public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: remove redundant role name field from plugin role registrations (#58166)

Browse Source 
* RBAC: Remove name from role registration

* Inline accesscontrol service

* test fix

* use fmt

Co-Authored-By: marefr <marcus.efraimsson@gmail.com>

Co-authored-by: marefr <marcus.efraimsson@gmail.com>
This commit is contained in:
Gabriel MABILLE
2022-11-15 09:51:40 +01:00
committed by GitHub
co-authored by marefr
parent 80e80221b9
commit d999b5bda0
10 changed files with 37 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/acimpl/service.go
+1 -1
View File
@@ -220,7 +220,7 @@ func (s *Service) DeclarePluginRoles(_ context.Context, ID, name string, regs []
return nil
}
acRegs := pluginutils.ToRegistrations(name, regs)
acRegs := pluginutils.ToRegistrations(ID, name, regs)
for _, r := range acRegs {
if err := pluginutils.ValidatePluginRole(ID, r.Role); err != nil {
return err
pkg/services/accesscontrol/acimpl/service_test.go
+8 -19
View File
@@ -175,31 +175,19 @@ func TestService_DeclarePluginRoles(t *testing.T) {
pluginID: "test-app",
registrations: []plugins.RoleRegistration{
{
Role: plugins.Role{Name: "plugins:test-app:test"},
Role: plugins.Role{Name: "Tester"},
Grants: []string{"Admin"},
},
},
wantErr: false,
},
{
name: "should fail registration invalid role name",
pluginID: "test-app",
registrations: []plugins.RoleRegistration{
{
Role: plugins.Role{Name: "invalid.plugins:test-app:test"},
Grants: []string{"Admin"},
},
},
wantErr: true,
err: &accesscontrol.ErrorInvalidRole{},
},
{
name: "should add registration with valid permissions",
pluginID: "test-app",
registrations: []plugins.RoleRegistration{
{
Role: plugins.Role{
Name: "plugins:test-app:test",
Name: "Tester",
Permissions: []plugins.Permission{
{Action: "plugins.app:access"},
{Action: "test-app:read"},
@@ -217,7 +205,7 @@ func TestService_DeclarePluginRoles(t *testing.T) {
registrations: []plugins.RoleRegistration{
{
Role: plugins.Role{
Name: "plugins:test-app:test",
Name: "Tester",
Permissions: []plugins.Permission{
{Action: "invalid.test-app.resource:read"},
},
@@ -233,7 +221,7 @@ func TestService_DeclarePluginRoles(t *testing.T) {
pluginID: "test-app",
registrations: []plugins.RoleRegistration{
{
Role: plugins.Role{Name: "plugins:test-app:test"},
Role: plugins.Role{Name: "Tester"},
Grants: []string{"WrongAdmin"},
},
},
@@ -245,11 +233,11 @@ func TestService_DeclarePluginRoles(t *testing.T) {
pluginID: "test-app",
registrations: []plugins.RoleRegistration{
{
Role: plugins.Role{Name: "plugins:test-app:test"},
Role: plugins.Role{Name: "Tester"},
Grants: []string{"Admin"},
},
{
Role: plugins.Role{Name: "plugins:test-app:test2"},
Role: plugins.Role{Name: "Tester2"},
Grants: []string{"Admin"},
},
},
@@ -335,7 +323,8 @@ func TestService_RegisterFixedRoles(t *testing.T) {
registrations: []accesscontrol.RoleRegistration{
{
Role: accesscontrol.RoleDTO{
Name: "plugins:test-app:test",
Name: accesscontrol.PluginRolePrefix + "test-app:tester",
DisplayName: "Tester",
Permissions: []accesscontrol.Permission{{Action: "test-app:test"}},
},
Grants: []string{"Editor"},
pkg/services/accesscontrol/pluginutils/utils.go
+8 -3
View File
@@ -1,6 +1,7 @@
package pluginutils
import (
"fmt"
"strings"
"github.com/grafana/grafana/pkg/plugins"
@@ -34,14 +35,14 @@ func ValidatePluginRole(pluginID string, role ac.RoleDTO) error {
return ValidatePluginPermissions(pluginID, role.Permissions)
}
func ToRegistrations(pluginName string, regs []plugins.RoleRegistration) []ac.RoleRegistration {
func ToRegistrations(pluginID, pluginName string, regs []plugins.RoleRegistration) []ac.RoleRegistration {
res := make([]ac.RoleRegistration, 0, len(regs))
for i := range regs {
res = append(res, ac.RoleRegistration{
Role: ac.RoleDTO{
Version: 1,
Name: regs[i].Role.Name,
DisplayName: regs[i].Role.DisplayName,
Name: roleName(pluginID, regs[i].Role.Name),
DisplayName: regs[i].Role.Name,
Description: regs[i].Role.Description,
Group: pluginName,
Permissions: toPermissions(regs[i].Role.Permissions),
@@ -53,6 +54,10 @@ func ToRegistrations(pluginName string, regs []plugins.RoleRegistration) []ac.Ro
return res
}
func roleName(pluginID, roleName string) string {
return fmt.Sprintf("%v%v:%v", ac.PluginRolePrefix, pluginID, strings.Replace(strings.ToLower(roleName), " ", "-", -1))
}
func toPermissions(perms []plugins.Permission) []ac.Permission {
res := make([]ac.Permission, 0, len(perms))
for i := range perms {
pkg/services/accesscontrol/pluginutils/utils_test.go
+9 -9
View File
@@ -24,8 +24,7 @@ func TestToRegistrations(t *testing.T) {
regs: []plugins.RoleRegistration{
{
Role: plugins.Role{
Name: "test:name",
DisplayName: "Test",
Name: "Tester",
Description: "Test",
Permissions: []plugins.Permission{
{Action: "test:action"},
@@ -36,7 +35,7 @@ func TestToRegistrations(t *testing.T) {
},
{
Role: plugins.Role{
Name: "test:name",
Name: "Admin Validator",
Permissions: []plugins.Permission{},
},
},
@@ -45,10 +44,10 @@ func TestToRegistrations(t *testing.T) {
{
Role: ac.RoleDTO{
Version: 1,
Name: "test:name",
DisplayName: "Test",
Name: ac.PluginRolePrefix + "plugin-id:tester",
DisplayName: "Tester",
Description: "Test",
Group: "PluginName",
Group: "Plugin Name",
Permissions: []ac.Permission{
{Action: "test:action"},
{Action: "test:action", Scope: "test:scope"},
@@ -60,8 +59,9 @@ func TestToRegistrations(t *testing.T) {
{
Role: ac.RoleDTO{
Version: 1,
Name: "test:name",
Group: "PluginName",
Name: ac.PluginRolePrefix + "plugin-id:admin-validator",
DisplayName: "Admin Validator",
Group: "Plugin Name",
Permissions: []ac.Permission{},
OrgID: ac.GlobalOrgID,
},
@@ -71,7 +71,7 @@ func TestToRegistrations(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got := ToRegistrations("PluginName", tt.regs)
got := ToRegistrations("plugin-id", "Plugin Name", tt.regs)
require.Equal(t, tt.want, got)
})
}