public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Folders: Use authlib.AccessClient in authorizer" (#110812)

Browse Source 
Revert "Folders: Use authlib.AccessClient in authorizer (#110602)"

This reverts commit 0cb52b8be0.
This commit is contained in:
Gabriel MABILLE
2025-09-09 15:45:37 +02:00
committed by GitHub
parent b30916c917
commit d0f25b0cd7
7 changed files with 317 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/rbac/models.go
+3 -3
View File
@@ -2,11 +2,11 @@ package rbac
import claims "github.com/grafana/authlib/types"
type checkRequest struct {
type CheckRequest struct {
Namespace claims.NamespaceInfo
IdentityType claims.IdentityType
UserUID string
Action string // Verb has been mapped into an action
Action string
Group string
Resource string
Verb string
@@ -14,7 +14,7 @@ type checkRequest struct {
ParentFolder string
}
type listRequest struct {
type ListRequest struct {
Namespace claims.NamespaceInfo
IdentityType claims.IdentityType
UserUID string
pkg/services/authz/rbac/service.go
+10 -11
View File
@@ -228,7 +228,7 @@ func (s *Service) List(ctx context.Context, req *authzv1.ListRequest) (*authzv1.
return resp, err
}
func (s *Service) validateCheckRequest(ctx context.Context, req *authzv1.CheckRequest) (*checkRequest, error) {
func (s *Service) validateCheckRequest(ctx context.Context, req *authzv1.CheckRequest) (*CheckRequest, error) {
ctx, span := s.tracer.Start(ctx, "authz_direct_db.service.validateCheckRequest")
defer span.End()
@@ -247,7 +247,7 @@ func (s *Service) validateCheckRequest(ctx context.Context, req *authzv1.CheckRe
return nil, err
}
checkReq := &checkRequest{
checkReq := &CheckRequest{
Namespace: ns,
UserUID: userUID,
IdentityType: idType,
@@ -261,7 +261,7 @@ func (s *Service) validateCheckRequest(ctx context.Context, req *authzv1.CheckRe
return checkReq, nil
}
func (s *Service) validateListRequest(ctx context.Context, req *authzv1.ListRequest) (*listRequest, error) {
func (s *Service) validateListRequest(ctx context.Context, req *authzv1.ListRequest) (*ListRequest, error) {
ctx, span := s.tracer.Start(ctx, "authz_direct_db.service.validateListRequest")
defer span.End()
@@ -280,7 +280,7 @@ func (s *Service) validateListRequest(ctx context.Context, req *authzv1.ListRequ
return nil, err
}
listReq := &listRequest{
listReq := &ListRequest{
Namespace: ns,
UserUID: userUID,
IdentityType: idType,
@@ -331,19 +331,18 @@ func (s *Service) validateSubject(ctx context.Context, subject string) (string,
return userUID, identityType, nil
}
// Find the action for a selected verb
func (s *Service) validateAction(ctx context.Context, group, resource, verb string) (string, error) {
ctxLogger := s.logger.FromContext(ctx)
t, ok := s.mapper.Get(group, resource)
if !ok {
ctxLogger.Error("unsupported resource", "group", group, "resource", resource)
ctxLogger.Error("unsupport resource", "group", group, "resource", resource)
return "", status.Error(codes.NotFound, "unsupported resource")
}
action, ok := t.Action(verb)
if !ok {
ctxLogger.Error("unsupported verb", "group", group, "resource", resource, "verb", verb)
ctxLogger.Error("unsupport verb", "group", group, "resource", resource, "verb", verb)
return "", status.Error(codes.NotFound, "unsupported verb")
}
@@ -571,7 +570,7 @@ func (s *Service) getUserBasicRole(ctx context.Context, ns types.NamespaceInfo,
return *basicRole, nil
}
func (s *Service) checkPermission(ctx context.Context, scopeMap map[string]bool, req *checkRequest) (bool, error) {
func (s *Service) checkPermission(ctx context.Context, scopeMap map[string]bool, req *CheckRequest) (bool, error) {
ctx, span := s.tracer.Start(ctx, "authz_direct_db.service.checkPermission", trace.WithAttributes(
attribute.Int("scope_count", len(scopeMap))))
defer span.End()
@@ -620,7 +619,7 @@ func getScopeMap(permissions []accesscontrol.Permission) map[string]bool {
return permMap
}
func (s *Service) checkInheritedPermissions(ctx context.Context, scopeMap map[string]bool, req *checkRequest) (bool, error) {
func (s *Service) checkInheritedPermissions(ctx context.Context, scopeMap map[string]bool, req *CheckRequest) (bool, error) {
if req.ParentFolder == "" {
return false, nil
}
@@ -697,7 +696,7 @@ func (s *Service) buildFolderTree(ctx context.Context, ns types.NamespaceInfo) (
return res.(folderTree), nil
}
func (s *Service) listPermission(ctx context.Context, scopeMap map[string]bool, req *listRequest) (*authzv1.ListResponse, error) {
func (s *Service) listPermission(ctx context.Context, scopeMap map[string]bool, req *ListRequest) (*authzv1.ListResponse, error) {
if scopeMap["*"] {
return &authzv1.ListResponse{All: true}, nil
}
@@ -708,7 +707,7 @@ func (s *Service) listPermission(ctx context.Context, scopeMap map[string]bool,
t, ok := s.mapper.Get(req.Group, req.Resource)
if !ok {
ctxLogger.Error("unsupported resource", "group", req.Group, "resource", req.Resource)
ctxLogger.Error("unsupport resource", "group", req.Group, "resource", req.Resource)
return nil, status.Error(codes.NotFound, "unsupported resource")
}
pkg/services/authz/rbac/service_test.go
+24 -93
View File
@@ -16,7 +16,7 @@ import (
authzv1 "github.com/grafana/authlib/authz/proto/v1"
"github.com/grafana/authlib/cache"
"github.com/grafana/authlib/types"
"github.com/grafana/grafana/pkg/apimachinery/identity"
"github.com/grafana/grafana/pkg/apimachinery/utils"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
@@ -30,7 +30,7 @@ func TestService_checkPermission(t *testing.T) {
type testCase struct {
name string
permissions []accesscontrol.Permission
check checkRequest
check CheckRequest
folders []store.Folder
expected bool
}
@@ -47,7 +47,7 @@ func TestService_checkPermission(t *testing.T) {
Identifier: "some_dashboard",
},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -66,7 +66,7 @@ func TestService_checkPermission(t *testing.T) {
Identifier: "another_dashboard",
},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -85,7 +85,7 @@ func TestService_checkPermission(t *testing.T) {
Identifier: "*",
},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -103,7 +103,7 @@ func TestService_checkPermission(t *testing.T) {
Attribute: "*",
},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -120,7 +120,7 @@ func TestService_checkPermission(t *testing.T) {
Kind: "*",
},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -139,7 +139,7 @@ func TestService_checkPermission(t *testing.T) {
Identifier: "general",
},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:create",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -154,7 +154,7 @@ func TestService_checkPermission(t *testing.T) {
Action: "dashboards:create",
},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:create",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -165,7 +165,7 @@ func TestService_checkPermission(t *testing.T) {
{
name: "should return false if user has no permissions on resource",
permissions: []accesscontrol.Permission{},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -187,7 +187,7 @@ func TestService_checkPermission(t *testing.T) {
{UID: "parent"},
{UID: "child", ParentUID: strPtr("parent")},
},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -208,7 +208,7 @@ func TestService_checkPermission(t *testing.T) {
},
},
folders: []store.Folder{{UID: "parent"}},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:create",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -230,7 +230,7 @@ func TestService_checkPermission(t *testing.T) {
},
},
folders: []store.Folder{{UID: "parent"}, {UID: "other_parent"}},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:create",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -252,7 +252,7 @@ func TestService_checkPermission(t *testing.T) {
},
},
folders: []store.Folder{{UID: "parent"}},
check: checkRequest{
check: CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -273,7 +273,7 @@ func TestService_checkPermission(t *testing.T) {
Identifier: "some_datasource",
},
},
check: checkRequest{
check: CheckRequest{
Action: "datasources:query",
Group: "query.grafana.app",
Resource: "query",
@@ -297,75 +297,6 @@ func TestService_checkPermission(t *testing.T) {
}
}
func TestService_mapping(t *testing.T) {
type testCase struct {
name string
input *authzv1.CheckRequest
output *checkRequest
err string
}
ns := "default"
testUserA := &identity.StaticRequester{
Type: types.TypeUser,
Login: "test",
UserID: 123,
UserUID: "u123",
OrgRole: identity.RoleAdmin,
IsGrafanaAdmin: true, // can do anything
Namespace: ns,
OrgID: 1,
}
ctx := types.WithAuthInfo(request.WithNamespace(context.Background(), ns), testUserA)
testCases := []testCase{
{
name: "should return true if user has permission",
input: &authzv1.CheckRequest{
Group: "folder.grafana.app",
Resource: "folders",
Name: "aaa",
Verb: utils.VerbCreate,
Folder: "folder",
},
output: &checkRequest{
Action: "folders:create",
Group: "folder.grafana.app",
Resource: "folders",
Name: "aaa",
Verb: "create",
ParentFolder: "folder",
Namespace: types.NamespaceInfo{
Value: ns,
OrgID: 1,
},
},
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
s := setupService()
tc.input.Namespace = ns
tc.input.Subject = testUserA.GetUID() // the subject string
got, err := s.validateCheckRequest(ctx, tc.input)
if tc.err != "" {
require.Error(t, err)
require.ErrorContains(t, err, tc.err)
return
}
require.NoError(t, err)
require.NotNil(t, got)
tc.output.IdentityType = types.TypeUser
tc.output.UserUID = testUserA.GetIdentifier()
require.Equal(t, tc.output, got)
})
}
}
func TestService_checkPermission_folderCacheMissRecovery(t *testing.T) {
s := setupService()
ctx := context.Background()
@@ -386,7 +317,7 @@ func TestService_checkPermission_folderCacheMissRecovery(t *testing.T) {
s.folderCache.Set(ctx, folderCacheKey("default"), newFolderTree([]store.Folder{{UID: "root"}}))
// Perform check on sub folder
check := checkRequest{
check := CheckRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -628,7 +559,7 @@ func TestService_listPermission(t *testing.T) {
name string
permissions []accesscontrol.Permission
folders []store.Folder
list listRequest
list ListRequest
expectedItems []string
expectedFolders []string
expectedAll bool
@@ -644,7 +575,7 @@ func TestService_listPermission(t *testing.T) {
Kind: "*",
},
},
list: listRequest{
list: ListRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -680,7 +611,7 @@ func TestService_listPermission(t *testing.T) {
{UID: "some_folder_1"},
{UID: "some_folder_2"},
},
list: listRequest{
list: ListRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -707,7 +638,7 @@ func TestService_listPermission(t *testing.T) {
{UID: "some_folder_subsubchild", ParentUID: strPtr("some_folder_subchild2")},
{UID: "some_folder_1", ParentUID: strPtr("some_other_folder")},
},
list: listRequest{
list: ListRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -736,7 +667,7 @@ func TestService_listPermission(t *testing.T) {
{UID: "some_folder_parent"},
{UID: "some_folder_child", ParentUID: strPtr("some_folder_parent")},
},
list: listRequest{
list: ListRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -768,7 +699,7 @@ func TestService_listPermission(t *testing.T) {
{UID: "some_folder_subchild", ParentUID: strPtr("some_folder_child")},
{UID: "some_folder_child2", ParentUID: strPtr("some_folder_parent")},
},
list: listRequest{
list: ListRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -782,7 +713,7 @@ func TestService_listPermission(t *testing.T) {
folders: []store.Folder{
{UID: "some_folder_1"},
},
list: listRequest{
list: ListRequest{
Action: "dashboards:read",
Group: "dashboard.grafana.app",
Resource: "dashboards",
@@ -803,7 +734,7 @@ func TestService_listPermission(t *testing.T) {
{UID: "some_folder_parent"},
{UID: "some_folder_child", ParentUID: strPtr("some_folder_parent")},
},
list: listRequest{
list: ListRequest{
Action: "folders:read",
Group: "folder.grafana.app",
Resource: "folders",