public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Access control: Move data source actions and scopes to datasource package (#46594)

Browse Source 
* Add permission actions and id scope

* Remove scope and actions variable prefix

* Move page evaluators and rename them
This commit is contained in:
Karl Persson
2022-03-16 15:11:03 +01:00
committed by GitHub
parent ea815d640f
commit d27ff42376
6 changed files with 90 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/accesscontrol.go
+13 -36
View File
@@ -83,12 +83,12 @@ func (hs *HTTPServer) declareFixedRoles() error {
Group: "Data sources",
Permissions: []ac.Permission{
{
Action: datasources.ActionDatasourcesRead,
Scope: datasources.ScopeDatasourcesProvider.GetResourceAllScope(),
Action: datasources.ActionRead,
Scope: datasources.ScopeAll,
},
{
Action: datasources.ActionDatasourcesQuery,
Scope: datasources.ScopeDatasourcesAll,
Action: datasources.ActionQuery,
Scope: datasources.ScopeAll,
},
},
},
@@ -104,15 +104,15 @@ func (hs *HTTPServer) declareFixedRoles() error {
Group: "Data sources",
Permissions: ac.ConcatPermissions(datasourcesReaderRole.Role.Permissions, []ac.Permission{
{
Action: datasources.ActionDatasourcesWrite,
Scope: datasources.ScopeDatasourcesAll,
Action: datasources.ActionWrite,
Scope: datasources.ScopeAll,
},
{
Action: datasources.ActionDatasourcesCreate,
Action: datasources.ActionCreate,
},
{
Action: datasources.ActionDatasourcesDelete,
Scope: datasources.ScopeDatasourcesAll,
Action: datasources.ActionDelete,
Scope: datasources.ScopeAll,
},
}),
},
@@ -128,8 +128,8 @@ func (hs *HTTPServer) declareFixedRoles() error {
Group: "Infrequently used",
Permissions: []ac.Permission{
{
Action: datasources.ActionDatasourcesIDRead,
Scope: datasources.ScopeDatasourcesAll,
Action: datasources.ActionIDRead,
Scope: datasources.ScopeAll,
},
},
},
@@ -144,8 +144,8 @@ func (hs *HTTPServer) declareFixedRoles() error {
Description: "Only used for open source compatibility. Query data sources.",
Group: "Infrequently used",
Permissions: []ac.Permission{
{Action: datasources.ActionDatasourcesQuery},
{Action: datasources.ActionDatasourcesRead},
{Action: datasources.ActionQuery},
{Action: datasources.ActionRead},
},
},
Grants: []string{string(models.ROLE_VIEWER)},
@@ -387,29 +387,6 @@ func (hs *HTTPServer) declareFixedRoles() error {
// Evaluators
// here is the list of complex evaluators we use in this package
// dataSourcesConfigurationAccessEvaluator is used to protect the "Configure > Data sources" tab access
var dataSourcesConfigurationAccessEvaluator = ac.EvalAll(
ac.EvalPermission(datasources.ActionDatasourcesRead),
ac.EvalAny(
ac.EvalPermission(datasources.ActionDatasourcesCreate),
ac.EvalPermission(datasources.ActionDatasourcesDelete),
ac.EvalPermission(datasources.ActionDatasourcesWrite),
),
)
// dataSourcesNewAccessEvaluator is used to protect the "Configure > Data sources > New" page access
var dataSourcesNewAccessEvaluator = ac.EvalAll(
ac.EvalPermission(datasources.ActionDatasourcesRead),
ac.EvalPermission(datasources.ActionDatasourcesCreate),
ac.EvalPermission(datasources.ActionDatasourcesWrite),
)
// dataSourcesEditAccessEvaluator is used to protect the "Configure > Data sources > Edit" page access
var dataSourcesEditAccessEvaluator = ac.EvalAll(
ac.EvalPermission(datasources.ActionDatasourcesRead),
ac.EvalPermission(datasources.ActionDatasourcesWrite),
)
// orgPreferencesAccessEvaluator is used to protect the "Configure > Preferences" page access
var orgPreferencesAccessEvaluator = ac.EvalAny(
ac.EvalAll(