543 lines
16 KiB
Go
543 lines
16 KiB
Go
package folder
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
"github.com/xlab/treeprint"
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
|
"k8s.io/client-go/dynamic"
|
|
"k8s.io/client-go/rest"
|
|
|
|
dashboardV0 "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v0alpha1"
|
|
folderV1 "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
|
|
"github.com/grafana/grafana/pkg/apimachinery/utils"
|
|
grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
|
|
"github.com/grafana/grafana/pkg/infra/db"
|
|
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
|
"github.com/grafana/grafana/pkg/services/folder"
|
|
"github.com/grafana/grafana/pkg/services/search/model"
|
|
"github.com/grafana/grafana/pkg/setting"
|
|
"github.com/grafana/grafana/pkg/tests/apis"
|
|
"github.com/grafana/grafana/pkg/tests/testinfra"
|
|
"github.com/grafana/grafana/pkg/util/testutil"
|
|
)
|
|
|
|
func TestIntegrationFolderTree(t *testing.T) {
|
|
testutil.SkipIntegrationTestInShortMode(t)
|
|
|
|
if !db.IsTestDbSQLite() {
|
|
t.Skip("test only on sqlite for now")
|
|
}
|
|
|
|
modes := []grafanarest.DualWriterMode{
|
|
grafanarest.Mode0, // legacy only
|
|
grafanarest.Mode2, // write both, read legacy
|
|
grafanarest.Mode3, // write both, read unified
|
|
grafanarest.Mode4,
|
|
grafanarest.Mode5,
|
|
}
|
|
for _, mode := range modes {
|
|
t.Run(fmt.Sprintf("mode %d", mode), func(t *testing.T) {
|
|
flags := []string{}
|
|
if mode >= grafanarest.Mode3 { // make sure modes 0-3 work without it
|
|
flags = append(flags, featuremgmt.FlagUnifiedStorageSearch)
|
|
}
|
|
helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
|
|
AppModeProduction: true,
|
|
DisableAnonymous: true,
|
|
APIServerStorageType: "unified",
|
|
EnableFeatureToggles: flags,
|
|
UnifiedStorageConfig: map[string]setting.UnifiedStorageConfig{
|
|
"dashboards.dashboard.grafana.app": {
|
|
DualWriterMode: mode,
|
|
},
|
|
"folders.folder.grafana.app": {
|
|
DualWriterMode: mode,
|
|
},
|
|
},
|
|
})
|
|
defer helper.Shutdown()
|
|
|
|
tests := []struct {
|
|
Name string
|
|
Definition FolderDefinition
|
|
Expected []ExpectedTree
|
|
}{
|
|
{
|
|
Name: "admin-only-tree",
|
|
Definition: FolderDefinition{
|
|
Children: []FolderDefinition{
|
|
{Name: "top",
|
|
Creator: helper.Org1.Admin,
|
|
Children: []FolderDefinition{
|
|
{Name: "middle",
|
|
Creator: helper.Org1.Admin,
|
|
Children: []FolderDefinition{
|
|
{Name: "child",
|
|
Creator: helper.Org1.Admin,
|
|
Permissions: []FolderPermission{{
|
|
Permission: "View",
|
|
User: helper.Org1.None,
|
|
}},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
Expected: []ExpectedTree{
|
|
{User: helper.Org1.Admin, Listing: `
|
|
└── top (admin,edit,save,delete)
|
|
....└── middle (admin,edit,save,delete)
|
|
........└── child (admin,edit,save,delete)`},
|
|
{User: helper.Org1.Viewer, Listing: `
|
|
└── top (view)
|
|
....└── middle (view)
|
|
........└── child (view)`},
|
|
{User: helper.Org1.None, Listing: `
|
|
└── sharedwithme (???)
|
|
....└── child (view)`,
|
|
E403: []string{"top", "middle"},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
var statusCode int
|
|
for _, tt := range tests {
|
|
t.Run(tt.Name, func(t *testing.T) {
|
|
tt.Definition.RequireUniqueName(t, make(map[string]bool))
|
|
|
|
tt.Definition.CreateWithLegacyAPI(t, helper, "")
|
|
// CreateWithLegacyAPI
|
|
|
|
for _, expect := range tt.Expected {
|
|
unstructured, client := getFolderClients(t, expect.User)
|
|
t.Run(fmt.Sprintf("query as %s", expect.User.Identity.GetLogin()), func(t *testing.T) {
|
|
legacy := getFoldersFromLegacyAPISearch(t, client)
|
|
legacy.requireEqual(t, expect.Listing, "legacy")
|
|
|
|
listed := getFoldersFromAPIServerList(t, unstructured)
|
|
listed.requireEqual(t, expect.Listing, "listed")
|
|
|
|
search := getFoldersFromDashboardV0Search(t, client, expect.User.Identity.GetNamespace())
|
|
search.requireEqual(t, expect.Listing, "search")
|
|
|
|
// ensure sure GET also works on each folder we can list
|
|
listed.forEach(func(fv *FolderView) {
|
|
if fv.Name == folder.SharedWithMeFolderUID {
|
|
return // skip it
|
|
}
|
|
found, err := unstructured.Get(context.Background(), fv.Name, v1.GetOptions{})
|
|
require.NoErrorf(t, err, "getting folder: %s", fv.Name)
|
|
require.Equal(t, found.GetName(), fv.Name)
|
|
})
|
|
|
|
// Forbidden things should really be hidden
|
|
for _, name := range expect.E403 {
|
|
_, err := unstructured.Get(context.Background(), name, v1.GetOptions{})
|
|
require.Error(t, err)
|
|
require.Truef(t, apierrors.IsForbidden(err), "error: %w", err) // 404 vs 403 ????
|
|
|
|
result := client.Get().AbsPath("api", "folders", name).
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
require.Equal(t, int(http.StatusForbidden), statusCode)
|
|
require.Error(t, result.Error())
|
|
|
|
// Verify sub-resources are hidden
|
|
for _, sub := range []string{"access", "parents", "children", "counts"} {
|
|
_, err := unstructured.Get(context.Background(), name, v1.GetOptions{}, sub)
|
|
require.Error(t, err, "expect error for subresource", sub)
|
|
require.Truef(t, apierrors.IsForbidden(err), "error: %w", err) // 404 vs 403 ????
|
|
}
|
|
|
|
// Verify legacy API access is also hidden
|
|
for _, sub := range []string{"permissions", "counts"} {
|
|
result := client.Get().AbsPath("api", "folders", name, sub).
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
require.Equalf(t, int(http.StatusForbidden), statusCode, "legacy access to: %s", sub)
|
|
require.Error(t, result.Error())
|
|
}
|
|
}
|
|
})
|
|
}
|
|
})
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
type ExpectedTree struct {
|
|
User apis.User
|
|
Listing string
|
|
E403 []string
|
|
}
|
|
|
|
type FolderDefinition struct {
|
|
Name string
|
|
Creator apis.User // The user who will create the folder
|
|
Permissions []FolderPermission
|
|
Children []FolderDefinition
|
|
}
|
|
|
|
type FolderPermission struct {
|
|
Permission string
|
|
User apis.User
|
|
// Team team.Team
|
|
// Role identity.RoleType
|
|
}
|
|
|
|
func (f *FolderDefinition) CreateWithLegacyAPI(t *testing.T, h *apis.K8sTestHelper, parent string) {
|
|
if f.Name == "" {
|
|
require.Empty(t, parent, "only the root should be empty")
|
|
} else {
|
|
cfg := dynamic.ConfigFor(f.Creator.NewRestConfig())
|
|
cfg.GroupVersion = &schema.GroupVersion{Group: "folder.grafana.app", Version: "v1beta1"} // group does not matter
|
|
client, err := rest.RESTClientFor(cfg)
|
|
require.NoError(t, err)
|
|
|
|
body, err := json.Marshal(map[string]any{
|
|
"uid": f.Name,
|
|
"title": f.Name,
|
|
"parentUid": parent,
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
var statusCode int
|
|
result := client.Post().AbsPath("api", "folders").
|
|
Body(body).
|
|
SetHeader("Content-type", "application/json").
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
require.NoError(t, result.Error(), f.Name)
|
|
require.Equal(t, int(http.StatusOK), statusCode, f.Name)
|
|
parent = f.Name
|
|
|
|
if len(f.Permissions) > 0 {
|
|
for _, def := range f.Permissions {
|
|
// http://localhost:3000/api/access-control/folders/feyx0ezuwqwowb/users/aeyx0jzgix9fkd
|
|
body = []byte(`{"permission": "` + def.Permission + `"}`)
|
|
require.NotEmpty(t, def.Permission, "invalid permission: %+v", def)
|
|
if def.User.Identity != nil {
|
|
result = client.Post().AbsPath(
|
|
"api", "access-control", "folders", f.Name, "users", def.User.Identity.GetIdentifier()).
|
|
Body(body).
|
|
SetHeader("Content-type", "application/json").
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
err = result.Error()
|
|
require.NoErrorf(t, err, "legacy access control: %s: %s", f.Name, body)
|
|
require.Equal(t, int(http.StatusOK), statusCode, f.Name)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
for _, child := range f.Children {
|
|
child.CreateWithLegacyAPI(t, h, parent)
|
|
}
|
|
}
|
|
|
|
func (f *FolderDefinition) CreateWithAPIServer(t *testing.T, h *apis.K8sTestHelper, parent string) {
|
|
if f.Name == "" {
|
|
require.Empty(t, parent, "only the root should be empty")
|
|
} else {
|
|
gvr := schema.GroupVersionResource{Group: "folder.grafana.app", Version: "v1beta1", Resource: "folders"}
|
|
|
|
ns := f.Creator.Identity.GetNamespace()
|
|
cfg := dynamic.ConfigFor(f.Creator.NewRestConfig())
|
|
dyn, err := dynamic.NewForConfig(cfg)
|
|
require.NoError(t, err)
|
|
client := dyn.Resource(gvr).Namespace(ns)
|
|
obj, err := client.Create(context.Background(), &unstructured.Unstructured{
|
|
Object: map[string]interface{}{
|
|
"metadata": map[string]interface{}{
|
|
"name": f.Name,
|
|
"namespace": ns,
|
|
"annotations": map[string]string{
|
|
utils.AnnoKeyFolder: parent,
|
|
},
|
|
},
|
|
"spec": map[string]interface{}{
|
|
"title": f.Name,
|
|
},
|
|
},
|
|
}, v1.CreateOptions{})
|
|
require.NoError(t, err)
|
|
require.Equal(t, f.Name, obj.GetName())
|
|
}
|
|
|
|
for _, child := range f.Children {
|
|
child.CreateWithAPIServer(t, h, parent)
|
|
}
|
|
}
|
|
|
|
func (f *FolderDefinition) RequireUniqueName(t *testing.T, names map[string]bool) {
|
|
if f.Name != "" && names[f.Name] {
|
|
t.Fatalf("duplicate name: %s", f.Name)
|
|
}
|
|
names[f.Name] = true
|
|
for _, child := range f.Children {
|
|
child.RequireUniqueName(t, names)
|
|
}
|
|
}
|
|
|
|
type FolderView struct {
|
|
Name string
|
|
Parent string
|
|
Title string
|
|
Children []*FolderView
|
|
Access *folderV1.FolderAccessInfo
|
|
}
|
|
|
|
func (n *FolderView) forEach(cb func(*FolderView)) {
|
|
for _, child := range n.Children {
|
|
cb(child)
|
|
}
|
|
}
|
|
|
|
func (n *FolderView) requireEqual(t *testing.T, expect string, msg string) {
|
|
input := strings.Split(expect, "\n")
|
|
output := make([]string, 0, len(input))
|
|
for _, v := range input {
|
|
v = strings.TrimSpace(v)
|
|
if len(v) > 0 {
|
|
output = append(output, v)
|
|
}
|
|
}
|
|
expect = strings.Join(output, "\n")
|
|
found := dotify(n.build(treeprint.New()))
|
|
require.Equal(t, expect, found, fmt.Sprintf("%s // EXPECT:\n%s\n\nFOUND:\n%s", msg, expect, found))
|
|
}
|
|
|
|
func accessDescription(access *folderV1.FolderAccessInfo) string {
|
|
if access == nil {
|
|
return "???"
|
|
}
|
|
perms := []string{}
|
|
if access.CanAdmin {
|
|
perms = append(perms, "admin")
|
|
}
|
|
if access.CanEdit {
|
|
perms = append(perms, "edit")
|
|
}
|
|
if access.CanSave {
|
|
perms = append(perms, "save")
|
|
}
|
|
if access.CanDelete {
|
|
perms = append(perms, "delete")
|
|
}
|
|
if len(perms) == 0 {
|
|
return "view" // because it was not nil!
|
|
}
|
|
return strings.Join(perms, ",")
|
|
}
|
|
|
|
func (n *FolderView) build(tree treeprint.Tree) treeprint.Tree {
|
|
for _, child := range n.Children {
|
|
child.build(tree.AddBranch(fmt.Sprintf("%s (%s)", child.Name, accessDescription(child.Access))))
|
|
}
|
|
return tree
|
|
}
|
|
|
|
func getFoldersFromLegacyAPISearch(t *testing.T, client *rest.RESTClient) *FolderView {
|
|
var statusCode int
|
|
result := client.Get().AbsPath("api", "search").
|
|
Param("type", "dash-folder").
|
|
Param("limit", "1000").
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
require.NoError(t, result.Error(), "getting folders with /api/search")
|
|
require.Equal(t, int(http.StatusOK), statusCode)
|
|
|
|
body, err := result.Raw()
|
|
require.NoError(t, err)
|
|
hits := model.HitList{}
|
|
err = json.Unmarshal(body, &hits)
|
|
require.NoError(t, err)
|
|
|
|
lookup := make(map[string]*FolderView, len(hits))
|
|
for _, hit := range hits {
|
|
fv := &FolderView{
|
|
Name: hit.UID,
|
|
Title: hit.Title,
|
|
Parent: hit.FolderUID,
|
|
}
|
|
|
|
// Read the access info (note not the same model but the fields we care about do overlap)
|
|
result = client.Get().AbsPath("api", "folders", hit.UID).
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
require.NoError(t, result.Error(), "getting folder access info (/api)")
|
|
require.Equal(t, int(http.StatusOK), statusCode)
|
|
|
|
body, err := result.Raw()
|
|
require.NoError(t, err)
|
|
err = json.Unmarshal(body, &fv.Access)
|
|
require.NoError(t, err)
|
|
|
|
lookup[hit.UID] = fv
|
|
}
|
|
return makeRoot(lookup, "/api/search")
|
|
}
|
|
|
|
func makeRoot(lookup map[string]*FolderView, name string) *FolderView {
|
|
shared := &FolderView{} // when not found
|
|
root := &FolderView{}
|
|
for _, v := range lookup {
|
|
if v.Parent == "" {
|
|
root.Children = append(root.Children, v)
|
|
} else {
|
|
p, ok := lookup[v.Parent]
|
|
if ok {
|
|
p.Children = append(p.Children, v)
|
|
} else {
|
|
shared.Children = append(shared.Children, v)
|
|
}
|
|
}
|
|
}
|
|
if len(shared.Children) > 0 {
|
|
shared.Name = folder.SharedWithMeFolderUID
|
|
root.Children = append([]*FolderView{shared}, root.Children...)
|
|
}
|
|
return root
|
|
}
|
|
|
|
func getFoldersFromDashboardV0Search(t *testing.T, client *rest.RESTClient, ns string) *FolderView {
|
|
var statusCode int
|
|
result := client.Get().AbsPath("apis", "dashboard.grafana.app", "v0alpha1", "namespaces", ns, "search").
|
|
Param("limit", "1000").
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
err := result.Error()
|
|
if err != nil {
|
|
if apierrors.IsForbidden(err) {
|
|
return &FolderView{} // empty list
|
|
}
|
|
require.NoError(t, err, "getting folders with /apis/dashboard.grafana.app/v0alpha1/.../search")
|
|
}
|
|
require.Equal(t, int(http.StatusOK), statusCode)
|
|
|
|
body, err := result.Raw()
|
|
require.NoError(t, err)
|
|
results := &dashboardV0.SearchResults{}
|
|
err = json.Unmarshal(body, &results)
|
|
require.NoError(t, err)
|
|
|
|
lookup := make(map[string]*FolderView, len(results.Hits))
|
|
for _, hit := range results.Hits {
|
|
fv := &FolderView{
|
|
Name: hit.Name,
|
|
Title: hit.Title,
|
|
Parent: hit.Folder,
|
|
}
|
|
|
|
result = client.Get().AbsPath("apis", folderV1.APIGroup,
|
|
folderV1.APIVersion, "namespaces", ns, "folders", hit.Name, "access").
|
|
Do(context.Background()).
|
|
StatusCode(&statusCode)
|
|
require.NoError(t, result.Error(), "getting folder access info (/access)")
|
|
require.Equal(t, int(http.StatusOK), statusCode)
|
|
|
|
body, err := result.Raw()
|
|
require.NoError(t, err)
|
|
err = json.Unmarshal(body, &fv.Access)
|
|
require.NoError(t, err)
|
|
|
|
lookup[hit.Name] = fv
|
|
}
|
|
|
|
return makeRoot(lookup, "dashboards/search")
|
|
}
|
|
|
|
func getFolderClients(t *testing.T, who apis.User) (dynamic.ResourceInterface, *rest.RESTClient) {
|
|
gvr := schema.GroupVersionResource{Group: folderV1.APIGroup, Version: folderV1.APIVersion, Resource: "folders"}
|
|
ns := who.Identity.GetNamespace()
|
|
cfg := dynamic.ConfigFor(who.NewRestConfig())
|
|
dyn, err := dynamic.NewForConfig(cfg)
|
|
require.NoError(t, err)
|
|
dc := dyn.Resource(gvr).Namespace(ns)
|
|
|
|
cfg.GroupVersion = &schema.GroupVersion{Group: gvr.Group, Version: gvr.Version}
|
|
client, err := rest.RESTClientFor(cfg)
|
|
require.NoError(t, err)
|
|
return dc, client
|
|
}
|
|
|
|
func getFoldersFromAPIServerList(t *testing.T, client dynamic.ResourceInterface) *FolderView {
|
|
lookup := map[string]*FolderView{}
|
|
continueToken := ""
|
|
for {
|
|
result, err := client.List(context.Background(), v1.ListOptions{Limit: 1000, Continue: continueToken})
|
|
if apierrors.IsForbidden(err) {
|
|
return &FolderView{} // empty list
|
|
}
|
|
require.NoError(t, err)
|
|
|
|
for _, hit := range result.Items {
|
|
obj, err := utils.MetaAccessor(&hit)
|
|
require.NoError(t, err)
|
|
|
|
title, _, err := unstructured.NestedString(hit.Object, "spec", "title")
|
|
require.NoError(t, err)
|
|
|
|
fv := &FolderView{
|
|
Name: hit.GetName(),
|
|
Title: title,
|
|
Parent: obj.GetFolder(),
|
|
}
|
|
|
|
access, err := client.Get(context.Background(), fv.Name, v1.GetOptions{}, "access")
|
|
require.NoError(t, err)
|
|
jj, err := json.Marshal(access)
|
|
require.NoError(t, err)
|
|
err = json.Unmarshal(jj, &fv.Access)
|
|
require.NoError(t, err)
|
|
|
|
lookup[fv.Name] = fv
|
|
}
|
|
|
|
continueToken = result.GetContinue()
|
|
if continueToken == "" {
|
|
break
|
|
}
|
|
}
|
|
|
|
return makeRoot(lookup, "folders/list")
|
|
}
|
|
|
|
func dotify(t treeprint.Tree) string {
|
|
buff := bytes.Buffer{}
|
|
for _, line := range strings.Split(t.String(), "\n") {
|
|
if line == "." || line == " " || len(line) == 0 {
|
|
continue
|
|
}
|
|
runes := []rune(line)
|
|
for j, r := range runes {
|
|
if r == rune(' ') {
|
|
runes[j] = '.'
|
|
continue
|
|
}
|
|
break
|
|
}
|
|
if buff.Len() > 0 {
|
|
buff.WriteRune('\n')
|
|
}
|
|
buff.WriteString(string(runes))
|
|
}
|
|
return buff.String()
|
|
}
|