public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump provisioning to admin-only in lieu of dedicated RBAC permissions (#50366) (#50367)

Browse Source 
(cherry picked from commit 28a47b56d2)

Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
This commit is contained in:
Grot (@grafanabot)
2022-06-08 00:43:33 +02:00
committed by GitHub
co-authored by Alexander Weaver
parent 2acf5ed0c0
commit ef8ad0f74a
2 changed files with 22 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/ngalert/api/authorization.go
+2 -2
View File
@@ -186,7 +186,7 @@ func (api *API) authorize(method, path string) web.Handler {
http.MethodGet + "/api/v1/provisioning/mute-timings",
http.MethodGet + "/api/v1/provisioning/mute-timings/{name}",
http.MethodGet + "/api/v1/provisioning/alert-rules/{UID}":
return middleware.ReqSignedIn
return middleware.ReqOrgAdmin
case http.MethodPut + "/api/v1/provisioning/policies",
http.MethodPost + "/api/v1/provisioning/contact-points",
@@ -201,7 +201,7 @@ func (api *API) authorize(method, path string) web.Handler {
http.MethodPut + "/api/v1/provisioning/alert-rules/{UID}",
http.MethodDelete + "/api/v1/provisioning/alert-rules/{UID}",
http.MethodPut + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}":
return middleware.ReqEditorRole
return middleware.ReqOrgAdmin
}
if eval != nil {
pkg/tests/api/alerting/api_provisioning_test.go
+20 -20
View File
@@ -64,24 +64,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode)
})
t.Run("viewer GET should succeed", func(t *testing.T) {
t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("editor GET should succeed", func(t *testing.T) {
t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("admin GET should succeed", func(t *testing.T) {
@@ -114,14 +114,14 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 403, resp.StatusCode)
})
t.Run("editor PUT should succeed", func(t *testing.T) {
t.Run("editor PUT should 403", func(t *testing.T) {
req := createTestRequest("PUT", url, "editor", body)
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 202, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("admin PUT should succeed", func(t *testing.T) {
@@ -157,24 +157,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode)
})
t.Run("viewer GET should succeed", func(t *testing.T) {
t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("editor GET should succeed", func(t *testing.T) {
t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("admin GET should succeed", func(t *testing.T) {
@@ -207,14 +207,14 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 403, resp.StatusCode)
})
t.Run("editor POST should succeed", func(t *testing.T) {
t.Run("editor POST should 403", func(t *testing.T) {
req := createTestRequest("POST", url, "editor", body)
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 202, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("admin POST should succeed", func(t *testing.T) {
@@ -241,24 +241,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode)
})
t.Run("viewer GET should succeed", func(t *testing.T) {
t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("editor GET should succeed", func(t *testing.T) {
t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("admin GET should succeed", func(t *testing.T) {
@@ -285,24 +285,24 @@ func TestProvisioning(t *testing.T) {
require.Equal(t, 401, resp.StatusCode)
})
t.Run("viewer GET should succeed", func(t *testing.T) {
t.Run("viewer GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "viewer", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("editor GET should succeed", func(t *testing.T) {
t.Run("editor GET should 403", func(t *testing.T) {
req := createTestRequest("GET", url, "editor", "")
resp, err := http.DefaultClient.Do(req)
require.NoError(t, err)
require.NoError(t, resp.Body.Close())
require.Equal(t, 200, resp.StatusCode)
require.Equal(t, 403, resp.StatusCode)
})
t.Run("admin GET should succeed", func(t *testing.T) {