Skip to content

Commit 82bcfba

Browse files
ryantxuryantxu
authored
Preferences: refactor experimental apiserver and improve tests (grafana#111596)
1 parent a333e8a commit 82bcfba

File tree

23 files changed

+947
-291
lines changed

23 files changed

+947
-291
lines changed

‎apps/preferences/kinds/preferences.cue‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,21 +40,21 @@ preferencesV1alpha1: {
4040

4141
// Navigation preferences
4242
navbar?: #NavbarPreference
43-
} @cuetsy(kind="interface")
43+
}
4444

4545
#QueryHistoryPreference: {
4646
// one of: '' | 'query' | 'starred';
4747
homeTab?: string
48-
} @cuetsy(kind="interface")
48+
}
4949

5050
#CookiePreferences: {
5151
analytics?: {}
5252
performance?: {}
5353
functional?: {}
54-
} @cuetsy(kind="interface")
54+
}
5555

5656
#NavbarPreference: {
5757
bookmarkUrls: [...string]
58-
} @cuetsy(kind="interface")
58+
}
5959
}
6060
}

‎apps/preferences/pkg/apis/preferences/v1alpha1/preferences_client_gen.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,16 @@ func (c *PreferencesClient) Patch(ctx context.Context, identifier resource.Ident
7676
return c.client.Patch(ctx, identifier, req, opts)
7777
}
7878

79-
func (c *PreferencesClient) UpdateStatus(ctx context.Context, newStatus PreferencesStatus, opts resource.UpdateOptions) (*Preferences, error) {
79+
func (c *PreferencesClient) UpdateStatus(ctx context.Context, identifier resource.Identifier, newStatus PreferencesStatus, opts resource.UpdateOptions) (*Preferences, error) {
8080
return c.client.Update(ctx, &Preferences{
8181
TypeMeta: metav1.TypeMeta{
8282
Kind: PreferencesKind().Kind(),
8383
APIVersion: GroupVersion.Identifier(),
8484
},
8585
ObjectMeta: metav1.ObjectMeta{
8686
ResourceVersion: opts.ResourceVersion,
87+
Namespace: identifier.Namespace,
88+
Name: identifier.Name,
8789
},
8890
Status: newStatus,
8991
}, resource.UpdateOptions{

‎apps/preferences/pkg/apis/preferences/v1alpha1/stars_client_gen.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,16 @@ func (c *StarsClient) Patch(ctx context.Context, identifier resource.Identifier,
7676
return c.client.Patch(ctx, identifier, req, opts)
7777
}
7878

79-
func (c *StarsClient) UpdateStatus(ctx context.Context, newStatus StarsStatus, opts resource.UpdateOptions) (*Stars, error) {
79+
func (c *StarsClient) UpdateStatus(ctx context.Context, identifier resource.Identifier, newStatus StarsStatus, opts resource.UpdateOptions) (*Stars, error) {
8080
return c.client.Update(ctx, &Stars{
8181
TypeMeta: metav1.TypeMeta{
8282
Kind: StarsKind().Kind(),
8383
APIVersion: GroupVersion.Identifier(),
8484
},
8585
ObjectMeta: metav1.ObjectMeta{
8686
ResourceVersion: opts.ResourceVersion,
87+
Namespace: identifier.Namespace,
88+
Name: identifier.Name,
8789
},
8890
Status: newStatus,
8991
}, resource.UpdateOptions{

‎apps/preferences/pkg/apis/preferences_manifest.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/grafana/grafana-app-sdk/app"
1414
"github.com/grafana/grafana-app-sdk/resource"
1515
"k8s.io/apimachinery/pkg/runtime"
16+
"k8s.io/kube-openapi/pkg/spec3"
1617

1718
v1alpha1 "github.com/grafana/grafana/apps/preferences/pkg/apis/preferences/v1alpha1"
1819
)
@@ -66,6 +67,10 @@ var appManifestData = app.ManifestData{
6667
Schema: &versionSchemaStarsv1alpha1,
6768
},
6869
},
70+
Routes: app.ManifestVersionRoutes{
71+
Namespaced: map[string]spec3.PathProps{},
72+
Cluster: map[string]spec3.PathProps{},
73+
},
6974
},
7075
},
7176
}
@@ -95,6 +100,7 @@ var customRouteToGoResponseType = map[string]any{}
95100
// ManifestCustomRouteResponsesAssociator returns the associated response go type for a given kind, version, custom route path, and method, if one exists.
96101
// kind may be empty for custom routes which are not kind subroutes. Leading slashes are removed from subroute paths.
97102
// If there is no association for the provided kind, version, custom route path, and method, exists will return false.
103+
// Resource routes (those without a kind) should prefix their route with "<namespace>/" if the route is namespaced (otherwise the route is assumed to be cluster-scope)
98104
func ManifestCustomRouteResponsesAssociator(kind, version, path, verb string) (goType any, exists bool) {
99105
if len(path) > 0 && path[0] == '/' {
100106
path = path[1:]
@@ -113,8 +119,22 @@ func ManifestCustomRouteQueryAssociator(kind, version, path, verb string) (goTyp
113119
return goType, exists
114120
}
115121

122+
var customRouteToGoRequestBodyType = map[string]any{}
123+
124+
func ManifestCustomRouteRequestBodyAssociator(kind, version, path, verb string) (goType any, exists bool) {
125+
if len(path) > 0 && path[0] == '/' {
126+
path = path[1:]
127+
}
128+
goType, exists = customRouteToGoRequestBodyType[fmt.Sprintf("%s|%s|%s|%s", version, kind, path, strings.ToUpper(verb))]
129+
return goType, exists
130+
}
131+
116132
type GoTypeAssociator struct{}
117133

134+
func NewGoTypeAssociator() *GoTypeAssociator {
135+
return &GoTypeAssociator{}
136+
}
137+
118138
func (g *GoTypeAssociator) KindToGoType(kind, version string) (goType resource.Kind, exists bool) {
119139
return ManifestGoTypeAssociator(kind, version)
120140
}
@@ -124,3 +144,6 @@ func (g *GoTypeAssociator) CustomRouteReturnGoType(kind, version, path, verb str
124144
func (g *GoTypeAssociator) CustomRouteQueryGoType(kind, version, path, verb string) (goType runtime.Object, exists bool) {
125145
return ManifestCustomRouteQueryAssociator(kind, version, path, verb)
126146
}
147+
func (g *GoTypeAssociator) CustomRouteRequestBodyGoType(kind, version, path, verb string) (goType any, exists bool) {
148+
return ManifestCustomRouteRequestBodyAssociator(kind, version, path, verb)
149+
}

‎pkg/apimachinery/identity/context.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@ var serviceIdentityTokenPermissions = []string{
139139
"secret.grafana.app:*",
140140
"query.grafana.app:*",
141141
"iam.grafana.app:*",
142+
"preferences.grafana.app:*",
142143

143144
// Secrets Manager uses a custom verb for secret decryption, and its authorizer does not allow wildcard permissions.
144145
"secret.grafana.app/securevalues:decrypt",

‎pkg/registry/apis/preferences/authorizer.go‎

Lines changed: 90 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -6,55 +6,98 @@ import (
66

77
"k8s.io/apiserver/pkg/authorization/authorizer"
88

9+
"github.com/grafana/authlib/authz"
10+
"github.com/grafana/grafana-app-sdk/logging"
911
"github.com/grafana/grafana/pkg/apimachinery/identity"
1012
"github.com/grafana/grafana/pkg/registry/apis/preferences/utils"
1113
)
1214

13-
func (b *APIBuilder) GetAuthorizer() authorizer.Authorizer {
14-
return authorizer.AuthorizerFunc(
15-
func(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error) {
16-
user, err := identity.GetRequester(ctx)
17-
if err != nil {
18-
return authorizer.DecisionDeny, "valid user is required", err
19-
}
20-
21-
if !attr.IsResourceRequest() || user.GetIsGrafanaAdmin() || attr.GetName() == "" {
22-
return authorizer.DecisionAllow, "", nil
23-
}
24-
25-
name, found := utils.ParseOwnerFromName(attr.GetName())
26-
if !found {
27-
return authorizer.DecisionDeny, "invalid name", nil
28-
}
29-
30-
if attr.GetResource() == "stars" && name.Owner != utils.UserResourceOwner {
31-
return authorizer.DecisionDeny, "stars only support users", nil
32-
}
33-
34-
switch name.Owner {
35-
case utils.NamespaceResourceOwner:
36-
return authorizer.DecisionAllow, "", nil
37-
38-
case utils.UserResourceOwner:
39-
if user.GetUID() == name.Name {
40-
return authorizer.DecisionAllow, "", nil
41-
}
42-
return authorizer.DecisionDeny, "you may only fetch your own preferences", nil
43-
44-
case utils.TeamResourceOwner:
45-
admin := !attr.IsReadOnly() // we need admin to for non read only commands
46-
teams, err := b.sql.GetTeams(ctx, user.GetOrgID(), user.GetUID(), admin)
47-
if err != nil {
48-
return authorizer.DecisionDeny, "error fetching teams", err
49-
}
50-
if slices.Contains(teams, name.Name) {
51-
return authorizer.DecisionAllow, "", nil
52-
}
53-
return authorizer.DecisionDeny, "not a team member", nil
54-
55-
default:
56-
}
57-
58-
return authorizer.DecisionDeny, "invalid name", nil
59-
})
15+
type authorizeFromName struct {
16+
teams utils.TeamService
17+
oknames []string
18+
resource map[string][]utils.ResourceOwner // may include unknown
19+
}
20+
21+
func (a *authorizeFromName) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error) {
22+
user, err := identity.GetRequester(ctx)
23+
if err != nil || user == nil {
24+
return authorizer.DecisionDeny, "valid user is required", err
25+
}
26+
27+
if !attr.IsResourceRequest() {
28+
return authorizer.DecisionNoOpinion, "", nil
29+
}
30+
31+
owners, ok := a.resource[attr.GetResource()]
32+
if !ok {
33+
return authorizer.DecisionDeny, "missing resource name", nil
34+
}
35+
36+
// Check if the request includes explicit permissions
37+
res := authz.CheckServicePermissions(user, attr.GetAPIGroup(), attr.GetResource(), attr.GetVerb())
38+
if !res.Allowed {
39+
log := logging.FromContext(ctx)
40+
log.Info("calling service lacks required permissions",
41+
"isServiceCall", res.ServiceCall,
42+
"apiGroup", attr.GetAPIGroup(),
43+
"resource", attr.GetResource(),
44+
"verb", attr.GetVerb(),
45+
"permissions", len(res.Permissions),
46+
)
47+
return authorizer.DecisionDeny, "calling service lacks required permissions", nil
48+
}
49+
50+
if attr.GetName() == "" {
51+
if attr.IsReadOnly() {
52+
return authorizer.DecisionAllow, "", nil
53+
}
54+
return authorizer.DecisionDeny, "mutating request without a name", nil
55+
}
56+
57+
// the pseudo sub-resource
58+
if a.oknames != nil && slices.Contains(a.oknames, attr.GetName()) {
59+
return authorizer.DecisionAllow, "", nil
60+
}
61+
62+
info, _ := utils.ParseOwnerFromName(attr.GetName())
63+
if !slices.Contains(owners, info.Owner) {
64+
return authorizer.DecisionDeny, "unsupported owner type", nil
65+
}
66+
67+
switch info.Owner {
68+
case utils.NamespaceResourceOwner:
69+
if attr.IsReadOnly() {
70+
// Everyone can see the namespace
71+
return authorizer.DecisionAllow, "", nil
72+
}
73+
if user.GetOrgRole() == identity.RoleAdmin {
74+
return authorizer.DecisionAllow, "", nil
75+
}
76+
return authorizer.DecisionDeny, "must be an org admin to edit", nil
77+
78+
case utils.UserResourceOwner:
79+
if user.GetIdentifier() == info.Identifier {
80+
return authorizer.DecisionAllow, "", nil
81+
}
82+
return authorizer.DecisionDeny, "your are not the owner of the resource", nil
83+
84+
case utils.TeamResourceOwner:
85+
if a.teams == nil {
86+
return authorizer.DecisionDeny, "team checker not configured", err
87+
}
88+
ok, err := a.teams.InTeam(ctx, user, info.Identifier, !attr.IsReadOnly())
89+
if err != nil {
90+
return authorizer.DecisionDeny, "error fetching teams", err
91+
}
92+
if ok {
93+
return authorizer.DecisionAllow, "", nil
94+
}
95+
return authorizer.DecisionDeny, "you are not a member of the referenced team", nil
96+
97+
case utils.UnknownResourceOwner:
98+
return authorizer.DecisionAllow, "", nil
99+
}
100+
101+
// the owner was not explicitly allowed
102+
return authorizer.DecisionDeny, "", nil
60103
}

0 commit comments

Comments
 (0)