mirror of
https://github.com/grafana/grafana.git
synced 2025-08-02 13:52:15 +08:00
88c11f1cc0
* AccessControl: Implement a way to register fixed roles * Add context to register func * Use FixedRoleGrantsMap instead of FixedRoleGrants * Removed FixedRoles map to sync.map * Wrote test for accesscontrol and provisioning * Use mutexes+map instead of sync maps * Create a sync map struct out of a Map and a Mutex * Create a sync map struct for grants as well * Validate builtin roles * Make validation public to access control * Handle errors consistently with what seeder does * Keep errors consistant amongst accesscontrol impl * Handle registration error * Reverse the registration direction thanks to a RoleRegistrant interface * Removed sync map in favor for simple maps since registration now happens during init * Work on the Registrant interface * Remove the Register Role from the interface to have services returning their registrations instead * Adding context to RegisterRegistrantsRoles and update descriptions * little bit of cosmetics * Making sure provisioning is ran after role registration * test for role registration * Change the accesscontrol interface to use a variadic * check if accesscontrol is enabled * Add a new test for RegisterFixedRoles and fix assign which was buggy * Moved RegistrationList def to roles.go * Change provisioning role's description * Better comment on RegisterFixedRoles * Correct comment on ValidateFixedRole * Simplify helper func to removeRoleHelper * Add log to saveFixedRole and assignFixedRole Co-authored-by: Vardan Torosyan <vardants@gmail.com> Co-authored-by: Jeremy Price <Jeremy.price@grafana.com>
108 lines
2.7 KiB
Go
108 lines
2.7 KiB
Go
package accesscontrol
|
|
|
|
import (
|
|
"time"
|
|
)
|
|
|
|
// RoleRegistration stores a role and its assignments to built-in roles
|
|
// (Viewer, Editor, Admin, Grafana Admin)
|
|
type RoleRegistration struct {
|
|
Role RoleDTO
|
|
Grants []string
|
|
}
|
|
|
|
type Role struct {
|
|
Version int64 `json:"version"`
|
|
UID string `json:"uid"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description"`
|
|
|
|
Updated time.Time `json:"updated"`
|
|
Created time.Time `json:"created"`
|
|
}
|
|
|
|
type RoleDTO struct {
|
|
Version int64 `json:"version"`
|
|
UID string `json:"uid"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description"`
|
|
Permissions []Permission `json:"permissions,omitempty"`
|
|
}
|
|
|
|
type Permission struct {
|
|
Action string `json:"action"`
|
|
Scope string `json:"scope"`
|
|
}
|
|
|
|
type EvaluationResult struct {
|
|
HasAccess bool
|
|
Meta interface{}
|
|
}
|
|
|
|
func (p RoleDTO) Role() Role {
|
|
return Role{
|
|
Name: p.Name,
|
|
Description: p.Description,
|
|
}
|
|
}
|
|
|
|
const (
|
|
// Permission actions
|
|
|
|
// Users actions
|
|
ActionUsersRead = "users:read"
|
|
ActionUsersWrite = "users:write"
|
|
ActionUsersTeamRead = "users.teams:read"
|
|
// We can ignore gosec G101 since this does not contain any credentials
|
|
// nolint:gosec
|
|
ActionUsersAuthTokenList = "users.authtoken:list"
|
|
// We can ignore gosec G101 since this does not contain any credentials
|
|
// nolint:gosec
|
|
ActionUsersAuthTokenUpdate = "users.authtoken:update"
|
|
// We can ignore gosec G101 since this does not contain any credentials
|
|
// nolint:gosec
|
|
ActionUsersPasswordUpdate = "users.password:update"
|
|
ActionUsersDelete = "users:delete"
|
|
ActionUsersCreate = "users:create"
|
|
ActionUsersEnable = "users:enable"
|
|
ActionUsersDisable = "users:disable"
|
|
ActionUsersPermissionsUpdate = "users.permissions:update"
|
|
ActionUsersLogout = "users:logout"
|
|
ActionUsersQuotasList = "users.quotas:list"
|
|
ActionUsersQuotasUpdate = "users.quotas:update"
|
|
|
|
// Org actions
|
|
ActionOrgUsersRead = "org.users:read"
|
|
ActionOrgUsersAdd = "org.users:add"
|
|
ActionOrgUsersRemove = "org.users:remove"
|
|
ActionOrgUsersRoleUpdate = "org.users.role:update"
|
|
|
|
// LDAP actions
|
|
ActionLDAPUsersRead = "ldap.user:read"
|
|
ActionLDAPUsersSync = "ldap.user:sync"
|
|
ActionLDAPStatusRead = "ldap.status:read"
|
|
ActionLDAPConfigReload = "ldap.config:reload"
|
|
|
|
// Server actions
|
|
ActionServerStatsRead = "server.stats:read"
|
|
|
|
// Settings actions
|
|
ActionSettingsRead = "settings:read"
|
|
|
|
// Datasources actions
|
|
ActionDatasourcesExplore = "datasources:explore"
|
|
|
|
// Global Scopes
|
|
ScopeGlobalUsersAll = "global:users:*"
|
|
|
|
// Users scope
|
|
ScopeUsersAll = "users:*"
|
|
|
|
// Settings scope
|
|
ScopeSettingsAll = "settings:**"
|
|
)
|
|
|
|
const RoleGrafanaAdmin = "Grafana Admin"
|
|
|
|
const FixedRolePrefix = "fixed:"
|