authnz: Fix panic in the authenticator and rename metric (#97150)

* Fix: panic

* suggestion
This commit is contained in:
Georges Chaudy
2024-11-28 14:03:54 +02:00
committed by GitHub
parent 5e5fa86b8b
commit f6124344ba
2 changed files with 26 additions and 19 deletions
+6 -6
View File
@@ -39,8 +39,8 @@ type groupResource map[string]map[string]interface{}
// For now, it makes one call to the authz service for each list items. This is known to be inefficient.
type authzLimitedClient struct {
client authz.AccessChecker
// whitelist is a map of group to resources that are compatible with RBAC.
whitelist groupResource
// allowlist is a map of group to resources that are compatible with RBAC.
allowlist groupResource
logger *slog.Logger
tracer trace.Tracer
}
@@ -57,7 +57,7 @@ func NewAuthzLimitedClient(client authz.AccessChecker, opts AuthzOptions) authz.
}
return &authzLimitedClient{
client: client,
whitelist: groupResource{
allowlist: groupResource{
"dashboard.grafana.app": map[string]interface{}{"dashboards": nil},
"folder.grafana.app": map[string]interface{}{"folders": nil},
},
@@ -107,7 +107,7 @@ func (c authzLimitedClient) Compile(ctx context.Context, id claims.AuthInfo, req
))
defer span.End()
if grpcutils.FallbackUsed(ctx) {
c.logger.Debug("Check", "group", req.Group, "resource", req.Resource, "fallback", true, "rbac", false, "allowed", true)
c.logger.Debug("Compile.Check", "group", req.Group, "resource", req.Resource, "fallback", true, "rbac", false, "allowed", true)
return true
}
// TODO: Implement For now we perform the check for each item.
@@ -134,8 +134,8 @@ func (c authzLimitedClient) Compile(ctx context.Context, id claims.AuthInfo, req
}
func (c authzLimitedClient) IsCompatibleWithRBAC(group, resource string) bool {
if _, ok := c.whitelist[group]; ok {
if _, ok := c.whitelist[group][resource]; ok {
if _, ok := c.allowlist[group]; ok {
if _, ok := c.allowlist[group][resource]; ok {
return true
}
}