public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Zanzana: Fix dashboard access evaluation in folders (#114718)

Browse Source 
* Zanzana: Fix dashboard access evaluation in folders

* add negative test

* Fix listing
This commit is contained in:
Alexander Zobnin
2025-12-04 09:36:03 +01:00
committed by GitHub
parent 1ba57a505a
commit f4fbbcc4f4
5 changed files with 86 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/zanzana/server/server_check_test.go
+32
View File
@@ -184,4 +184,36 @@ func testCheck(t *testing.T, server *Server) {
require.NoError(t, err)
assert.True(t, res.GetAllowed())
})
t.Run("user:17 should be able to view dashboards in folder 4 and all subfolders", func(t *testing.T) {
// Check for folders
res, err := server.Check(newContextWithNamespace(), newReq("user:17", utils.VerbGet, folderGroup, folderResource, "", "", "4"))
require.NoError(t, err)
assert.True(t, res.GetAllowed())
res, err = server.Check(newContextWithNamespace(), newReq("user:17", utils.VerbGet, folderGroup, folderResource, "", "", "5"))
require.NoError(t, err)
assert.True(t, res.GetAllowed())
res, err = server.Check(newContextWithNamespace(), newReq("user:17", utils.VerbGet, folderGroup, folderResource, "", "", "6"))
require.NoError(t, err)
assert.True(t, res.GetAllowed())
// Check for dashboards
res, err = server.Check(newContextWithNamespace(), newReq("user:17", utils.VerbGet, dashboardGroup, dashboardResource, "", "4", "1"))
require.NoError(t, err)
assert.True(t, res.GetAllowed(), "user should be able to view dashboards in folder 4")
res, err = server.Check(newContextWithNamespace(), newReq("user:17", utils.VerbGet, dashboardGroup, dashboardResource, "", "5", "1"))
require.NoError(t, err)
assert.True(t, res.GetAllowed(), "user should be able to view dashboards in folder 5")
res, err = server.Check(newContextWithNamespace(), newReq("user:17", utils.VerbGet, dashboardGroup, dashboardResource, "", "6", "1"))
require.NoError(t, err)
assert.True(t, res.GetAllowed(), "user should be able to view dashboards in folder 6")
res, err = server.Check(newContextWithNamespace(), newReq("user:17", utils.VerbGet, "foo.grafana.app", "bar", "", "4", "1"))
require.NoError(t, err)
assert.False(t, res.GetAllowed(), "user should not be able to view other resources in folder 4")
})
}