public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Team: Create permission type for team membership (#92352)

Browse Source 
* Create permission type enum for team and remove usage of dashboard permission type
This commit is contained in:
Karl Persson
2024-08-23 12:34:34 +02:00
committed by GitHub
parent 927ce6c700
commit ddee95cb6d
10 changed files with 93 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/migrations/accesscontrol/team_membership.go
+4 -5
View File
@@ -8,7 +8,6 @@ import (
"xorm.io/xorm"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards/dashboardaccess"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
"github.com/grafana/grafana/pkg/services/team"
@@ -64,12 +63,12 @@ func (p *teamPermissionMigrator) setRolePermissions(roleID int64, permissions []
}
// mapPermissionToRBAC translates the legacy membership (Member or Admin) into RBAC permissions
func (p *teamPermissionMigrator) mapPermissionToRBAC(permission dashboardaccess.PermissionType, teamID int64) []accesscontrol.Permission {
func (p *teamPermissionMigrator) mapPermissionToRBAC(permission team.PermissionType, teamID int64) []accesscontrol.Permission {
teamIDScope := accesscontrol.Scope("teams", "id", strconv.FormatInt(teamID, 10))
switch permission {
case 0:
case team.PermissionTypeMember:
return []accesscontrol.Permission{{Action: "teams:read", Scope: teamIDScope}}
case dashboardaccess.PERMISSION_ADMIN:
case team.PermissionTypeAdmin:
return []accesscontrol.Permission{
{Action: "teams:delete", Scope: teamIDScope},
{Action: "teams:read", Scope: teamIDScope},
@@ -210,7 +209,7 @@ func (p *teamPermissionMigrator) generateAssociatedPermissions(teamMemberships [
// Downgrade team permissions if needed:
// only admins or editors (when editorsCanAdmin option is enabled)
// can access team administration endpoints
if m.Permission == dashboardaccess.PERMISSION_ADMIN {
if m.Permission == team.PermissionTypeAdmin {
if userRolesByOrg[m.OrgID][m.UserID] == string(org.RoleViewer) || (userRolesByOrg[m.OrgID][m.UserID] == string(org.RoleEditor) && !p.editorsCanAdmin) {
m.Permission = 0
pkg/services/sqlstore/migrations/accesscontrol/test/ac_test.go
+5 -6
View File
@@ -12,7 +12,6 @@ import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards/dashboardaccess"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore/migrations"
@@ -328,7 +327,7 @@ func setupTeams(t *testing.T, x *xorm.Engine) {
TeamID: 1,
UserID: 1,
External: false,
Permission: 0,
Permission: team.PermissionTypeMember,
Created: now,
Updated: now,
},
@@ -338,7 +337,7 @@ func setupTeams(t *testing.T, x *xorm.Engine) {
TeamID: 1,
UserID: 2,
External: false,
Permission: dashboardaccess.PERMISSION_ADMIN,
Permission: team.PermissionTypeAdmin,
Created: now,
Updated: now,
},
@@ -348,7 +347,7 @@ func setupTeams(t *testing.T, x *xorm.Engine) {
TeamID: 1,
UserID: 3,
External: false,
Permission: dashboardaccess.PERMISSION_ADMIN,
Permission: team.PermissionTypeAdmin,
Created: now,
Updated: now,
},
@@ -358,7 +357,7 @@ func setupTeams(t *testing.T, x *xorm.Engine) {
TeamID: 1,
UserID: 4,
External: false,
Permission: dashboardaccess.PERMISSION_ADMIN,
Permission: team.PermissionTypeAdmin,
Created: now,
Updated: now,
},
@@ -368,7 +367,7 @@ func setupTeams(t *testing.T, x *xorm.Engine) {
TeamID: 2,
UserID: 5,
External: false,
Permission: 0,
Permission: team.PermissionTypeMember,
Created: now,
Updated: now,
},