From ef8ad0f74ae90ff586da7dc670f583ea9910ed5c Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Tue, 7 Jun 2022 18:43:33 -0400 Subject: [PATCH] Bump provisioning to admin-only in lieu of dedicated RBAC permissions (#50366) (#50367) (cherry picked from commit 28a47b56d2ea84c0289bc0c38eb934600f97be84) Co-authored-by: Alexander Weaver --- pkg/services/ngalert/api/authorization.go | 4 +- .../api/alerting/api_provisioning_test.go | 40 +++++++++---------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/pkg/services/ngalert/api/authorization.go b/pkg/services/ngalert/api/authorization.go index 479b1398e84..024158a40bc 100644 --- a/pkg/services/ngalert/api/authorization.go +++ b/pkg/services/ngalert/api/authorization.go @@ -186,7 +186,7 @@ func (api *API) authorize(method, path string) web.Handler { http.MethodGet + "/api/v1/provisioning/mute-timings", http.MethodGet + "/api/v1/provisioning/mute-timings/{name}", http.MethodGet + "/api/v1/provisioning/alert-rules/{UID}": - return middleware.ReqSignedIn + return middleware.ReqOrgAdmin case http.MethodPut + "/api/v1/provisioning/policies", http.MethodPost + "/api/v1/provisioning/contact-points", @@ -201,7 +201,7 @@ func (api *API) authorize(method, path string) web.Handler { http.MethodPut + "/api/v1/provisioning/alert-rules/{UID}", http.MethodDelete + "/api/v1/provisioning/alert-rules/{UID}", http.MethodPut + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}": - return middleware.ReqEditorRole + return middleware.ReqOrgAdmin } if eval != nil { diff --git a/pkg/tests/api/alerting/api_provisioning_test.go b/pkg/tests/api/alerting/api_provisioning_test.go index 197dfa4d57f..7643ea0c86b 100644 --- a/pkg/tests/api/alerting/api_provisioning_test.go +++ b/pkg/tests/api/alerting/api_provisioning_test.go @@ -64,24 +64,24 @@ func TestProvisioning(t *testing.T) { require.Equal(t, 401, resp.StatusCode) }) - t.Run("viewer GET should succeed", func(t *testing.T) { + t.Run("viewer GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "viewer", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) - t.Run("editor GET should succeed", func(t *testing.T) { + t.Run("editor GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "editor", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) t.Run("admin GET should succeed", func(t *testing.T) { @@ -114,14 +114,14 @@ func TestProvisioning(t *testing.T) { require.Equal(t, 403, resp.StatusCode) }) - t.Run("editor PUT should succeed", func(t *testing.T) { + t.Run("editor PUT should 403", func(t *testing.T) { req := createTestRequest("PUT", url, "editor", body) resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 202, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) t.Run("admin PUT should succeed", func(t *testing.T) { @@ -157,24 +157,24 @@ func TestProvisioning(t *testing.T) { require.Equal(t, 401, resp.StatusCode) }) - t.Run("viewer GET should succeed", func(t *testing.T) { + t.Run("viewer GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "viewer", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) - t.Run("editor GET should succeed", func(t *testing.T) { + t.Run("editor GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "editor", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) t.Run("admin GET should succeed", func(t *testing.T) { @@ -207,14 +207,14 @@ func TestProvisioning(t *testing.T) { require.Equal(t, 403, resp.StatusCode) }) - t.Run("editor POST should succeed", func(t *testing.T) { + t.Run("editor POST should 403", func(t *testing.T) { req := createTestRequest("POST", url, "editor", body) resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 202, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) t.Run("admin POST should succeed", func(t *testing.T) { @@ -241,24 +241,24 @@ func TestProvisioning(t *testing.T) { require.Equal(t, 401, resp.StatusCode) }) - t.Run("viewer GET should succeed", func(t *testing.T) { + t.Run("viewer GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "viewer", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) - t.Run("editor GET should succeed", func(t *testing.T) { + t.Run("editor GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "editor", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) t.Run("admin GET should succeed", func(t *testing.T) { @@ -285,24 +285,24 @@ func TestProvisioning(t *testing.T) { require.Equal(t, 401, resp.StatusCode) }) - t.Run("viewer GET should succeed", func(t *testing.T) { + t.Run("viewer GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "viewer", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) - t.Run("editor GET should succeed", func(t *testing.T) { + t.Run("editor GET should 403", func(t *testing.T) { req := createTestRequest("GET", url, "editor", "") resp, err := http.DefaultClient.Do(req) require.NoError(t, err) require.NoError(t, resp.Body.Close()) - require.Equal(t, 200, resp.StatusCode) + require.Equal(t, 403, resp.StatusCode) }) t.Run("admin GET should succeed", func(t *testing.T) {