Gabriel MABILLE
e5b0353c41
* `grafana-iam`: Add basic roles to the apis * Fix validation * chore: trigger CI * Leave the hooks intact for now, moving them later * Remove Role mention from the interface * Refactor to use a NoopRest backend and Deny access
102 lines
4.2 KiB
Go
102 lines
4.2 KiB
Go
package iam
|
|
|
|
import (
|
|
"github.com/prometheus/client_golang/prometheus"
|
|
"k8s.io/apiserver/pkg/authorization/authorizer"
|
|
|
|
"github.com/grafana/authlib/types"
|
|
|
|
"github.com/grafana/grafana/pkg/infra/log"
|
|
iamauthorizer "github.com/grafana/grafana/pkg/registry/apis/iam/authorizer"
|
|
"github.com/grafana/grafana/pkg/registry/apis/iam/externalgroupmapping"
|
|
"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
|
|
"github.com/grafana/grafana/pkg/registry/apis/iam/serviceaccount"
|
|
"github.com/grafana/grafana/pkg/registry/apis/iam/sso"
|
|
"github.com/grafana/grafana/pkg/registry/apis/iam/team"
|
|
"github.com/grafana/grafana/pkg/registry/apis/iam/teambinding"
|
|
"github.com/grafana/grafana/pkg/registry/apis/iam/user"
|
|
"github.com/grafana/grafana/pkg/services/apiserver/builder"
|
|
"github.com/grafana/grafana/pkg/services/authz/zanzana"
|
|
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
|
"github.com/grafana/grafana/pkg/services/ssosettings"
|
|
"github.com/grafana/grafana/pkg/storage/legacysql/dualwrite"
|
|
"github.com/grafana/grafana/pkg/storage/unified/resource"
|
|
"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
|
|
)
|
|
|
|
var _ builder.APIGroupBuilder = (*IdentityAccessManagementAPIBuilder)(nil)
|
|
var _ builder.APIGroupRouteProvider = (*IdentityAccessManagementAPIBuilder)(nil)
|
|
var _ builder.APIGroupValidation = (*IdentityAccessManagementAPIBuilder)(nil)
|
|
var _ builder.APIGroupMutation = (*IdentityAccessManagementAPIBuilder)(nil)
|
|
|
|
// CoreRoleStorageBackend uses the resource.StorageBackend interface to provide storage for core roles.
|
|
// Used by wire to identify the storage backend for core roles.
|
|
type CoreRoleStorageBackend interface{ resource.StorageBackend }
|
|
|
|
// RoleStorageBackend uses the resource.StorageBackend interface to provide storage for custom roles.
|
|
// Used by wire to identify the storage backend for custom roles.
|
|
type RoleStorageBackend interface{ resource.StorageBackend }
|
|
|
|
// RoleBindingStorageBackend uses the resource.StorageBackend interface to provide storage for role bindings.
|
|
// Used by wire to identify the storage backend for role bindings.
|
|
type RoleBindingStorageBackend interface{ resource.StorageBackend }
|
|
|
|
// ExternalGroupMappingStorageBackend uses the resource.StorageBackend interface to provide storage for external group mappings.
|
|
// Used by wire to identify the storage backend for external group mappings.
|
|
type ExternalGroupMappingStorageBackend interface{ resource.StorageBackend }
|
|
|
|
// This is used just so wire has something unique to return
|
|
type IdentityAccessManagementAPIBuilder struct {
|
|
// Stores
|
|
store legacy.LegacyIdentityStore
|
|
|
|
userLegacyStore *user.LegacyStore
|
|
saLegacyStore *serviceaccount.LegacyStore
|
|
legacyTeamStore *team.LegacyStore
|
|
teamBindingLegacyStore *teambinding.LegacyBindingStore
|
|
ssoLegacyStore *sso.LegacyStore
|
|
coreRolesStorage CoreRoleStorageBackend
|
|
roleApiInstaller RoleApiInstaller
|
|
resourcePermissionsStorage resource.StorageBackend
|
|
roleBindingsStorage RoleBindingStorageBackend
|
|
externalGroupMappingStorage ExternalGroupMappingStorageBackend
|
|
|
|
// Required for resource permissions authorization
|
|
// fetches resources parent folders
|
|
resourceParentProvider iamauthorizer.ParentProvider
|
|
|
|
// Access Control
|
|
authorizer authorizer.Authorizer
|
|
// legacyAccessClient is used for the identity apis, we need to migrate to the access client
|
|
legacyAccessClient types.AccessClient
|
|
// accessClient is used for the core role apis
|
|
accessClient types.AccessClient
|
|
// zClient is used to populate Zanzana with:
|
|
// - roles
|
|
// - permissions
|
|
// - assignments
|
|
zClient zanzana.Client
|
|
// Buffered channel to limit the amount of concurrent writes to Zanzana
|
|
zTickets chan bool
|
|
|
|
reg prometheus.Registerer
|
|
logger log.Logger
|
|
|
|
dual dualwrite.Service
|
|
unified resource.ResourceClient
|
|
userSearchClient resourcepb.ResourceIndexClient
|
|
userSearchHandler *user.SearchHandler
|
|
teamSearch *TeamSearchHandler
|
|
|
|
teamGroupsHandler externalgroupmapping.TeamGroupsHandler
|
|
|
|
// non-k8s api route
|
|
display *user.LegacyDisplayREST
|
|
|
|
// Not set for multi-tenant deployment for now
|
|
sso ssosettings.Service
|
|
|
|
// Toggle for enabling authz management apis
|
|
features featuremgmt.FeatureToggles
|
|
}
|