pkg/services/pluginsintegration/pluginaccesscontrol/accesscontrol.go - main - githubmirror/grafana

pkg/services/pluginsintegration/pluginaccesscontrol/accesscontrol.go
138 строк5 KB
Yudintsev George (Egor)
GlobalRoles: Chore: export fixed roles (#123339)
29 апр 2026, 16:36
29 апр 2026, 16:360d0de1e
package pluginaccesscontrol

import (
	"context"

	"github.com/grafana/grafana/pkg/plugins"
	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
	"github.com/grafana/grafana/pkg/services/datasources"
	"github.com/grafana/grafana/pkg/services/org"
	"github.com/grafana/grafana/pkg/setting"
)

const (
	// Plugins actions
	ActionInstall = "plugins:install"
	ActionWrite   = "plugins:write"

	// App Plugins actions
	ActionAppAccess = "plugins.app:access"

	pluginsMaintainerRoleName = ac.FixedRolePrefix + "plugins:maintainer"
)

var (
	ScopeProvider = ac.NewScopeProvider("plugins")
	// Protects access to the Configuration > Plugins page
	AdminAccessEvaluator = ac.EvalAny(ac.EvalPermission(ActionWrite), ac.EvalPermission(ActionInstall))
)

// RoleRegistry handles the plugin RBAC roles and their assignments
type RoleRegistry interface {
	DeclarePluginRoles(ctx context.Context, ID, name string, registrations []plugins.RoleRegistration) error
}

// ActionSetRegistry handles the plugin RBAC actionsets
type ActionSetRegistry interface {
	RegisterActionSets(ctx context.Context, ID string, registrations []plugins.ActionSet) error
}

func ReqCanAdminPlugins(cfg *setting.Cfg) func(rc *contextmodel.ReqContext) bool {
	// Legacy handler that protects access to the Configuration > Plugins page
	return func(rc *contextmodel.ReqContext) bool {
		return rc.OrgRole == org.RoleAdmin || cfg.PluginAdminEnabled && rc.IsGrafanaAdmin
	}
}

// FixedRoleRegistrations returns plugin role registrations with grants adjusted
// for the running instance. When pluginAdminEnabled is false the maintainer
// role receives no grants (plugin install/uninstall is disabled).
func FixedRoleRegistrations(pluginAdminEnabled bool) []ac.RoleRegistration {
	AppPluginsReader := ac.RoleRegistration{
		Role: ac.RoleDTO{
			Name:        ac.FixedRolePrefix + "plugins.app:reader",
			DisplayName: "Application Plugins Access",
			Description: "Access application plugins (still enforcing the organization role)",
			Group:       "Plugins",
			Permissions: []ac.Permission{
				{Action: ActionAppAccess, Scope: ScopeProvider.GetResourceAllScope()},
			},
		},
		Grants: []string{string(org.RoleViewer)},
	}
	PluginsWriter := ac.RoleRegistration{
		Role: ac.RoleDTO{
			Name:        ac.FixedRolePrefix + "plugins:writer",
			DisplayName: "Writer",
			Description: "Enable and disable plugins and edit plugins' settings",
			Group:       "Plugins",
			Permissions: []ac.Permission{
				{Action: ActionWrite, Scope: ScopeProvider.GetResourceAllScope()},
			},
		},
		Grants: []string{string(org.RoleAdmin)},
	}

	maintainerGrants := []string{ac.RoleGrafanaAdmin}
	if !pluginAdminEnabled {
		maintainerGrants = []string{}
	}
	PluginsMaintainer := ac.RoleRegistration{
		Role: ac.RoleDTO{
			Name:        pluginsMaintainerRoleName,
			DisplayName: "Maintainer",
			Description: "Install, uninstall plugins. Needs to be assigned globally.",
			Group:       "Plugins",
			Permissions: []ac.Permission{
				{Action: ActionInstall},
			},
		},
		Grants: maintainerGrants,
	}

	return []ac.RoleRegistration{AppPluginsReader, PluginsWriter, PluginsMaintainer}
}

func DeclareRBACRoles(service ac.Service, cfg *setting.Cfg) error {
	return service.DeclareFixedRoles(FixedRoleRegistrations(cfg.PluginAdminEnabled)...)
}

var datasourcesActions = map[string]bool{
	datasources.ActionIDRead:                    true,
	datasources.ActionQuery:                     true,
	datasources.ActionRead:                      true,
	datasources.ActionWrite:                     true,
	datasources.ActionDelete:                    true,
	datasources.ActionPermissionsRead:           true,
	datasources.ActionPermissionsWrite:          true,
	"datasources.caching:read":                  true,
	"datasources.caching:write":                 true,
	ac.ActionAlertingRuleExternalRead:           true,
	ac.ActionAlertingRuleExternalWrite:          true,
	ac.ActionAlertingInstancesExternalRead:      true,
	ac.ActionAlertingInstancesExternalWrite:     true,
	ac.ActionAlertingNotificationsExternalRead:  true,
	ac.ActionAlertingNotificationsExternalWrite: true,
}

// GetDataSourceRouteEvaluator returns an evaluator for the given data source UID and action.
func GetDataSourceRouteEvaluator(dsUID, action string) ac.Evaluator {
	if datasourcesActions[action] {
		return ac.EvalPermission(action, "datasources:uid:"+dsUID)
	}
	return ac.EvalPermission(action)
}

var pluginsActions = map[string]bool{
	ActionWrite:     true,
	ActionAppAccess: true,
}

// GetPluginRouteEvaluator returns an evaluator for the given plugin ID and action.
func GetPluginRouteEvaluator(pluginID, action string) ac.Evaluator {
	if pluginsActions[action] {
		return ac.EvalPermission(action, "plugins:id:"+pluginID)
	}
	return ac.EvalPermission(action)
}