mirror of https://github.com/grafana/grafana
Access control: Add access control based permissions to admins/users (#32409)
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>pull/32997/head
Vardan Torosyan
4 years ago
committed by
GitHub
parent
cdb4785496
commit
9f82eac833
@ -1,44 +0,0 @@ |
||||
package ossaccesscontrol |
||||
|
||||
import ( |
||||
"github.com/grafana/grafana/pkg/services/accesscontrol" |
||||
) |
||||
|
||||
const roleGrafanaAdmin = "Grafana Admin" |
||||
|
||||
var builtInRolesMap = map[string]accesscontrol.RoleDTO{ |
||||
"grafana:builtin:users:read:self": { |
||||
Name: "grafana:builtin:users:read:self", |
||||
Version: 1, |
||||
Permissions: []accesscontrol.Permission{ |
||||
{ |
||||
Action: "users:read", |
||||
Scope: "users:self", |
||||
}, |
||||
{ |
||||
Action: "users.tokens:list", |
||||
Scope: "users:self", |
||||
}, |
||||
{ |
||||
Action: "users.teams:read", |
||||
Scope: "users:self", |
||||
}, |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
var builtInRoleGrants = map[string][]string{ |
||||
"Viewer": { |
||||
"grafana:builtin:users:read:self", |
||||
}, |
||||
} |
||||
|
||||
func getBuiltInRole(role string) *accesscontrol.RoleDTO { |
||||
var builtInRole accesscontrol.RoleDTO |
||||
if r, ok := builtInRolesMap[role]; ok { |
||||
// Do not modify builtInRoles
|
||||
builtInRole = r |
||||
return &builtInRole |
||||
} |
||||
return nil |
||||
} |
||||
@ -0,0 +1,113 @@ |
||||
package accesscontrol |
||||
|
||||
// PredefinedRoles provides a map of permission sets/roles which can be
|
||||
// assigned to a set of users. When adding a new resource protected by
|
||||
// Grafana access control the default permissions should be added to a
|
||||
// new predefined role in this set so that users can access the new
|
||||
// resource. PredefinedRoleGrants lists which organization roles are
|
||||
// assigned which predefined roles in this list.
|
||||
var PredefinedRoles = map[string]RoleDTO{ |
||||
// TODO: Add support for inheritance between the predefined roles to
|
||||
// make the admin ⊃ editor ⊃ viewer property hold.
|
||||
usersAdminRead: { |
||||
Name: usersAdminRead, |
||||
Version: 1, |
||||
Permissions: []Permission{ |
||||
{ |
||||
Action: ActionUsersRead, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersTeamRead, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersAuthTokenList, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersQuotasList, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
}, |
||||
}, |
||||
usersAdminEdit: { |
||||
Name: usersAdminEdit, |
||||
Version: 1, |
||||
Permissions: []Permission{ |
||||
{ |
||||
// Inherited from grafana:roles:users:admin:read
|
||||
Action: ActionUsersRead, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
// Inherited from grafana:roles:users:admin:read
|
||||
Action: ActionUsersTeamRead, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
// Inherited from grafana:roles:users:admin:read
|
||||
Action: ActionUsersAuthTokenList, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersPasswordUpdate, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersCreate, |
||||
}, |
||||
{ |
||||
Action: ActionUsersWrite, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersDelete, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersEnable, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersDisable, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersPermissionsUpdate, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersLogout, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersAuthTokenUpdate, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
// Inherited from grafana:roles:users:admin:read
|
||||
Action: ActionUsersQuotasList, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
{ |
||||
Action: ActionUsersQuotasUpdate, |
||||
Scope: ScopeUsersAll, |
||||
}, |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
const ( |
||||
usersAdminEdit = "grafana:roles:users:admin:edit" |
||||
usersAdminRead = "grafana:roles:users:admin:read" |
||||
) |
||||
|
||||
// PredefinedRoleGrants specifies which organization roles are assigned
|
||||
// to which set of PredefinedRoles by default. Alphabetically sorted.
|
||||
var PredefinedRoleGrants = map[string][]string{ |
||||
RoleGrafanaAdmin: { |
||||
usersAdminEdit, |
||||
usersAdminRead, |
||||
}, |
||||
} |
||||
@ -0,0 +1,35 @@ |
||||
package accesscontrol |
||||
|
||||
import ( |
||||
"sort" |
||||
"strings" |
||||
"testing" |
||||
|
||||
"github.com/stretchr/testify/assert" |
||||
) |
||||
|
||||
func TestPredefinedRoles(t *testing.T) { |
||||
for name, r := range PredefinedRoles { |
||||
assert.Truef(t, |
||||
strings.HasPrefix(name, "grafana:roles:"), |
||||
"expected all predefined roles to be prefixed by 'grafana:roles:', found role '%s'", name, |
||||
) |
||||
assert.Equal(t, name, r.Name) |
||||
assert.NotZero(t, r.Version) |
||||
// assert.NotEmpty(t, r.Description)
|
||||
} |
||||
} |
||||
|
||||
func TestPredefinedRoleGrants(t *testing.T) { |
||||
for _, v := range PredefinedRoleGrants { |
||||
assert.True(t, |
||||
sort.SliceIsSorted(v, func(i, j int) bool { |
||||
return v[i] < v[j] |
||||
}), |
||||
"require role grant lists to be sorted", |
||||
) |
||||
for _, r := range v { |
||||
assert.Contains(t, PredefinedRoles, r) |
||||
} |
||||
} |
||||
} |
||||
Loading…
Reference in new issue