Moustafa Baiou
ca8324e62a
Rules created in the new api makes the rule have no group in the database, but the rule is returned in the old group api with a sentinel group name formatted with the rule uid for compatiblity with the old api. This makes the UI continue to work with the rules without a group, and the ruler will continue to work with the rules without a group. Rules are not allowed to be created in the provisioning api with a NoGroup sentinel mask, but NoGroup rules can be manipulated through both the new and old apis. Co-authored-by: William Wernert <william.wernert@grafana.com>
51 lines
1.5 KiB
Go
51 lines
1.5 KiB
Go
package alertrule
|
|
|
|
import (
|
|
"context"
|
|
|
|
"k8s.io/apiserver/pkg/authorization/authorizer"
|
|
|
|
"github.com/grafana/grafana/pkg/apimachinery/identity"
|
|
"github.com/grafana/grafana/pkg/services/accesscontrol"
|
|
)
|
|
|
|
func Authorize(ctx context.Context, ac accesscontrol.AccessControl, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
|
|
if attr.GetResource() != ResourceInfo.GroupResource().Resource {
|
|
return authorizer.DecisionNoOpinion, "", nil
|
|
}
|
|
user, err := identity.GetRequester(ctx)
|
|
if err != nil {
|
|
return authorizer.DecisionDeny, "valid user is required", err
|
|
}
|
|
|
|
var action accesscontrol.Evaluator
|
|
// Default evaluator - all actions require read permissions
|
|
defaultEvaluator := accesscontrol.EvalPermission(accesscontrol.ActionAlertingRuleRead)
|
|
|
|
switch attr.GetVerb() {
|
|
case "get", "list", "watch":
|
|
action = defaultEvaluator
|
|
case "create":
|
|
action = accesscontrol.EvalAll(
|
|
defaultEvaluator,
|
|
accesscontrol.EvalPermission(accesscontrol.ActionAlertingRuleCreate),
|
|
)
|
|
case "patch", "update":
|
|
action = accesscontrol.EvalAll(
|
|
defaultEvaluator,
|
|
accesscontrol.EvalPermission(accesscontrol.ActionAlertingRuleUpdate),
|
|
)
|
|
case "delete", "deletecollection":
|
|
action = accesscontrol.EvalAll(
|
|
defaultEvaluator,
|
|
accesscontrol.EvalPermission(accesscontrol.ActionAlertingRuleDelete),
|
|
)
|
|
}
|
|
|
|
ok, err := ac.Evaluate(ctx, user, action)
|
|
if ok {
|
|
return authorizer.DecisionAllow, "", nil
|
|
}
|
|
return authorizer.DecisionDeny, "", err
|
|
}
|