From f6a1d4a14ecc08c6cbad26c528f2c496e4d1010b Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Thu, 20 Nov 2025 14:02:15 +0100 Subject: [PATCH] Revert Auth: Add None role to Viewer case (#114224) --- pkg/services/apiserver/auth/authorizer/role.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkg/services/apiserver/auth/authorizer/role.go b/pkg/services/apiserver/auth/authorizer/role.go index 6bc6e9d5474..82e80b38164 100644 --- a/pkg/services/apiserver/auth/authorizer/role.go +++ b/pkg/services/apiserver/auth/authorizer/role.go @@ -4,9 +4,10 @@ import ( "context" "fmt" + "k8s.io/apiserver/pkg/authorization/authorizer" + "github.com/grafana/grafana/pkg/apimachinery/identity" "github.com/grafana/grafana/pkg/services/org" - "k8s.io/apiserver/pkg/authorization/authorizer" ) var _ authorizer.Authorizer = &roleAuthorizer{} @@ -34,13 +35,15 @@ func (auth roleAuthorizer) Authorize(ctx context.Context, a authorizer.Attribute default: return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil } - case org.RoleViewer, org.RoleNone: + case org.RoleViewer: switch a.GetVerb() { case "get", "list", "watch": return authorizer.DecisionAllow, "", nil default: return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil } + case org.RoleNone: + return authorizer.DecisionDeny, errorMessageForGrafanaOrgRole(orgRole, a), nil } return authorizer.DecisionDeny, "", nil }