public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Permission check performance improvements for the new search (#60729)

Browse Source 
* Add checker and update the resource filter function for new search

* Add tests for checker

* small fixes

* handle location for panels correctly

* clean up checker code and extend the tests for it

* more fixes, but tests don't quite work yet

* a small change to return error

* cleanup

* more simplification

* fix tests

* correct wrong argument ordering & use constant

* Apply suggestions from code review

Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>

* import

* check general folder from permission checker function

* handle root folder aka general folder properly

* update tests

* clean up

* lint

* add fix from main

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>
This commit is contained in:
Ieva
2023-01-27 12:12:30 +00:00
committed by GitHub
co-authored by Artur Wierzbicki Karl Persson
parent dab3fac01b
commit eb9ef34272
27 changed files with 289 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/searchV2/auth.go
+22 -19
View File
@@ -7,21 +7,20 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
"github.com/grafana/grafana/pkg/services/user"
)
// ResourceFilter checks if a given a uid (resource identifier) check if we have the requested permission
type ResourceFilter func(uid string) bool
type ResourceFilter func(kind entityKind, uid, parentUID string) bool
// FutureAuthService eventually implemented by the security service
type FutureAuthService interface {
GetDashboardReadFilter(user *user.SignedInUser) (ResourceFilter, error)
}
var _ FutureAuthService = (*simpleSQLAuthService)(nil)
var _ FutureAuthService = (*simpleAuthService)(nil)
type simpleSQLAuthService struct {
type simpleAuthService struct {
sql db.DB
ac accesscontrol.Service
}
@@ -30,22 +29,26 @@ type dashIdQueryResult struct {
UID string `xorm:"uid"`
}
func (a *simpleSQLAuthService) getDashboardTableAuthFilter(user *user.SignedInUser) searchstore.FilterWhere {
if a.ac.IsDisabled() {
return permissions.DashboardPermissionFilter{
OrgRole: user.OrgRole,
OrgId: user.OrgID,
Dialect: a.sql.GetDialect(),
UserId: user.UserID,
PermissionLevel: dashboards.PERMISSION_VIEW,
}
func (a *simpleAuthService) GetDashboardReadFilter(user *user.SignedInUser) (ResourceFilter, error) {
if !a.ac.IsDisabled() {
canReadDashboard, canReadFolder := accesscontrol.Checker(user, dashboards.ActionDashboardsRead), accesscontrol.Checker(user, dashboards.ActionFoldersRead)
return func(kind entityKind, uid, parent string) bool {
if kind == entityKindFolder {
return canReadFolder(dashboards.ScopeFoldersProvider.GetResourceScopeUID(uid))
} else if kind == entityKindDashboard {
return canReadDashboard(dashboards.ScopeDashboardsProvider.GetResourceScopeUID(uid), dashboards.ScopeFoldersProvider.GetResourceScopeUID(parent))
}
return false
}, nil
}
return permissions.NewAccessControlDashboardPermissionFilter(user, dashboards.PERMISSION_VIEW, "")
}
func (a *simpleSQLAuthService) GetDashboardReadFilter(user *user.SignedInUser) (ResourceFilter, error) {
filter := a.getDashboardTableAuthFilter(user)
filter := permissions.DashboardPermissionFilter{
OrgRole: user.OrgRole,
OrgId: user.OrgID,
Dialect: a.sql.GetDialect(),
UserId: user.UserID,
PermissionLevel: dashboards.PERMISSION_VIEW,
}
rows := make([]*dashIdQueryResult, 0)
err := a.sql.WithDbSession(context.Background(), func(sess *db.Session) error {
@@ -72,7 +75,7 @@ func (a *simpleSQLAuthService) GetDashboardReadFilter(user *user.SignedInUser) (
uids[rows[i].UID] = true
}
return func(uid string) bool {
return func(_ entityKind, uid, _ string) bool {
return uids[uid]
}, err
}