root
/
grafana
mirror of https://github.com/grafana/grafana.git
1
0
Fork 0
Code Issues Actions 142 Packages Projects Releases Wiki Activity

use FT for assessing what permissions to set

This commit is contained in:
IevaVasiljeva 2025-10-07 10:38:50 +01:00
parent 3833124031
commit 858c5b0290
No known key found for this signature in database
3 changed files with 23 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/registry/apis/folders/folder_storage.go
View File

@ -19,6 +19,7 @@ import (
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
"github.com/grafana/grafana/pkg/services/dashboards/dashboardaccess"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/org"
)
@ -39,6 +40,7 @@ type folderStorage struct {
tableConverter rest.TableConvertor
permissionsOnCreate bool // cfg.RBAC.PermissionsOnCreation("folder")
features featuremgmt.FeatureToggles
folderPermissionsSvc accesscontrol.FolderPermissionsService
acService accesscontrol.Service
}
@ -150,27 +152,32 @@ func (s *folderStorage) DeleteCollection(ctx context.Context, deleteValidation r
}
func (s *folderStorage) setDefaultFolderPermissions(ctx context.Context, orgID int64, user identity.Requester, uid, parentUID string) error {
var permissions []accesscontrol.SetResourcePermissionCommand
isNested := parentUID != ""
if isNested {
if s.features.IsEnabledGlobally(featuremgmt.FlagKubernetesDashboards) && isNested {
// No permissions on nested folders when kubernetesDashboards is enabled
return nil
}
permissions := []accesscontrol.SetResourcePermissionCommand{
{BuiltinRole: string(org.RoleEditor), Permission: dashboardaccess.PERMISSION_EDIT.String()},
{BuiltinRole: string(org.RoleViewer), Permission: dashboardaccess.PERMISSION_VIEW.String()},
}
// Creator permissions always set with the legacy behaviour and set on root level folders for new behaviour
if user.IsIdentityType(claims.TypeUser, claims.TypeServiceAccount) {
userID, err := user.GetInternalID()
if err != nil {
return err
}
permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{
UserID: userID, Permission: dashboardaccess.PERMISSION_ADMIN.String(),
})
}
if !isNested {
permissions = append(permissions, []accesscontrol.SetResourcePermissionCommand{
{BuiltinRole: string(org.RoleEditor), Permission: dashboardaccess.PERMISSION_EDIT.String()},
{BuiltinRole: string(org.RoleViewer), Permission: dashboardaccess.PERMISSION_VIEW.String()},
}...)
}
_, err := s.folderPermissionsSvc.SetPermissions(ctx, orgID, uid, permissions...)
if err != nil {
return err

1
pkg/registry/apis/folders/register.go
View File

@ -168,6 +168,7 @@ func (b *FolderAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.API
b.storage = &folderStorage{
tableConverter: resourceInfo.TableConverter(),
folderPermissionsSvc: b.folderPermissionsSvc,
features: b.features,
acService: b.acService,
permissionsOnCreate: b.permissionsOnCreate,
store: dw,

22
pkg/services/dashboards/service/dashboard_service.go
View File

@ -1179,30 +1179,24 @@ func (dr *DashboardServiceImpl) SetDefaultPermissionsAfterCreate(ctx context.Con
return err
}
permissions := []accesscontrol.SetResourcePermissionCommand{}
isNested := obj.GetFolder() != ""
if dr.features.IsEnabledGlobally(featuremgmt.FlagKubernetesDashboards) && isNested {
// Don't set any permissions for nested dashboards
return nil
}
if user.IsIdentityType(claims.TypeUser, claims.TypeServiceAccount) {
permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{
UserID: uid, Permission: dashboardaccess.PERMISSION_ADMIN.String(),
})
}
isNested := obj.GetFolder() != ""
if !dr.features.IsEnabledGlobally(featuremgmt.FlagKubernetesDashboards) {
// legacy behavior
if !isNested {
permissions = append(permissions, []accesscontrol.SetResourcePermissionCommand{
{BuiltinRole: string(org.RoleEditor), Permission: dashboardaccess.PERMISSION_EDIT.String()},
{BuiltinRole: string(org.RoleViewer), Permission: dashboardaccess.PERMISSION_VIEW.String()},
}...)
}
} else {
// Don't set any permissions for nested dashboards
if isNested {
return nil
}
if !isNested {
permissions = append(permissions, []accesscontrol.SetResourcePermissionCommand{
{BuiltinRole: string(org.RoleEditor), Permission: dashboardaccess.PERMISSION_EDIT.String()},
{BuiltinRole: string(org.RoleViewer), Permission: dashboardaccess.PERMISSION_VIEW.String()},
}...)
}
svc := dr.getPermissionsService(key.Resource == "folders")
if _, err := svc.SetPermissions(ctx, ns.OrgID, obj.GetName(), permissions...); err != nil {
logger.Error("Could not set default permissions", "error", err)