RBAC: Allow scoping access to root level dashboards #76987
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
IevaVasiljeva
requested review from
papagian,
zserge and
nikimanoledaki
and removed request for
a team
gamab
approved these changes
Oct 24, 2023
There was a problem hiding this comment.
Great job and thanks for fixing this quickly. 🎉
I tested this with a service account with only the following permissions:
"permissions": [
{ "action": "dashboards:create", "scope": "folders:uid:general" },
{ "action": "dashboards:read", "scope": "folders:uid:general"}
]I could search dashboards at the root level and not the other ones.
The "provisioned" permission also popped up in the UI:
| @@ -163,7 +163,7 @@ func ProvideDashboardPermissions( | |||
| } | |||
| return append([]string{parentScope}, nestedScopes...), nil | |||
| } | |||
| return []string{}, nil | |||
| return []string{dashboards.ScopeFoldersProvider.GetResourceScopeUID(folder.GeneralFolderUID)}, nil | |||
There was a problem hiding this comment.
Do I understand this change correctly?
If the FolderID == 0 then user permissions targeting the General Folder will apply.
There was a problem hiding this comment.
Yes, exactly! Otherwise the correct permissions were not displayed in the UI for dashboards under the root.
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
3 tasks
grafana-delivery-bot bot
pushed a commit
that referenced
this pull request
Nov 3, 2023
* correctly check permissions to list dashboards on the root * correctly display the access inherited from general folder for dashboards * Update pkg/services/sqlstore/permissions/dashboard.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update dashboard_filter_no_subquery.go --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> (cherry picked from commit 159bb3c)
IevaVasiljeva
added a commit
that referenced
this pull request
Nov 3, 2023
RBAC: Allow scoping access to root level dashboards (#76987) * correctly check permissions to list dashboards on the root * correctly display the access inherited from general folder for dashboards * Update pkg/services/sqlstore/permissions/dashboard.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update dashboard_filter_no_subquery.go --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> (cherry picked from commit 159bb3c) Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What is this feature?
Take into account dashboard listing permissions scoped to the root (
folders:uid:general) when listing dashboards.Why do we need this feature?
To allow scoping access to root level dashboards.
Who is this feature for?
Anyone
Which issue(s) does this PR fix?:
Fixes https://github.com/grafana/grafana-enterprise/issues/5920
Special notes for your reviewer:
Please check that: