Access control: SQL filtering for annotation listing (#47467)
* pass in user to attribute scope resolver * add SQL filter to annotation listing * check annotation FGAC permissions before exposing them for commenting * remove the requirement to be able to list all annotations from annotation listing endpoint * adding tests for annotation listing * remove changes that got moved to a different PR * unused var * Update pkg/services/sqlstore/annotation.go Co-authored-by: Ezequiel Victorero <evictorero@gmail.com> * remove unneeded check * remove unneeded check * undo accidental change * undo accidental change * doc update * move tests * redo the approach for passing the user in for scope resolution * accidental change * cleanup * error handling Co-authored-by: Ezequiel Victorero <evictorero@gmail.com>
This commit is contained in:
Ieva
co-authored by
Ezequiel Victorero
Ezequiel Victorero
parent
4bc582570e
commit
ef4c2672b3
@@ -1,27 +1,32 @@
|
||||
//go:build integration
|
||||
// +build integration
|
||||
|
||||
package sqlstore
|
||||
package sqlstore_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/grafana/grafana/pkg/components/simplejson"
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/accesscontrol"
|
||||
"github.com/grafana/grafana/pkg/services/annotations"
|
||||
dashboardstore "github.com/grafana/grafana/pkg/services/dashboards/database"
|
||||
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
||||
"github.com/grafana/grafana/pkg/services/sqlstore"
|
||||
)
|
||||
|
||||
func TestAnnotations(t *testing.T) {
|
||||
mockTimeNow()
|
||||
defer resetTimeNow()
|
||||
|
||||
repo := SQLAnnotationRepo{}
|
||||
repo.sql = InitTestDB(t)
|
||||
sql := sqlstore.InitTestDB(t)
|
||||
repo := sqlstore.NewSQLAnnotationRepo(sql)
|
||||
|
||||
t.Run("Testing annotation create, read, update and delete", func(t *testing.T) {
|
||||
t.Cleanup(func() {
|
||||
err := repo.sql.WithDbSession(context.Background(), func(dbSession *DBSession) error {
|
||||
err := sql.WithDbSession(context.Background(), func(dbSession *sqlstore.DBSession) error {
|
||||
_, err := dbSession.Exec("DELETE FROM annotation WHERE 1=1")
|
||||
if err != nil {
|
||||
return err
|
||||
@@ -331,3 +336,136 @@ func TestAnnotations(t *testing.T) {
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
func TestAnnotationListingWithFGAC(t *testing.T) {
|
||||
sql := sqlstore.InitTestDB(t)
|
||||
sql.Cfg.IsFeatureToggleEnabled = func(key string) bool {
|
||||
return key == featuremgmt.FlagAccesscontrol
|
||||
}
|
||||
repo := sqlstore.NewSQLAnnotationRepo(sql)
|
||||
dashboardStore := dashboardstore.ProvideDashboardStore(sql)
|
||||
|
||||
testDashboard1 := models.SaveDashboardCommand{
|
||||
UserId: 1,
|
||||
OrgId: 1,
|
||||
Dashboard: simplejson.NewFromAny(map[string]interface{}{
|
||||
"title": "Dashboard 1",
|
||||
}),
|
||||
}
|
||||
dashboard, err := dashboardStore.SaveDashboard(testDashboard1)
|
||||
require.NoError(t, err)
|
||||
dash1UID := dashboard.Uid
|
||||
|
||||
testDashboard2 := models.SaveDashboardCommand{
|
||||
UserId: 1,
|
||||
OrgId: 1,
|
||||
Dashboard: simplejson.NewFromAny(map[string]interface{}{
|
||||
"title": "Dashboard 2",
|
||||
}),
|
||||
}
|
||||
_, err = dashboardStore.SaveDashboard(testDashboard2)
|
||||
require.NoError(t, err)
|
||||
|
||||
dash1Annotation := &annotations.Item{
|
||||
OrgId: 1,
|
||||
DashboardId: 1,
|
||||
Epoch: 10,
|
||||
}
|
||||
err = repo.Save(dash1Annotation)
|
||||
require.NoError(t, err)
|
||||
|
||||
dash2Annotation := &annotations.Item{
|
||||
OrgId: 1,
|
||||
DashboardId: 2,
|
||||
Epoch: 10,
|
||||
}
|
||||
err = repo.Save(dash2Annotation)
|
||||
require.NoError(t, err)
|
||||
|
||||
organizationAnnotation := &annotations.Item{
|
||||
OrgId: 1,
|
||||
Epoch: 10,
|
||||
}
|
||||
err = repo.Save(organizationAnnotation)
|
||||
require.NoError(t, err)
|
||||
|
||||
user := &models.SignedInUser{
|
||||
UserId: 1,
|
||||
OrgId: 1,
|
||||
}
|
||||
|
||||
type testStruct struct {
|
||||
description string
|
||||
permissions map[string][]string
|
||||
expectedAnnotationIds []int64
|
||||
expectedError bool
|
||||
}
|
||||
|
||||
testCases := []testStruct{
|
||||
{
|
||||
description: "Should find all annotations when has permissions to list all annotations and read all dashboards",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsAll},
|
||||
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
|
||||
},
|
||||
expectedAnnotationIds: []int64{dash1Annotation.Id, dash2Annotation.Id, organizationAnnotation.Id},
|
||||
},
|
||||
{
|
||||
description: "Should find all dashboard annotations",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeDashboard},
|
||||
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
|
||||
},
|
||||
expectedAnnotationIds: []int64{dash1Annotation.Id, dash2Annotation.Id},
|
||||
},
|
||||
{
|
||||
description: "Should find only annotations from dashboards that user can read",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeDashboard},
|
||||
accesscontrol.ActionDashboardsRead: {fmt.Sprintf("dashboards:uid:%s", dash1UID)},
|
||||
},
|
||||
expectedAnnotationIds: []int64{dash1Annotation.Id},
|
||||
},
|
||||
{
|
||||
description: "Should find no annotations if user can't view dashboards or organization annotations",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeDashboard},
|
||||
},
|
||||
expectedAnnotationIds: []int64{},
|
||||
},
|
||||
{
|
||||
description: "Should find only organization annotations",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeOrganization},
|
||||
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
|
||||
},
|
||||
expectedAnnotationIds: []int64{organizationAnnotation.Id},
|
||||
},
|
||||
{
|
||||
description: "Should error if user doesn't have annotation read permissions",
|
||||
permissions: map[string][]string{
|
||||
accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
|
||||
},
|
||||
expectedError: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.description, func(t *testing.T) {
|
||||
user.Permissions = map[int64]map[string][]string{1: tc.permissions}
|
||||
results, err := repo.Find(context.Background(), &annotations.ItemQuery{
|
||||
OrgId: 1,
|
||||
SignedInUser: user,
|
||||
})
|
||||
if tc.expectedError {
|
||||
require.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, results, len(tc.expectedAnnotationIds))
|
||||
for _, r := range results {
|
||||
assert.Contains(t, tc.expectedAnnotationIds, r.Id)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user