public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Zanzana: Update docs with subresources description (#101948)

Browse Source 
* Zanzana: Update docs with subresources description

* clarify resource name
This commit is contained in:
Alexander Zobnin
2025-03-11 16:27:17 +01:00
committed by GitHub
parent 5bfe046da9
commit f6f6ae4496
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/zanzana/schema/README.md
+12 -5
View File
@@ -5,8 +5,8 @@ Here's some notes about [OpenFGA authorization model](https://openfga.dev/docs/m
## GroupResource level permissions
A relation to a group_resource object grants access to all objects of the GroupResource.
They take the form of `{ “user”: “user:1”, relation: “read”, object:”group_resource:dashboard.grafana.app/dashboard” }`. This
example would grant `user:1` access to all `dashboard.grafana.app/dashboard` in the namespace.
They take the form of `{ “user”: “user:1”, relation: “read”, object:”group_resource:dashboard.grafana.app/dashboards” }`. This
example would grant `user:1` access to all `dashboard.grafana.app/dashboards` in the namespace.
## Folder level permissions
@@ -20,11 +20,19 @@ This context holds all GroupResources in a list e.g. `{ "group_resources": ["das
## Resource level permissions
Most of our resource should use the generic resource type.
Most of our resource should use the generic resource type.
To grant a user direct access to a specific resource we store `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboard/<name>” }` with additional context.
To grant a user direct access to a specific resource we store `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboards/<name>” }` with additional context.
This context store the GroupResource. `{ "group_resource": "dashboard.grafana.app/dashboards" }`. This is required so we can filter them out for list requests.
## Subresources
Subresources enable more granular permissions for the resources. Example might be access to public dashboards or access to dashboard settings.
To grant a user access to the subresource of the specific resource we store following tuple: `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboards/<subresource>/<resource_name>” }` with additional context `{ "group_resource": "dashboard.grafana.app/dashboards/<subresource>" }`
It's also possible to grant user access to all subresources for specific resource type. It can be done with following tuple: `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboards/<subresource>” }`.
## Managed permissions
In the RBAC model managed permissions stored as a special "managed" role permissions. OpenFGA model allows to assign permissions directly to users, so it produces following tuples:
@@ -58,4 +66,3 @@ type folder
```
According to the schema, user can get `read` access to folder if it has `read` relation granted directly to the folder or its parent folders.