mirror of https://github.com/grafana/grafana
Karl Persson
8 months ago
parent
5533b30135
commit
95379dcd23
@ -0,0 +1,24 @@ |
||||
package common |
||||
|
||||
// Common relation for each resource
|
||||
const ( |
||||
RelationView string = "view" |
||||
RelationEdit string = "edit" |
||||
RelationAdmin string = "admin" |
||||
|
||||
RelationRead string = "read" |
||||
RelationWrite string = "write" |
||||
RelationCreate string = "create" |
||||
RelationDelete string = "delete" |
||||
RelationPermissionsRead string = "permissions_read" |
||||
RelationPermissionsWrite string = "permissions_write" |
||||
) |
||||
|
||||
var ResourceRelations = [...]string{ |
||||
RelationRead, |
||||
RelationWrite, |
||||
RelationCreate, |
||||
RelationDelete, |
||||
RelationPermissionsRead, |
||||
RelationPermissionsWrite, |
||||
} |
||||
@ -0,0 +1,69 @@ |
||||
package server |
||||
|
||||
import ( |
||||
"context" |
||||
|
||||
authzv1 "github.com/grafana/authlib/authz/proto/v1" |
||||
|
||||
"github.com/grafana/grafana/pkg/services/authz/zanzana/common" |
||||
authzextv1 "github.com/grafana/grafana/pkg/services/authz/zanzana/proto/v1" |
||||
) |
||||
|
||||
func (s *Server) Capabilities(ctx context.Context, r *authzextv1.CapabilitiesRequest) (*authzextv1.CapabilitiesResponse, error) { |
||||
if info, ok := common.GetTypeInfo(r.Group, r.Resource); ok { |
||||
return s.capabilitiesTyped(ctx, r, info) |
||||
} |
||||
return s.capabilitiesGeneric(ctx, r) |
||||
} |
||||
|
||||
func (s *Server) capabilitiesTyped(ctx context.Context, r *authzextv1.CapabilitiesRequest, info common.TypeInfo) (*authzextv1.CapabilitiesResponse, error) { |
||||
out := make([]string, 0, len(common.ResourceRelations)) |
||||
for _, relation := range common.ResourceRelations { |
||||
res, err := s.checkTyped(ctx, &authzv1.CheckRequest{ |
||||
Subject: r.Subject, |
||||
Group: r.Group, |
||||
Resource: r.Resource, |
||||
Namespace: r.Namespace, |
||||
Name: r.Name, |
||||
Folder: r.Folder, |
||||
Subresource: r.Subresource, |
||||
Path: r.Path, |
||||
}, info, relation) |
||||
|
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
if res.GetAllowed() { |
||||
out = append(out, relation) |
||||
} |
||||
} |
||||
|
||||
return &authzextv1.CapabilitiesResponse{Capabilities: out}, nil |
||||
} |
||||
|
||||
func (s *Server) capabilitiesGeneric(ctx context.Context, r *authzextv1.CapabilitiesRequest) (*authzextv1.CapabilitiesResponse, error) { |
||||
out := make([]string, 0, len(common.ResourceRelations)) |
||||
for _, relation := range common.ResourceRelations { |
||||
res, err := s.checkGeneric(ctx, &authzv1.CheckRequest{ |
||||
Subject: r.Subject, |
||||
Group: r.Group, |
||||
Resource: r.Resource, |
||||
Namespace: r.Namespace, |
||||
Name: r.Name, |
||||
Folder: r.Folder, |
||||
Subresource: r.Subresource, |
||||
Path: r.Path, |
||||
}, relation) |
||||
|
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
if res.GetAllowed() { |
||||
out = append(out, relation) |
||||
} |
||||
} |
||||
|
||||
return &authzextv1.CapabilitiesResponse{Capabilities: out}, nil |
||||
} |
||||
@ -0,0 +1,68 @@ |
||||
package server |
||||
|
||||
import ( |
||||
"context" |
||||
"testing" |
||||
|
||||
"github.com/stretchr/testify/assert" |
||||
"github.com/stretchr/testify/require" |
||||
|
||||
"github.com/grafana/grafana/pkg/services/authz/zanzana/common" |
||||
authzextv1 "github.com/grafana/grafana/pkg/services/authz/zanzana/proto/v1" |
||||
) |
||||
|
||||
func testCapabilities(t *testing.T, server *Server) { |
||||
newReq := func(subject, group, resource, folder, name string) *authzextv1.CapabilitiesRequest { |
||||
return &authzextv1.CapabilitiesRequest{ |
||||
// FIXME: namespace should map to store
|
||||
// Namespace: storeID,
|
||||
Subject: subject, |
||||
Group: group, |
||||
Resource: resource, |
||||
Name: name, |
||||
Folder: folder, |
||||
} |
||||
} |
||||
|
||||
t.Run("user:1 should only be able to read and write resource:dashboards.grafana.app/dashboards/1", func(t *testing.T) { |
||||
res, err := server.Capabilities(context.Background(), newReq("user:1", dashboardGroup, dashboardResource, "1", "1")) |
||||
require.NoError(t, err) |
||||
assert.Equal(t, res.GetCapabilities(), []string{common.RelationRead, common.RelationWrite}) |
||||
}) |
||||
|
||||
t.Run("user:2 should be able to read and write resource:dashboards.grafana.app/dashboards/1 through namespace", func(t *testing.T) { |
||||
res, err := server.Capabilities(context.Background(), newReq("user:2", dashboardGroup, dashboardResource, "1", "1")) |
||||
require.NoError(t, err) |
||||
assert.Equal(t, res.GetCapabilities(), []string{common.RelationRead, common.RelationWrite}) |
||||
}) |
||||
|
||||
t.Run("user:3 should be able to read resource:dashboards.grafana.app/dashboards/1 with set relation", func(t *testing.T) { |
||||
res, err := server.Capabilities(context.Background(), newReq("user:3", dashboardGroup, dashboardResource, "1", "1")) |
||||
require.NoError(t, err) |
||||
assert.Equal(t, res.GetCapabilities(), []string{common.RelationRead}) |
||||
}) |
||||
|
||||
t.Run("user:4 should be able to read dashboards.grafana.app/dashboards in folder 1", func(t *testing.T) { |
||||
res, err := server.Capabilities(context.Background(), newReq("user:4", dashboardGroup, dashboardResource, "1", "1")) |
||||
require.NoError(t, err) |
||||
assert.Equal(t, res.GetCapabilities(), []string{common.RelationRead}) |
||||
}) |
||||
|
||||
t.Run("user:5 should be able to read, write, create and delete resource:dashboards.grafana.app/dashboards/1 through folder with set relation", func(t *testing.T) { |
||||
res, err := server.Capabilities(context.Background(), newReq("user:5", dashboardGroup, dashboardResource, "1", "1")) |
||||
require.NoError(t, err) |
||||
assert.Equal(t, res.GetCapabilities(), []string{common.RelationRead, common.RelationWrite, common.RelationCreate, common.RelationDelete}) |
||||
}) |
||||
|
||||
t.Run("user:6 should be able to read folder 1 ", func(t *testing.T) { |
||||
res, err := server.Capabilities(context.Background(), newReq("user:6", folderGroup, folderResource, "", "1")) |
||||
require.NoError(t, err) |
||||
assert.Equal(t, res.GetCapabilities(), []string{common.RelationRead}) |
||||
}) |
||||
|
||||
t.Run("user:7 should be able to read folder one through namespace access", func(t *testing.T) { |
||||
res, err := server.Capabilities(context.Background(), newReq("user:7", folderGroup, folderResource, "", "1")) |
||||
require.NoError(t, err) |
||||
assert.Equal(t, res.GetCapabilities(), []string{common.RelationRead}) |
||||
}) |
||||
} |
||||
Loading…
Reference in new issue