public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthZ: Deleting managed role permissions for a specified resource (#110617)

Browse Source 
* basics for deleting managed role permissions for a specified resource

* fix the query

* fix query tests

* storage tests

* sql tests

* add missing import

* Update pkg/registry/apis/iam/resourcepermission/storage_backend.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* PR feedback

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
This commit is contained in:
Ieva
2025-09-05 16:22:09 +01:00
committed by GitHub
co-authored by Gabriel MABILLE
parent ba202ebab1
commit d692303e76
11 changed files with 291 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/iam/resourcepermission/sql_test.go
+63 -1
View File
@@ -43,7 +43,7 @@ func setupTestRoles(t *testing.T, store db.DB) {
sess := store.GetSqlxSession()
_, err := sess.Exec(context.Background(),
`INSERT INTO role (id, version, org_id, uid, name, display_name, description, group_name, hidden, created, updated)
`INSERT INTO role (id, version, org_id, uid, name, display_name, description, group_name, hidden, created, updated)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?), (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?), (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?), (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
// Managed roles
@@ -207,6 +207,68 @@ func TestIntegration_ResourcePermSqlBackend_getResourcePermission(t *testing.T)
}
}
func TestResourcePermSqlBackend_deleteResourcePermission(t *testing.T) {
if testing.Short() {
t.Skip("skipping integration test in short mode")
}
backend := setupBackend(t)
sql, err := backend.dbProvider(context.Background())
require.NoError(t, err)
setupTestRoles(t, sql.DB)
tests := []struct {
name string
resource string
orgID int64
want v0alpha1.ResourcePermission
err error
}{
{
name: "should return an error for unknown resource type",
orgID: 1,
resource: "unknown.grafana.app-unknown-u1",
err: errUnknownGroupResource,
},
{
name: "should return an error for invalid resource name",
orgID: 1,
resource: "invalid.grafana.app-invalid",
err: errInvalidName,
},
{
name: "should delete permissions in org1 for fold1",
resource: "folder.grafana.app-folders-fold1",
orgID: 1,
err: nil,
},
{
name: "should delete permissions in org2 for fold1",
resource: "folder.grafana.app-folders-fold1",
orgID: 2,
err: nil,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ns := types.NamespaceInfo{
OrgID: tt.orgID,
}
err := backend.deleteResourcePermission(context.Background(), sql, ns, tt.resource)
if tt.err != nil {
require.Error(t, err)
require.ErrorIs(t, err, tt.err)
return
}
require.NoError(t, err)
// check that the resource has been deleted
_, err = backend.getResourcePermission(context.Background(), sql, ns, tt.resource)
require.Error(t, err)
})
}
}
func TestIntegration_ResourcePermSqlBackend_CreateResourcePermission(t *testing.T) {
if testing.Short() {
t.Skip("skipping integration test")