Misi
c012a95fa1
* codegen fix * Return user role from the legacy store * Lint * Add tests, gen openapi * make generate * revert go.mod, go.sum, go.work.sum changes * Update go.mod and go.sum
32 lines
893 B
Go
32 lines
893 B
Go
package user
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
|
|
iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
|
|
"github.com/grafana/grafana/pkg/apimachinery/identity"
|
|
)
|
|
|
|
func ValidateOnCreate(ctx context.Context, obj *iamv0alpha1.User) error {
|
|
requester, err := identity.GetRequester(ctx)
|
|
if err != nil {
|
|
return apierrors.NewUnauthorized("no identity found")
|
|
}
|
|
|
|
// Temporary validation that the user is not trying to create a Grafana Admin without being a Grafana Admin.
|
|
if obj.Spec.GrafanaAdmin && !requester.GetIsGrafanaAdmin() {
|
|
return apierrors.NewForbidden(iamv0alpha1.UserResourceInfo.GroupResource(),
|
|
obj.Name,
|
|
fmt.Errorf("only grafana admins can create grafana admins"))
|
|
}
|
|
|
|
if obj.Spec.Login == "" && obj.Spec.Email == "" {
|
|
return apierrors.NewBadRequest("user must have either login or email")
|
|
}
|
|
|
|
return nil
|
|
}
|