public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RBAC: Remove accessControlOnCall feature toggle (#101222)

Browse Source 
* RBAC: Remove accessControlOnCall feature toggle

* Leave the other one in place

* Tests

* frontend

* Readd empty ft to frontend test

* Remove legacy RBAC check

* Fix test

* no need for context

* Remove unused variable

* Remove unecessary param

* remove unecessary param from tests

* More tests :D
This commit is contained in:
Gabriel MABILLE
2025-02-25 13:44:40 +01:00
committed by GitHub
parent 1a65154e74
commit f3433fd472
23 changed files with 88 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/acimpl/service.go
+2 -7
View File
@@ -68,7 +68,7 @@ func ProvideService(
lock,
)
api.NewAccessControlAPI(routeRegister, accessControl, service, userService, features).RegisterAPIEndpoints()
api.NewAccessControlAPI(routeRegister, accessControl, service, userService).RegisterAPIEndpoints()
if err := accesscontrol.DeclareFixedRoles(service, cfg); err != nil {
return nil, err
}
@@ -472,14 +472,9 @@ func (s *Service) RegisterFixedRoles(ctx context.Context) error {
// DeclarePluginRoles allow the caller to declare, to the service, plugin roles and their assignments
// to organization roles ("Viewer", "Editor", "Admin") or "Grafana Admin"
func (s *Service) DeclarePluginRoles(ctx context.Context, ID, name string, regs []plugins.RoleRegistration) error {
ctx, span := tracer.Start(ctx, "accesscontrol.acimpl.DeclarePluginRoles")
_, span := tracer.Start(ctx, "accesscontrol.acimpl.DeclarePluginRoles")
defer span.End()
// Protect behind feature toggle
if !s.features.IsEnabled(ctx, featuremgmt.FlagAccessControlOnCall) {
return nil
}
acRegs := pluginutils.ToRegistrations(ID, name, regs)
for _, r := range acRegs {
if err := pluginutils.ValidatePluginRole(ID, r.Role); err != nil {
pkg/services/accesscontrol/acimpl/service_test.go
-1
View File
@@ -253,7 +253,6 @@ func TestService_DeclarePluginRoles(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ac := setupTestEnv(t)
ac.features = featuremgmt.WithFeatures(featuremgmt.FlagAccessControlOnCall)
// Reset the registations
ac.registrations = accesscontrol.RegistrationList{}
pkg/services/accesscontrol/api/api.go
+2 -8
View File
@@ -17,20 +17,17 @@ import (
"github.com/grafana/grafana/pkg/middleware/requestmeta"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/user"
)
var tracer = otel.Tracer("github.com/grafana/grafana/pkg/services/accesscontrol/api")
func NewAccessControlAPI(router routing.RouteRegister, accesscontrol ac.AccessControl, service ac.Service,
userSvc user.Service, features featuremgmt.FeatureToggles) *AccessControlAPI {
func NewAccessControlAPI(router routing.RouteRegister, accesscontrol ac.AccessControl, service ac.Service, userSvc user.Service) *AccessControlAPI {
return &AccessControlAPI{
RouteRegister: router,
Service: service,
userSvc: userSvc,
AccessControl: accesscontrol,
features: features,
}
}
@@ -39,7 +36,6 @@ type AccessControlAPI struct {
AccessControl ac.AccessControl
RouteRegister routing.RouteRegister
userSvc user.Service
features featuremgmt.FeatureToggles
}
func (api *AccessControlAPI) RegisterAPIEndpoints() {
@@ -48,9 +44,7 @@ func (api *AccessControlAPI) RegisterAPIEndpoints() {
api.RouteRegister.Group("/api/access-control", func(rr routing.RouteRegister) {
rr.Get("/user/actions", middleware.ReqSignedIn, routing.Wrap(api.getUserActions))
rr.Get("/user/permissions", middleware.ReqSignedIn, routing.Wrap(api.getUserPermissions))
if api.features.IsEnabledGlobally(featuremgmt.FlagAccessControlOnCall) {
rr.Get("/users/permissions/search", authorize(ac.EvalPermission(ac.ActionUsersPermissionsRead)), routing.Wrap(api.searchUsersPermissions))
}
rr.Get("/users/permissions/search", authorize(ac.EvalPermission(ac.ActionUsersPermissionsRead)), routing.Wrap(api.searchUsersPermissions))
}, requestmeta.SetOwner(requestmeta.TeamAuth))
}
pkg/services/accesscontrol/api/api_test.go
+3 -4
View File
@@ -12,7 +12,6 @@ import (
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
"github.com/grafana/grafana/pkg/services/datasources"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/services/user/usertest"
"github.com/grafana/grafana/pkg/util"
@@ -42,7 +41,7 @@ func TestAPI_getUserActions(t *testing.T) {
for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
acSvc := actest.FakeService{ExpectedPermissions: tt.permissions}
api := NewAccessControlAPI(routing.NewRouteRegister(), actest.FakeAccessControl{}, acSvc, &usertest.FakeUserService{}, featuremgmt.WithFeatures())
api := NewAccessControlAPI(routing.NewRouteRegister(), actest.FakeAccessControl{}, acSvc, &usertest.FakeUserService{})
api.RegisterAPIEndpoints()
server := webtest.NewServer(t, api.RouteRegister)
@@ -95,7 +94,7 @@ func TestAPI_getUserPermissions(t *testing.T) {
for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
acSvc := actest.FakeService{ExpectedPermissions: tt.permissions}
api := NewAccessControlAPI(routing.NewRouteRegister(), actest.FakeAccessControl{}, acSvc, &usertest.FakeUserService{}, featuremgmt.WithFeatures())
api := NewAccessControlAPI(routing.NewRouteRegister(), actest.FakeAccessControl{}, acSvc, &usertest.FakeUserService{})
api.RegisterAPIEndpoints()
server := webtest.NewServer(t, api.RouteRegister)
@@ -192,7 +191,7 @@ func TestAccessControlAPI_searchUsersPermissions(t *testing.T) {
mockUserSvc := usertest.NewMockService(t)
mockUserSvc.On("GetByUID", mock.Anything, &user.GetUserByUIDQuery{UID: "user_2_uid"}).Return(&user.User{ID: 2}, nil).Maybe()
mockUserSvc.On("GetByUID", mock.Anything, &user.GetUserByUIDQuery{UID: "non_existent_uid"}).Return(nil, user.ErrUserNotFound).Maybe()
api := NewAccessControlAPI(routing.NewRouteRegister(), accessControl, acSvc, mockUserSvc, featuremgmt.WithFeatures(featuremgmt.FlagAccessControlOnCall))
api := NewAccessControlAPI(routing.NewRouteRegister(), accessControl, acSvc, mockUserSvc)
api.RegisterAPIEndpoints()
server := webtest.NewServer(t, api.RouteRegister)
pkg/services/accesscontrol/resourcepermissions/service.go
+1 -1
View File
@@ -583,7 +583,7 @@ func (a *ActionSetSvc) RegisterActionSets(ctx context.Context, pluginID string,
ctx, span := tracer.Start(ctx, "accesscontrol.resourcepermissions.RegisterActionSets")
defer span.End()
if !a.features.IsEnabled(ctx, featuremgmt.FlagAccessActionSets) || !a.features.IsEnabled(ctx, featuremgmt.FlagAccessControlOnCall) {
if !a.features.IsEnabled(ctx, featuremgmt.FlagAccessActionSets) {
return nil
}
for _, reg := range registrations {
pkg/services/accesscontrol/resourcepermissions/service_test.go
+6 -6
View File
@@ -328,7 +328,7 @@ func TestStore_RegisterActionSet(t *testing.T) {
tests := []actionSetTest{
{
desc: "should be able to register a plugin action set if the right feature toggles are enabled",
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets, featuremgmt.FlagAccessControlOnCall),
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets),
pluginID: "test-app",
pluginActions: []plugins.ActionSet{
{
@@ -345,7 +345,7 @@ func TestStore_RegisterActionSet(t *testing.T) {
},
{
desc: "should not register plugin action set if feature toggles are missing",
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessControlOnCall),
features: featuremgmt.WithFeatures(),
pluginID: "test-app",
pluginActions: []plugins.ActionSet{
{
@@ -357,7 +357,7 @@ func TestStore_RegisterActionSet(t *testing.T) {
},
{
desc: "should be able to register multiple plugin action sets",
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets, featuremgmt.FlagAccessControlOnCall),
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets),
pluginID: "test-app",
pluginActions: []plugins.ActionSet{
{
@@ -382,7 +382,7 @@ func TestStore_RegisterActionSet(t *testing.T) {
},
{
desc: "action set actions should be added not replaced",
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets, featuremgmt.FlagAccessControlOnCall),
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets),
pluginID: "test-app",
pluginActions: []plugins.ActionSet{
{
@@ -425,7 +425,7 @@ func TestStore_RegisterActionSet(t *testing.T) {
},
{
desc: "should not be able to register an action that doesn't have a plugin prefix",
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets, featuremgmt.FlagAccessControlOnCall),
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets),
pluginID: "test-app",
pluginActions: []plugins.ActionSet{
{
@@ -441,7 +441,7 @@ func TestStore_RegisterActionSet(t *testing.T) {
},
{
desc: "should not be able to register action set that is not in the allow list",
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets, featuremgmt.FlagAccessControlOnCall),
features: featuremgmt.WithFeatures(featuremgmt.FlagAccessActionSets),
pluginID: "test-app",
pluginActions: []plugins.ActionSet{
{