mirror of
https://github.com/grafana/grafana.git
synced 2025-08-01 11:53:09 +08:00
101ce57a94
* RBAC: Allow listing user permissions with scope * Add docs * Document the api endpoint * Update docs Co-authored-by: Garrett Guillotte <100453168+gguillotte-grafana@users.noreply.github.com> * Split endpoint in two * document reloadcache * Update docs/sources/developers/http_api/access_control.md * Fix test * Ieva's nit. * Simplify flag description Co-authored-by: Garrett Guillotte <100453168+gguillotte-grafana@users.noreply.github.com>
56 lines
1.7 KiB
Go
56 lines
1.7 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/grafana/grafana/pkg/api/response"
|
|
"github.com/grafana/grafana/pkg/api/routing"
|
|
"github.com/grafana/grafana/pkg/middleware"
|
|
"github.com/grafana/grafana/pkg/models"
|
|
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
|
|
)
|
|
|
|
func NewAccessControlAPI(router routing.RouteRegister, service ac.Service) *AccessControlAPI {
|
|
return &AccessControlAPI{
|
|
RouteRegister: router,
|
|
Service: service,
|
|
}
|
|
}
|
|
|
|
type AccessControlAPI struct {
|
|
Service ac.Service
|
|
RouteRegister routing.RouteRegister
|
|
}
|
|
|
|
func (api *AccessControlAPI) RegisterAPIEndpoints() {
|
|
// Users
|
|
api.RouteRegister.Group("/api/access-control", func(rr routing.RouteRegister) {
|
|
rr.Get("/user/actions", middleware.ReqSignedIn, routing.Wrap(api.getUserActions))
|
|
rr.Get("/user/permissions", middleware.ReqSignedIn, routing.Wrap(api.getUserPermissions))
|
|
})
|
|
}
|
|
|
|
// GET /api/access-control/user/actions
|
|
func (api *AccessControlAPI) getUserActions(c *models.ReqContext) response.Response {
|
|
reloadCache := c.QueryBool("reloadcache")
|
|
permissions, err := api.Service.GetUserPermissions(c.Req.Context(),
|
|
c.SignedInUser, ac.Options{ReloadCache: reloadCache})
|
|
if err != nil {
|
|
response.JSON(http.StatusInternalServerError, err)
|
|
}
|
|
|
|
return response.JSON(http.StatusOK, ac.BuildPermissionsMap(permissions))
|
|
}
|
|
|
|
// GET /api/access-control/user/permissions
|
|
func (api *AccessControlAPI) getUserPermissions(c *models.ReqContext) response.Response {
|
|
reloadCache := c.QueryBool("reloadcache")
|
|
permissions, err := api.Service.GetUserPermissions(c.Req.Context(),
|
|
c.SignedInUser, ac.Options{ReloadCache: reloadCache})
|
|
if err != nil {
|
|
response.JSON(http.StatusInternalServerError, err)
|
|
}
|
|
|
|
return response.JSON(http.StatusOK, ac.GroupScopesByAction(permissions))
|
|
}
|