public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v11.0.x] Access Control: Clean up permissions for deprovisioned data sources (#88700)

Browse Source 
merge
This commit is contained in:
Ieva
2024-06-05 10:49:41 +03:00
committed by GitHub
parent 02699ea1af
commit dde92e457c
7 changed files with 89 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/datasources/service/datasource_test.go
+65
View File
@@ -364,6 +364,71 @@ func TestService_UpdateDataSource(t *testing.T) {
})
}
func TestService_DeleteDataSource(t *testing.T) {
t.Run("should not return an error if data source doesn't exist", func(t *testing.T) {
sqlStore := db.InitTestDB(t)
secretsService := secretsmng.SetupTestService(t, fakes.NewFakeSecretsStore())
secretsStore := secretskvs.NewSQLSecretsKVStore(sqlStore, secretsService, log.New("test.logger"))
quotaService := quotatest.New(false, nil)
permissionSvc := acmock.NewMockedPermissionsService()
permissionSvc.On("DeleteResourcePermissions", mock.Anything, mock.Anything, mock.Anything).Return(nil).Maybe()
dsService, err := ProvideService(sqlStore, secretsService, secretsStore, &setting.Cfg{}, featuremgmt.WithFeatures(), acmock.New(), permissionSvc, quotaService, &pluginstore.FakePluginStore{})
require.NoError(t, err)
cmd := &datasources.DeleteDataSourceCommand{
UID: uuid.New().String(),
ID: 1,
OrgID: 1,
}
err = dsService.DeleteDataSource(context.Background(), cmd)
require.NoError(t, err)
})
t.Run("should successfully delete a data source that exists", func(t *testing.T) {
sqlStore := db.InitTestDB(t)
secretsService := secretsmng.SetupTestService(t, fakes.NewFakeSecretsStore())
secretsStore := secretskvs.NewSQLSecretsKVStore(sqlStore, secretsService, log.New("test.logger"))
quotaService := quotatest.New(false, nil)
permissionSvc := acmock.NewMockedPermissionsService()
permissionSvc.On("SetPermissions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([]accesscontrol.ResourcePermission{}, nil).Once()
permissionSvc.On("DeleteResourcePermissions", mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
dsService, err := ProvideService(sqlStore, secretsService, secretsStore, &setting.Cfg{}, featuremgmt.WithFeatures(), acmock.New(), permissionSvc, quotaService, &pluginstore.FakePluginStore{})
require.NoError(t, err)
// First add the datasource
ds, err := dsService.AddDataSource(context.Background(), &datasources.AddDataSourceCommand{
OrgID: 1,
Name: "test",
Type: "test",
UserID: 0,
})
require.NoError(t, err)
cmd := &datasources.DeleteDataSourceCommand{
ID: ds.ID,
UID: ds.UID,
OrgID: 1,
}
err = dsService.DeleteDataSource(context.Background(), cmd)
require.NoError(t, err)
// Data source doesn't exist anymore
ds, err = dsService.GetDataSource(context.Background(), &datasources.GetDataSourceQuery{
OrgID: 1,
UID: ds.UID,
})
require.Nil(t, ds)
require.ErrorIs(t, err, datasources.ErrDataSourceNotFound)
permissionSvc.AssertExpectations(t)
})
}
func TestService_NameScopeResolver(t *testing.T) {
retriever := &dataSourceMockRetriever{[]*datasources.DataSource{
{Name: "test-datasource", UID: "1"},
pkg/services/datasources/service/store.go
-7
View File
@@ -14,7 +14,6 @@ import (
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/metrics"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/datasources"
"github.com/grafana/grafana/pkg/services/quota"
"github.com/grafana/grafana/pkg/services/sqlstore"
@@ -158,12 +157,6 @@ func (ss *SqlStore) DeleteDataSource(ctx context.Context, cmd *datasources.Delet
}
cmd.DeletedDatasourcesCount, _ = result.RowsAffected()
// Remove associated AccessControl permissions
if _, errDeletingPerms := sess.Exec("DELETE FROM permission WHERE scope=?",
ac.Scope(datasources.ScopeProvider.GetResourceScope(ds.UID))); errDeletingPerms != nil {
return errDeletingPerms
}
}
if cmd.UpdateSecretFn != nil {
pkg/services/datasources/service/store_test.go
-41
View File
@@ -12,7 +12,6 @@ import (
"github.com/grafana/grafana/pkg/events"
"github.com/grafana/grafana/pkg/infra/db"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/datasources"
)
@@ -308,46 +307,6 @@ func TestIntegrationDataAccess(t *testing.T) {
require.Equal(t, 0, len(dataSources))
})
t.Run("DeleteDataSourceAccessControlPermissions", func(t *testing.T) {
store := db.InitTestDB(t)
ds := initDatasource(store)
ss := SqlStore{db: store}
// Init associated permission
errAddPermissions := store.WithTransactionalDbSession(context.TODO(), func(sess *db.Session) error {
_, err := sess.Table("permission").Insert(ac.Permission{
RoleID: 1,
Action: "datasources:read",
Scope: datasources.ScopeProvider.GetResourceScope(ds.UID),
Updated: time.Now(),
Created: time.Now(),
})
return err
})
require.NoError(t, errAddPermissions)
query := datasources.GetDataSourcesQuery{OrgID: 10}
errDeletingDS := ss.DeleteDataSource(context.Background(),
&datasources.DeleteDataSourceCommand{Name: ds.Name, OrgID: ds.OrgID},
)
require.NoError(t, errDeletingDS)
// Check associated permission
permCount := int64(0)
errGetPermissions := store.WithTransactionalDbSession(context.TODO(), func(sess *db.Session) error {
var err error
permCount, err = sess.Table("permission").Count()
return err
})
require.NoError(t, errGetPermissions)
require.Zero(t, permCount, "permissions associated to the data source should have been removed")
dataSources, err := ss.GetDataSources(context.Background(), &query)
require.NoError(t, err)
require.Equal(t, 0, len(dataSources))
})
t.Run("GetDataSources", func(t *testing.T) {
t.Run("Number of data sources returned limited to 6 per organization", func(t *testing.T) {
db := db.InitTestDB(t)