[v9.4.x] Auth: Fix orgrole picker disabled if isSynced user (#65553)

Auth: Fix orgrole picker disabled if isSynced user (#64033) * fix: disable orgrolepicker if externaluser is synced * add disable to role picker * just took me 2 hours to center the icon * wip * fix: check externallySyncedUser for API call * remove check from store * add: tests * refactor authproxy and made tests run * add: feature toggle * set feature toggle for tests * add: IsProviderEnabled * refactor: featuretoggle name * IsProviderEnabled tests * add specific tests for isProviderEnabled * fix: org_user tests * add: owner to featuretoggle * add missing authlabels * remove fmt * feature toggle * change config * add test for a different authmodule * test refactor * gen feature toggle again * fix basic auth user able to change the org role * test for basic auth role * make err.base to error * lowered lvl of log and input mesg (cherry picked from commit 3cd952b8ba)
2023-04-05 09:55:43 +01:00
parent f9f0dd8b1b
commit d37fa06f05
27 changed files with 618 additions and 89 deletions
@@ -17,9 +17,13 @@ import (
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/db/dbtest"
 	"github.com/grafana/grafana/pkg/infra/localcache"
+	"github.com/grafana/grafana/pkg/models/roletype"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/login"
+	"github.com/grafana/grafana/pkg/services/login/logintest"
 	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/org/orgimpl"
 	"github.com/grafana/grafana/pkg/services/org/orgtest"
@@ -30,8 +34,10 @@ import (
 	"github.com/grafana/grafana/pkg/services/temp_user/tempuserimpl"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/services/user/userimpl"
+	"github.com/grafana/grafana/pkg/services/user/usertest"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/util"
+	"github.com/grafana/grafana/pkg/web/webtest"
 )

 func setUpGetOrgUsersDB(t *testing.T, sqlStore *sqlstore.SQLStore) {
@@ -200,6 +206,99 @@ func TestOrgUsersAPIEndpoint_userLoggedIn(t *testing.T) {
 	})
 }

+func TestOrgUsersAPIEndpoint_updateOrgRole(t *testing.T) {
+	type testCase struct {
+		desc            string
+		SkipOrgRoleSync bool
+		AuthEnabled     bool
+		AuthModule      string
+		expectedCode    int
+	}
+	permissions := []accesscontrol.Permission{
+		{Action: accesscontrol.ActionOrgUsersRead, Scope: "users:*"},
+		{Action: accesscontrol.ActionOrgUsersWrite, Scope: "users:*"},
+		{Action: accesscontrol.ActionOrgUsersAdd, Scope: "users:*"},
+		{Action: accesscontrol.ActionOrgUsersRemove, Scope: "users:*"},
+	}
+	tests := []testCase{
+		{
+			desc:            "should be able to change basicRole when skip_org_role_sync true",
+			SkipOrgRoleSync: true,
+			AuthEnabled:     true,
+			AuthModule:      login.LDAPAuthModule,
+			expectedCode:    http.StatusOK,
+		},
+		{
+			desc:            "should not be able to change basicRole when skip_org_role_sync false",
+			SkipOrgRoleSync: false,
+			AuthEnabled:     true,
+			AuthModule:      login.LDAPAuthModule,
+			expectedCode:    http.StatusForbidden,
+		},
+		{
+			desc:            "should not be able to change basicRole with a different provider",
+			SkipOrgRoleSync: false,
+			AuthEnabled:     true,
+			AuthModule:      login.GenericOAuthModule,
+			expectedCode:    http.StatusForbidden,
+		},
+		{
+			desc:            "should be able to change basicRole with a basic Auth",
+			SkipOrgRoleSync: false,
+			AuthEnabled:     false,
+			AuthModule:      "",
+			expectedCode:    http.StatusOK,
+		},
+		{
+			desc:            "should be able to change basicRole with a basic Auth",
+			SkipOrgRoleSync: true,
+			AuthEnabled:     true,
+			AuthModule:      "",
+			expectedCode:    http.StatusOK,
+		},
+	}
+
+	userWithPermissions := userWithPermissions(1, permissions)
+	userRequesting := &user.User{ID: 2, OrgID: 1}
+	reqBody := `{"userId": "1", "role": "Admin", "orgId": "1"}`
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			server := SetupAPITestServer(t, func(hs *HTTPServer) {
+				hs.Cfg = setting.NewCfg()
+				hs.Cfg.LDAPAuthEnabled = tt.AuthEnabled
+				if tt.AuthModule == login.LDAPAuthModule {
+					hs.Cfg.LDAPAuthEnabled = tt.AuthEnabled
+					hs.Cfg.LDAPSkipOrgRoleSync = tt.SkipOrgRoleSync
+				} else if tt.AuthModule == login.GenericOAuthModule {
+					hs.Cfg.GenericOAuthAuthEnabled = tt.AuthEnabled
+					hs.Cfg.GenericOAuthSkipOrgRoleSync = tt.SkipOrgRoleSync
+				} else if tt.AuthModule == "" {
+					// authmodule empty means basic auth
+				} else {
+					t.Errorf("invalid auth module for test: %s", tt.AuthModule)
+				}
+
+				hs.authInfoService = &logintest.AuthInfoServiceFake{
+					ExpectedUserAuth: &login.UserAuth{AuthModule: tt.AuthModule},
+				}
+				hs.Features = featuremgmt.WithFeatures(featuremgmt.FlagOnlyExternalOrgRoleSync, true)
+				hs.userService = &usertest.FakeUserService{ExpectedSignedInUser: userWithPermissions}
+				hs.orgService = &orgtest.FakeOrgService{}
+				hs.accesscontrolService = &actest.FakeService{
+					ExpectedPermissions: permissions,
+				}
+			})
+			req := server.NewRequest(http.MethodPatch, fmt.Sprintf("/api/orgs/%d/users/%d", userRequesting.OrgID, userRequesting.ID), strings.NewReader(reqBody))
+			req.Header.Set("Content-Type", "application/json")
+			userWithPermissions.OrgRole = roletype.RoleAdmin
+			res, err := server.Send(webtest.RequestWithSignedInUser(req, userWithPermissions))
+			require.NoError(t, err)
+			assert.Equal(t, tt.expectedCode, res.StatusCode)
+			require.NoError(t, res.Body.Close())
+		})
+	}
+}
+
 func TestOrgUsersAPIEndpoint_LegacyAccessControl_FolderAdmin(t *testing.T) {
 	cfg := setting.NewCfg()
 	cfg.RBACEnabled = false