public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AccessControl: Enable RBAC by default (#48813)

Browse Source 
* Add RBAC section to settings

* Default to RBAC enabled settings to true

* Update tests to respect RBAC

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
This commit is contained in:
Ieva
2022-05-16 12:45:41 +02:00
committed by GitHub
co-authored by Karl Persson
parent 3106af9eec
commit f256f625d8
40 changed files with 540 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tests/api/alerting/api_prometheus_test.go
+68 -18
View File
@@ -16,7 +16,9 @@ import (
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/models"
dashboardsstore "github.com/grafana/grafana/pkg/services/dashboards/database"
"github.com/grafana/grafana/pkg/services/accesscontrol"
acdb "github.com/grafana/grafana/pkg/services/accesscontrol/database"
"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions/types"
apimodels "github.com/grafana/grafana/pkg/services/ngalert/api/tooling/definitions"
ngmodels "github.com/grafana/grafana/pkg/services/ngalert/models"
"github.com/grafana/grafana/pkg/tests/testinfra"
@@ -35,10 +37,6 @@ func TestPrometheusRules(t *testing.T) {
grafanaListedAddr, store := testinfra.StartGrafana(t, dir, path)
// Create the namespace under default organisation (orgID = 1) where we'll save our alerts to.
_, err = createFolder(t, store, 0, "default")
require.NoError(t, err)
// Create a user to make authenticated requests
createUser(t, store, models.CreateUserCommand{
DefaultOrgRole: string(models.ROLE_EDITOR),
@@ -46,6 +44,11 @@ func TestPrometheusRules(t *testing.T) {
Login: "grafana",
})
// Create the namespace we'll save our alerts to.
err = createFolder(t, "default", grafanaListedAddr, "grafana", "password")
require.NoError(t, err)
reloadCachedPermissions(t, grafanaListedAddr, "grafana", "password")
interval, err := model.ParseDuration("10s")
require.NoError(t, err)
@@ -330,10 +333,6 @@ func TestPrometheusRulesFilterByDashboard(t *testing.T) {
grafanaListedAddr, store := testinfra.StartGrafana(t, dir, path)
// Create the namespace under default organisation (orgID = 1) where we'll save our alerts to.
dashboardUID, err := createFolder(t, store, 0, "default")
require.NoError(t, err)
// Create a user to make authenticated requests
createUser(t, store, models.CreateUserCommand{
DefaultOrgRole: string(models.ROLE_EDITOR),
@@ -341,6 +340,12 @@ func TestPrometheusRulesFilterByDashboard(t *testing.T) {
Login: "grafana",
})
// Create the namespace we'll save our alerts to.
dashboardUID := "default"
err = createFolder(t, dashboardUID, grafanaListedAddr, "grafana", "password")
require.NoError(t, err)
reloadCachedPermissions(t, grafanaListedAddr, "grafana", "password")
interval, err := model.ParseDuration("10s")
require.NoError(t, err)
@@ -625,23 +630,27 @@ func TestPrometheusRulesPermissions(t *testing.T) {
})
grafanaListedAddr, store := testinfra.StartGrafana(t, dir, path)
dashboardsStore := dashboardsstore.ProvideDashboardStore(store)
// Create a user to make authenticated requests
createUser(t, store, models.CreateUserCommand{
userID := createUser(t, store, models.CreateUserCommand{
DefaultOrgRole: string(models.ROLE_EDITOR),
Password: "password",
Login: "grafana",
})
// Create a namespace under default organisation (orgID = 1) where we'll save some alerts.
_, err = createFolder(t, store, 0, "folder1")
// access control permissions store
permissionsStore := acdb.ProvideService(store)
// Create the namespace we'll save our alerts to.
err = createFolder(t, "folder1", grafanaListedAddr, "grafana", "password")
require.NoError(t, err)
// Create another namespace under default organisation (orgID = 1) where we'll save some alerts.
_, err = createFolder(t, store, 0, "folder2")
// Create the namespace we'll save our alerts to.
err = createFolder(t, "folder2", grafanaListedAddr, "grafana", "password")
require.NoError(t, err)
reloadCachedPermissions(t, grafanaListedAddr, "grafana", "password")
// Create rule under folder1
createRule(t, grafanaListedAddr, "folder1", "grafana", "password")
@@ -717,7 +726,8 @@ func TestPrometheusRulesPermissions(t *testing.T) {
}
// remove permissions from folder2
require.NoError(t, dashboardsStore.UpdateDashboardACL(context.Background(), 2, nil))
removeFolderPermission(t, permissionsStore, 1, userID, models.ROLE_EDITOR, "folder2")
reloadCachedPermissions(t, grafanaListedAddr, "grafana", "password")
// make sure that folder2 is not included in the response
{
@@ -764,8 +774,9 @@ func TestPrometheusRulesPermissions(t *testing.T) {
}`, string(b))
}
// remove permissions from _ALL_ folders
require.NoError(t, dashboardsStore.UpdateDashboardACL(context.Background(), 1, nil))
// remove permissions from folder1
removeFolderPermission(t, permissionsStore, 1, userID, models.ROLE_EDITOR, "folder1")
reloadCachedPermissions(t, grafanaListedAddr, "grafana", "password")
// make sure that no folders are included in the response
{
@@ -790,3 +801,42 @@ func TestPrometheusRulesPermissions(t *testing.T) {
}`, string(b))
}
}
func reloadCachedPermissions(t *testing.T, addr, login, password string) {
t.Helper()
u := fmt.Sprintf("http://%s:%s@%s/api/access-control/user/permissions?reloadcache=true", login, password, addr)
// nolint:gosec
resp, err := http.Get(u)
t.Cleanup(func() {
require.NoError(t, resp.Body.Close())
})
require.NoError(t, err)
require.Equal(t, http.StatusOK, resp.StatusCode)
}
func removeFolderPermission(t *testing.T, store *acdb.AccessControlStore, orgID, userID int64, role models.RoleType, uid string) {
t.Helper()
// remove user permissions on folder
_, _ = store.SetUserResourcePermission(context.Background(), orgID, accesscontrol.User{ID: userID}, types.SetResourcePermissionCommand{
Resource: "folders",
ResourceID: uid,
ResourceAttribute: "uid",
}, nil)
// remove org role permissions from folder
_, _ = store.SetBuiltInResourcePermission(context.Background(), orgID, string(role), types.SetResourcePermissionCommand{
Resource: "folders",
ResourceID: uid,
ResourceAttribute: "uid",
}, nil)
// remove org role children permissions from folder
for _, c := range role.Children() {
_, _ = store.SetBuiltInResourcePermission(context.Background(), orgID, string(c), types.SetResourcePermissionCommand{
Resource: "folders",
ResourceID: uid,
ResourceAttribute: "uid",
}, nil)
}
}