||||
},
|
||||
{
|
||||
name: "should return correct key for matching a service account with userId -1",
|
||||
signedInUser: &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
UserID: -1,
|
||||
IsServiceAccount: true,
|
||||
FallbackType: claims.TypeUser, // NOTE, this is still a service account!
|
||||
},
|
||||
expected: "rbac-permissions-1-service-account--1",
|
||||
},
|
||||
{
|
||||
name: "should use org role if no unique id",
|
||||
signedInUser: &user.SignedInUser{
|
||||
OrgID: 1,
|
||||
OrgRole: org.RoleNone,
|
||||
FallbackType: claims.TypeUser,
|
||||
},
|
||||
expected: "rbac-permissions-1-user-None",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testcases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
assert.Equal(t, tc.expected, GetUserPermissionCacheKey(tc.signedInUser))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetSearchPermissionCacheKey(t *testing.T) {
|
||||
keyInputs := []struct {
|
||||
signedInUser *user.SignedInUser
|
||||
|
||||
Reference in New Issue
Block a user