pkg/services/team/teamapi/api.go - main - githubmirror/grafana

pkg/services/team/teamapi/api.go
111 строк6 KB
Andrej Ocenas
Teams: Add validation and block deleting teams with ownerReferences to folders (#128202)
23 июл 2026, 16:14
23 июл 2026, 16:142003eb0
package teamapi

import (
	"github.com/grafana/grafana/pkg/api/routing"
	"github.com/grafana/grafana/pkg/infra/log"
	"github.com/grafana/grafana/pkg/middleware/requestmeta"
	"github.com/grafana/grafana/pkg/services/accesscontrol"
	"github.com/grafana/grafana/pkg/services/apiserver"
	"github.com/grafana/grafana/pkg/services/dashboards"
	"github.com/grafana/grafana/pkg/services/featuremgmt"
	"github.com/grafana/grafana/pkg/services/licensing"
	pref "github.com/grafana/grafana/pkg/services/preference"
	"github.com/grafana/grafana/pkg/services/preference/prefapi"
	"github.com/grafana/grafana/pkg/services/team"
	"github.com/grafana/grafana/pkg/services/user"
	"github.com/grafana/grafana/pkg/setting"
	"github.com/grafana/grafana/pkg/storage/unified/resource"
	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
)

type TeamAPI struct {
	teamService            team.Service
	ac                     accesscontrol.Service
	teamPermissionsService accesscontrol.TeamPermissionsService
	// FIXME: it's a legacy functionality and we should move to api calls in the future.
	// https://github.com/grafana/identity-access-team/issues/1922
	userService          user.Service
	license              licensing.Licensing
	cfg                  *setting.Cfg
	preferenceService    pref.Service
	preferenceK8sHandler *prefapi.K8sHandler
	ds                   dashboards.DashboardService
	logger               log.Logger
	features             featuremgmt.FeatureToggles
	teamClientFactory    teamClientFactory
	folderSearcher       resourcepb.ResourceIndexClient
}

func ProvideTeamAPI(
	routeRegister routing.RouteRegister,
	teamService team.Service,
	ac accesscontrol.Service,
	acEvaluator accesscontrol.AccessControl,
	teamPermissionsService accesscontrol.TeamPermissionsService,
	userService user.Service,
	license licensing.Licensing,
	cfg *setting.Cfg,
	preferenceService pref.Service,
	preferenceK8sHandler *prefapi.K8sHandler,
	ds dashboards.DashboardService,
	features featuremgmt.FeatureToggles,
	resourceClient resource.ResourceClient,
	clientConfigProvider apiserver.DirectRestConfigProvider,
) *TeamAPI {
	tapi := &TeamAPI{
		teamService:            teamService,
		ac:                     ac,
		teamPermissionsService: teamPermissionsService,
		userService:            userService,
		license:                license,
		cfg:                    cfg,
		preferenceService:      preferenceService,
		preferenceK8sHandler:   preferenceK8sHandler,
		ds:                     ds,
		logger:                 log.New("team-api"),
		features:               features,
		teamClientFactory:      &directRestConfigClientFactory{clientConfigProvider: clientConfigProvider},
		folderSearcher:         resourceClient,
	}

	tapi.registerRoutes(routeRegister, acEvaluator)
	return tapi
}

func (tapi *TeamAPI) registerRoutes(router routing.RouteRegister, ac accesscontrol.AccessControl) {
	authorize := accesscontrol.Middleware(ac)
	teamResolver := team.MiddlewareTeamUIDResolver(tapi.teamService, ":teamId")
	router.Group("/api", func(apiRoute routing.RouteRegister) {
		// team (admin permission required)
		apiRoute.Group("/teams", func(teamsRoute routing.RouteRegister) {
			teamsRoute.Post("/", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsCreate)),
				routing.Wrap(tapi.createTeam))
			teamsRoute.Put("/:teamId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsWrite,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.updateTeam))
			teamsRoute.Delete("/:teamId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsDelete,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.deleteTeamByID))
			teamsRoute.Get("/:teamId/members", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsRead,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.getTeamMembers))
			teamsRoute.Post("/:teamId/members", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.addTeamMember))
			teamsRoute.Put("/:teamId/members/:userId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.updateTeamMember))
			teamsRoute.Put("/:teamId/members", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.setTeamMemberships))
			teamsRoute.Delete("/:teamId/members/:userId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsPermissionsWrite,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.removeTeamMember))
			teamsRoute.Get("/:teamId/preferences", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.getTeamPreferences))
			teamsRoute.Put("/:teamId/preferences", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsWrite,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.updateTeamPreferences))
		}, requestmeta.SetOwner(requestmeta.TeamAuth))

		// team without requirement of user to be org admin
		apiRoute.Group("/teams", func(teamsRoute routing.RouteRegister) {
			teamsRoute.Get("/:teamId", teamResolver, authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead,
				accesscontrol.ScopeTeamsID)), routing.Wrap(tapi.getTeamByID))
			teamsRoute.Get("/search", authorize(accesscontrol.EvalPermission(accesscontrol.ActionTeamsRead)),
				routing.Wrap(tapi.searchTeams))
		}, requestmeta.SetOwner(requestmeta.TeamAuth))
	})
}