Matthew Jacobson
32f06c6d9c
* Replace global authz abstraction with one compatible with uid scope * Replace GettableApiReceiver with models.Receiver in receiver_svc * GrafanaIntegrationConfig -> models.Integration * Implement Create/Update methods * Add optimistic concurrency to receiver API * Add scope to ReceiversRead & ReceiversReadSecrets migrates existing permissions to include implicit global scope * Add receiver create, update, delete actions * Check if receiver is used by rules before delete * On receiver name change update in routes and notification settings * Improve errors * Linting * Include read permissions are requirements for create/update/delete * Alias ngalert/models to ngmodels to differentiate from v0alpha1 model * Ensure integration UIDs are valid, unique, and generated if empty * Validate integration settings on create/update * Leverage UidToName to GetReceiver instead of GetReceivers * Remove some unnecessary uses of simplejson * alerting.notifications.receiver -> alerting.notifications.receivers * validator -> provenanceValidator * Only validate the modified receiver stops existing invalid receivers from preventing modification of a valid receiver. * Improve error in Integration.Encrypt * Remove scope from alert.notifications.receivers:create * Add todos for receiver renaming * Use receiverAC precondition checks in k8s api * Linting * Optional optimistic concurrency for delete * make update-workspace * More specific auth checks in k8s authorize.go * Add debug log when delete optimistic concurrency is skipped * Improve error message on authorizer.DecisionDeny * Keep error for non-forbidden errutil errors
50 lines
2.0 KiB
Go
50 lines
2.0 KiB
Go
package ualert
|
|
|
|
import (
|
|
"xorm.io/xorm"
|
|
|
|
"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
|
|
)
|
|
|
|
const (
|
|
AlertingAddReceiverActionScopes = "Add scope to alert.notifications.receivers:read and alert.notifications.receivers.secrets:read"
|
|
)
|
|
|
|
// AddReceiverActionScopesMigration is a migration that will add scopes to alert.notifications.receivers:read and
|
|
// alert.notifications.receivers.secrets:read actions.
|
|
// Originally, they were created without any scope, but treated as if all actions were globally scoped.
|
|
// With the introduction of receiver FGAC, we need to scope these actions to UID so any existing roles should be updated
|
|
// to explicitly have the global scope.
|
|
func AddReceiverActionScopesMigration(mg *migrator.Migrator) {
|
|
mg.AddMigration(AlertingAddReceiverActionScopes, &addReceiverActionScopesMigrator{})
|
|
}
|
|
|
|
var _ migrator.CodeMigration = (*addReceiverActionScopesMigrator)(nil)
|
|
|
|
type addReceiverActionScopesMigrator struct {
|
|
migrator.MigrationBase
|
|
}
|
|
|
|
func (p addReceiverActionScopesMigrator) SQL(migrator.Dialect) string {
|
|
return codeMigration
|
|
}
|
|
|
|
func (p addReceiverActionScopesMigrator) Exec(sess *xorm.Session, migrator *migrator.Migrator) error {
|
|
// Vendored.
|
|
actionAlertingReceiversRead := "alert.notifications.receivers:read"
|
|
actionAlertingReceiversReadSecrets := "alert.notifications.receivers.secrets:read"
|
|
|
|
_, err := sess.Exec("UPDATE permission SET `scope` = 'receivers:*', `kind` = 'receivers', `attribute` = '*', `identifier` = '*' WHERE action = ?", actionAlertingReceiversRead)
|
|
if err != nil {
|
|
migrator.Logger.Error("Failed to update permissions for action", "action", actionAlertingReceiversRead, "error", err)
|
|
return err
|
|
}
|
|
|
|
_, err = sess.Exec("UPDATE permission SET `scope` = 'receivers:*', `kind` = 'receivers', `attribute` = '*', `identifier` = '*' WHERE action = ?", actionAlertingReceiversReadSecrets)
|
|
if err != nil {
|
|
migrator.Logger.Error("Failed to update permissions for action", "action", actionAlertingReceiversReadSecrets, "error", err)
|
|
return err
|
|
}
|
|
return nil
|
|
}
|