public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthZ: Add if user is allowed to the span attribute (#112197)

Browse Source 
* `AuthZ`: Add if user is allowed to the span attribute

* Suggestiong
This commit is contained in:
Gabriel MABILLE
2025-10-09 10:49:50 +02:00
committed by GitHub
parent 857e73bdc2
commit f4cd46504b
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/rbac/service.go
+6 -2
View File
@@ -119,6 +119,7 @@ func (s *Service) Check(ctx context.Context, req *authzv1.CheckRequest) (*authzv
ctxLogger.Debug("Check execution time", "duration", time.Since(start).Milliseconds())
}(time.Now())
allow := &authzv1.CheckResponse{Allowed: true}
deny := &authzv1.CheckResponse{Allowed: false}
checkReq, err := s.validateCheckRequest(ctx, req)
@@ -135,13 +136,14 @@ func (s *Service) Check(ctx context.Context, req *authzv1.CheckRequest) (*authzv
attribute.String("action", checkReq.Action),
attribute.String("name", checkReq.Name),
attribute.String("folder", checkReq.ParentFolder),
attribute.Bool("allowed", false),
)
permDenialKey := userPermDenialCacheKey(checkReq.Namespace.Value, checkReq.UserUID, checkReq.Action, checkReq.Name, checkReq.ParentFolder)
if _, ok := s.permDenialCache.Get(ctx, permDenialKey); ok {
s.metrics.permissionCacheUsage.WithLabelValues("true", checkReq.Action).Inc()
s.metrics.requestCount.WithLabelValues("false", "true", req.GetVerb(), req.GetGroup(), req.GetResource()).Inc()
return &authzv1.CheckResponse{Allowed: false}, nil
return deny, nil
}
cachedPerms, err := s.getCachedIdentityPermissions(ctx, checkReq.Namespace, checkReq.IdentityType, checkReq.UserUID, checkReq.Action)
@@ -155,7 +157,8 @@ func (s *Service) Check(ctx context.Context, req *authzv1.CheckRequest) (*authzv
if allowed {
s.metrics.permissionCacheUsage.WithLabelValues("true", checkReq.Action).Inc()
s.metrics.requestCount.WithLabelValues("false", "true", req.GetVerb(), req.GetGroup(), req.GetResource()).Inc()
return &authzv1.CheckResponse{Allowed: allowed}, nil
span.SetAttributes(attribute.Bool("allowed", true))
return allow, nil
}
}
s.metrics.permissionCacheUsage.WithLabelValues("false", checkReq.Action).Inc()
@@ -179,6 +182,7 @@ func (s *Service) Check(ctx context.Context, req *authzv1.CheckRequest) (*authzv
}
s.metrics.requestCount.WithLabelValues("false", "true", req.GetVerb(), req.GetGroup(), req.GetResource()).Inc()
span.SetAttributes(attribute.Bool("allowed", allowed))
return &authzv1.CheckResponse{Allowed: allowed}, nil
}