public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Access control: expose SA frontend to users with the right permissions (#47727)

Browse Source 
* expose frontend to users with permissions

* cover the ui endpoints

* fix permissions
This commit is contained in:
Ieva
2022-04-14 12:40:15 +01:00
committed by GitHub
parent 6f31a69bfd
commit e50bd5cac8
7 changed files with 57 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/index.go
+6 -3
View File
@@ -149,8 +149,11 @@ func (hs *HTTPServer) getAppLinks(c *models.ReqContext) ([]*dtos.NavLink, error)
}
func enableServiceAccount(hs *HTTPServer, c *models.ReqContext) bool {
return (c.OrgRole == models.ROLE_ADMIN || (hs.Cfg.EditorsCanAdmin && c.OrgRole == models.ROLE_EDITOR)) &&
hs.Features.IsEnabled(featuremgmt.FlagServiceAccounts)
if !hs.Features.IsEnabled(featuremgmt.FlagServiceAccounts) {
return false
}
hasAccess := ac.HasAccess(hs.AccessControl, c)
return hasAccess(ac.ReqOrgAdmin, serviceAccountAccessEvaluator)
}
func (hs *HTTPServer) ReqCanAdminTeams(c *models.ReqContext) bool {
@@ -291,7 +294,7 @@ func (hs *HTTPServer) getNavTree(c *models.ReqContext, hasEditPerm bool) ([]*dto
})
}
if c.OrgRole == models.ROLE_ADMIN {
if hasAccess(ac.ReqOrgAdmin, apiKeyAccessEvaluator) {
configNodes = append(configNodes, &dtos.NavLink{
Text: "API keys",
Id: "apikeys",