From f6f6ae449615cfb866aed4afe53dc4a0cde83f25 Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Tue, 11 Mar 2025 16:27:17 +0100 Subject: [PATCH] Zanzana: Update docs with subresources description (#101948) * Zanzana: Update docs with subresources description * clarify resource name --- pkg/services/authz/zanzana/schema/README.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/pkg/services/authz/zanzana/schema/README.md b/pkg/services/authz/zanzana/schema/README.md index 4462e0f18e0..3a41e96a11a 100644 --- a/pkg/services/authz/zanzana/schema/README.md +++ b/pkg/services/authz/zanzana/schema/README.md @@ -5,8 +5,8 @@ Here's some notes about [OpenFGA authorization model](https://openfga.dev/docs/m ## GroupResource level permissions A relation to a group_resource object grants access to all objects of the GroupResource. -They take the form of `{ “user”: “user:1”, relation: “read”, object:”group_resource:dashboard.grafana.app/dashboard” }`. This -example would grant `user:1` access to all `dashboard.grafana.app/dashboard` in the namespace. +They take the form of `{ “user”: “user:1”, relation: “read”, object:”group_resource:dashboard.grafana.app/dashboards” }`. This +example would grant `user:1` access to all `dashboard.grafana.app/dashboards` in the namespace. ## Folder level permissions @@ -20,11 +20,19 @@ This context holds all GroupResources in a list e.g. `{ "group_resources": ["das ## Resource level permissions -Most of our resource should use the generic resource type. +Most of our resource should use the generic resource type. -To grant a user direct access to a specific resource we store `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboard/” }` with additional context. +To grant a user direct access to a specific resource we store `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboards/” }` with additional context. This context store the GroupResource. `{ "group_resource": "dashboard.grafana.app/dashboards" }`. This is required so we can filter them out for list requests. +## Subresources + +Subresources enable more granular permissions for the resources. Example might be access to public dashboards or access to dashboard settings. + +To grant a user access to the subresource of the specific resource we store following tuple: `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboards//” }` with additional context `{ "group_resource": "dashboard.grafana.app/dashboards/" }` + +It's also possible to grant user access to all subresources for specific resource type. It can be done with following tuple: `{ “user”: “user:1”, relation: “read”, object:”resource:dashboard.grafana.app/dashboards/” }`. + ## Managed permissions In the RBAC model managed permissions stored as a special "managed" role permissions. OpenFGA model allows to assign permissions directly to users, so it produces following tuples: @@ -58,4 +66,3 @@ type folder ``` According to the schema, user can get `read` access to folder if it has `read` relation granted directly to the folder or its parent folders. -