public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: move dashboard_acl models into dashboard service (#62151)

Browse Source
This commit is contained in:
Kristin Laemmert
2023-01-26 08:46:30 -05:00
committed by GitHub
parent c5cb5be3cc
commit e8b8a9e276
65 changed files with 553 additions and 572 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/permissions/dashboard.go
+4 -5
View File
@@ -3,7 +3,6 @@ package permissions
import (
"strings"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/org"
@@ -17,7 +16,7 @@ type DashboardPermissionFilter struct {
Dialect migrator.Dialect
UserId int64
OrgId int64
PermissionLevel models.PermissionType
PermissionLevel dashboards.PermissionType
}
func (d DashboardPermissionFilter) Where() (string, []interface{}) {
@@ -85,9 +84,9 @@ type AccessControlDashboardPermissionFilter struct {
folderActions []string
}
// NewAccessControlDashboardPermissionFilter creates a new AccessControlDashboardPermissionFilter that is configured with specific actions calculated based on the models.PermissionType and query type
func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissionLevel models.PermissionType, queryType string) AccessControlDashboardPermissionFilter {
needEdit := permissionLevel > models.PERMISSION_VIEW
// NewAccessControlDashboardPermissionFilter creates a new AccessControlDashboardPermissionFilter that is configured with specific actions calculated based on the dashboards.PermissionType and query type
func NewAccessControlDashboardPermissionFilter(user *user.SignedInUser, permissionLevel dashboards.PermissionType, queryType string) AccessControlDashboardPermissionFilter {
needEdit := permissionLevel > dashboards.PERMISSION_VIEW
var folderActions []string
var dashboardActions []string
pkg/services/sqlstore/permissions/dashboard_test.go
+13 -13
View File
@@ -6,9 +6,11 @@ import (
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/org"
@@ -16,8 +18,6 @@ import (
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestIntegration_DashboardPermissionFilter(t *testing.T) {
@@ -28,7 +28,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
type testCase struct {
desc string
queryType string
permission models.PermissionType
permission dashboards.PermissionType
permissions []accesscontrol.Permission
expectedResult int
}
@@ -36,7 +36,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
tests := []testCase{
{
desc: "Should be able to view all dashboards with wildcard scope",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionDashboardsRead, Scope: dashboards.ScopeDashboardsAll},
},
@@ -44,7 +44,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should be able to view all dashboards with folder wildcard scope",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionDashboardsRead, Scope: dashboards.ScopeFoldersAll},
},
@@ -52,7 +52,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should be able to view a subset of dashboards with dashboard scopes",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionDashboardsRead, Scope: "dashboards:uid:110"},
{Action: dashboards.ActionDashboardsRead, Scope: "dashboards:uid:40"},
@@ -65,7 +65,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should be able to view a subset of dashboards with dashboard action and folder scope",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:8"},
{Action: dashboards.ActionDashboardsRead, Scope: "folders:uid:10"},
@@ -74,7 +74,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should be able to view all folders with folder wildcard",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:*"},
},
@@ -82,7 +82,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should be able to view a subset folders",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:3"},
{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:6"},
@@ -92,7 +92,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should return folders and dashboard with 'edit' permission",
permission: models.PERMISSION_EDIT,
permission: dashboards.PERMISSION_EDIT,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:3"},
{Action: dashboards.ActionDashboardsCreate, Scope: "folders:uid:3"},
@@ -103,7 +103,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should return folders that users can read alerts from",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
queryType: searchstore.TypeAlertFolder,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionFoldersRead, Scope: "folders:uid:3"},
@@ -115,7 +115,7 @@ func TestIntegration_DashboardPermissionFilter(t *testing.T) {
},
{
desc: "Should return folders that users can read alerts when user has read wildcard",
permission: models.PERMISSION_VIEW,
permission: dashboards.PERMISSION_VIEW,
queryType: searchstore.TypeAlertFolder,
permissions: []accesscontrol.Permission{
{Action: dashboards.ActionFoldersRead, Scope: "*"},
pkg/services/sqlstore/permissions/dashboards_bench_test.go
+4 -4
View File
@@ -7,17 +7,17 @@ import (
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/grafana/grafana/pkg/components/simplejson"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/user"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func benchmarkDashboardPermissionFilter(b *testing.B, numUsers, numDashboards int) {
@@ -25,7 +25,7 @@ func benchmarkDashboardPermissionFilter(b *testing.B, numUsers, numDashboards in
b.ResetTimer()
for i := 0; i < b.N; i++ {
usr := &user.SignedInUser{UserID: 1, OrgID: 1, OrgRole: org.RoleViewer, Permissions: map[int64]map[string][]string{1: {}}}
filter := permissions.NewAccessControlDashboardPermissionFilter(usr, models.PERMISSION_VIEW, "")
filter := permissions.NewAccessControlDashboardPermissionFilter(usr, dashboards.PERMISSION_VIEW, "")
var result int
err := store.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
q, params := filter.Where()