mirror of
https://github.com/grafana/grafana.git
synced 2025-07-30 20:42:31 +08:00
488e994d37
* Access control: Use composite cache key for team permissions * use composite key for teams * use cache for hotpath (getCachedUserPermissions) * fix linter * fix sorting --------- Co-authored-by: Jeff Levin <jeff@levinology.com>
55 lines
1.6 KiB
Go
55 lines
1.6 KiB
Go
package accesscontrol
|
|
|
|
import (
|
|
"fmt"
|
|
"slices"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/grafana/grafana/pkg/apimachinery/identity"
|
|
)
|
|
|
|
func GetUserPermissionCacheKey(user identity.Requester) string {
|
|
return fmt.Sprintf("rbac-permissions-%s", user.GetCacheKey())
|
|
}
|
|
|
|
func GetSearchPermissionCacheKey(user identity.Requester, searchOptions SearchOptions) string {
|
|
key := fmt.Sprintf("rbac-permissions-%s", user.GetCacheKey())
|
|
if searchOptions.Action != "" {
|
|
key += fmt.Sprintf("-%s", searchOptions.Action)
|
|
}
|
|
if searchOptions.Scope != "" {
|
|
key += fmt.Sprintf("-%s", searchOptions.Scope)
|
|
}
|
|
if len(searchOptions.RolePrefixes) > 0 {
|
|
key += "-" + strings.Join(searchOptions.RolePrefixes, "-")
|
|
}
|
|
if searchOptions.ActionPrefix != "" {
|
|
key += fmt.Sprintf("-%s", searchOptions.ActionPrefix)
|
|
}
|
|
return key
|
|
}
|
|
|
|
func GetUserDirectPermissionCacheKey(user identity.Requester) string {
|
|
return fmt.Sprintf("rbac-permissions-direct-%s", user.GetCacheKey())
|
|
}
|
|
|
|
func GetBasicRolePermissionCacheKey(role string, orgID int64) string {
|
|
roleKey := strings.Replace(role, " ", "_", -1)
|
|
roleKey = strings.ToLower(roleKey)
|
|
return fmt.Sprintf("rbac-permissions-basic-role-%d-%s", orgID, roleKey)
|
|
}
|
|
|
|
func GetTeamPermissionCacheKey(teamID int64, orgID int64) string {
|
|
return fmt.Sprintf("rbac-permissions-team-%d-%d", orgID, teamID)
|
|
}
|
|
|
|
func GetTeamPermissionCompositeCacheKey(teamIds []int64, orgID int64) string {
|
|
teams := make([]string, 0)
|
|
for _, id := range teamIds {
|
|
teams = append(teams, strconv.FormatInt(id, 10))
|
|
}
|
|
slices.Sort(teams)
|
|
return fmt.Sprintf("rbac-permissions-team-%d-%s", orgID, strings.Join(teams, "-"))
|
|
}
|