mirror of
https://github.com/grafana/grafana.git
synced 2026-06-09 08:34:38 -04:00
a4faa7f6bd
The files connector handles GET/POST/PUT/DELETE in a single place but was wired with a single static fallback role (accessWithAdmin), so any role fallback was wrong for at least one verb family — reads should fall back to Viewer, writes to Editor; an Admin-only fallback over-restricts both. Introduce auth.NewVerbAwareAccessChecker(read, write AccessChecker) which dispatches Check by req.Verb (get/list/watch -> read, everything else -> write), and compose accessWithViewer + accessWithEditor for the files connector. Inner checkers retain their fallback configuration; the wrapper's WithFallbackRole is intentionally a no-op (per-verb fallbacks are decided at construction). This does not by itself resolve the customer regression where MT-side authz denies dashboards:create for Editors on non-General folders — that denial originates in the MT authz service and the role fallback is a no-op in token mode regardless. Filed separately for the I&A team. This PR removes the static-fallback-role footgun on the files connector so the eventual MT fix surfaces correctly here. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| access_checker.go | ||
| access_checker_mock.go | ||
| session_access_checker.go | ||
| session_access_checker_test.go | ||
| token_access_checker.go | ||
| token_access_checker_test.go | ||
| verb_aware_access_checker.go | ||
| verb_aware_access_checker_test.go | ||