[WIP] RBAC: Improves Plugin ability for `reqAction` to have multiple actions #106335

eleijonmarck · 2025-06-04T14:44:28Z

NOTE:

Decision needed: we need to figure out of the operation should be a any or all evaluation of permissions.

What is this feature?

This update allows plugin RBAC to use multiple actions (with OR logic) for routes and navigation items. Users gain access if they possess any of the specified permissions. The plugin.schema.json for action and reqAction now accepts either a single string or an array of strings.

Why do we need this feature?

Previously, only a single RBAC action could be defined for plugin routes/navigation, limiting flexibility. This change enables more granular access control where users can have one of several permissions to access a resource

Who is this feature for?

Plugin developers needing more fine-grained access control, and Grafana administrators managing plugin permissions.

Changes:

Schema: action and reqAction in plugin.schema.json now support string or array of strings.
RBAC Logic: New MultiActionEvaluator functions implement OR logic for permission checks; relevant middleware updated.
Tests: Added unit tests for checking actions in the plugin json to be correct and in line with array of strings, or a string.

This change is backward compatible with existing single string action definitions.

Which issue(s) does this PR fix?:
https://github.com/grafana/grafana-enterprise/issues/8691

github-actions · 2025-06-04T14:46:37Z

😢 zizmor failed with exit code 14.

Expand for full output

error[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/release-pr.yml:42:3
   |
42 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

93 findings (45 ignored, 47 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 1 high

github-actions · 2025-06-04T14:47:22Z

💻 Deploy preview available:

https://deploy-preview-grafana-106335-zb444pucvq-vp.a.run.app/docs/grafana/latest/

IevaVasiljeva

LGTM overall, but added some suggestions and corrections.

IevaVasiljeva · 2025-06-04T15:17:17Z

docs/sources/developers/plugins/plugin.schema.json

+            "oneOf": [
+              {
+                "type": "string",
+                "description": "Single RBAC action required to see this page in the navigation menu. Supports wildcards (e.g., 'plugin.write.*')"


Do we need wildcard support if we allow defining multiple actions? Same question for reqAction.

After looking through the code changes, I don't think we actually support wildcards.

oh that's a miss from me! i had initially worked on wildcard

IevaVasiljeva · 2025-06-04T15:20:33Z

pkg/plugins/plugins.go

+			if str, ok := action.(string); ok && str != "" {
+				actions = append(actions, str)
+			}


nit: might be worth adding a log for cases where a non-string is specified here, to help debugging.

IevaVasiljeva · 2025-06-04T15:30:13Z

pkg/services/pluginsintegration/pluginaccesscontrol/accesscontrol.go

+	if len(actions) == 0 {
+		return ac.EvalPermission("") // Always deny
+	}


We should never encounter this case here, so I'm not sure how to best treat it. Feels wrong to deny, but feels risky to allow. Also feels weird to be denying by using EvalPermission(""). Something like "no opinion" that was implemented for the new APIs evaluators would be suitable, but that's probably overcomplicating it. If you stick with this code, could you please add a comment stating that this code should never be hit?

i actually removed this piece of code to make it easier. if we would have zero actions, we would hit the evaluator with zero evaluators which would result in a false. Meaning we would deny the request. Is this okay?

IevaVasiljeva · 2025-06-04T15:32:48Z

pkg/services/pluginsintegration/pluginaccesscontrol/accesscontrol.go

 	if datasourcesActions[action] {
 		return ac.EvalPermission(action, "datasources:uid:"+dsUID)
 	}
 	return ac.EvalPermission(action)
 }

+// GetDataSourceRouteMultiActionEvaluator returns an evaluator for multiple data source actions (OR logic)
+func GetDataSourceRouteMultiActionEvaluator(dsUID string, actions []string) ac.Evaluator {


I'd prefer to keep the previous function name, and not split the functions into a public and private one. Probably just a matter of preference, but these feel like unnecessary changes to me.

IevaVasiljeva · 2025-06-04T15:37:24Z

pkg/plugins/models_test.go

+// NOTE: maybe redundant test as the "only" thing the it does is to check the len of GetActions()
+//
+//	actions := e.GetActions()
+//	return len(actions) > 0


nit: remove the comment. I think it's worth keeping the test in, the logic might become more complex in the future.

yea, this was a review comment actually. so it worked! il note that for next time. that it is a review comment 👍

github-actions · 2025-07-26T02:16:14Z

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 2 weeks if no further activity occurs. Please feel free to give a status update or ping for review. Thank you for your contributions!

eleijonmarck added 2 commits June 4, 2025 15:33

updated docs

6fa7fa7

add multiaction checks

4948039

eleijonmarck requested a review from IevaVasiljeva June 4, 2025 14:44

eleijonmarck self-assigned this Jun 4, 2025

github-actions bot added area/backend type/docs Flags the technical writing team for documentation support; auto adds to org-wide docs project labels Jun 4, 2025

IevaVasiljeva reviewed Jun 4, 2025

View reviewed changes

remove the wildcard reference

4345fa3

github-actions bot added the stale Issue with no recent activity label Jul 26, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[WIP] RBAC: Improves Plugin ability for `reqAction` to have multiple actions #106335

[WIP] RBAC: Improves Plugin ability for `reqAction` to have multiple actions #106335

Uh oh!

eleijonmarck commented Jun 4, 2025

Uh oh!

github-actions bot commented Jun 4, 2025

Uh oh!

github-actions bot commented Jun 4, 2025

Uh oh!

IevaVasiljeva left a comment

Uh oh!

IevaVasiljeva Jun 4, 2025

Uh oh!

IevaVasiljeva Jun 4, 2025

Uh oh!

eleijonmarck Jun 4, 2025

Uh oh!

IevaVasiljeva Jun 4, 2025

Uh oh!

IevaVasiljeva Jun 4, 2025

Uh oh!

eleijonmarck Jun 17, 2025

Uh oh!

IevaVasiljeva Jun 4, 2025

Uh oh!

IevaVasiljeva Jun 4, 2025

Uh oh!

eleijonmarck Jun 4, 2025

Uh oh!

github-actions bot commented Jul 26, 2025

Uh oh!

Uh oh!

[WIP] RBAC: Improves Plugin ability for reqAction to have multiple actions #106335

Are you sure you want to change the base?

[WIP] RBAC: Improves Plugin ability for reqAction to have multiple actions #106335

Uh oh!

Conversation

eleijonmarck commented Jun 4, 2025

Uh oh!

github-actions bot commented Jun 4, 2025

Uh oh!

github-actions bot commented Jun 4, 2025

Uh oh!

IevaVasiljeva left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jul 26, 2025

Uh oh!

Uh oh!

[WIP] RBAC: Improves Plugin ability for `reqAction` to have multiple actions #106335

[WIP] RBAC: Improves Plugin ability for `reqAction` to have multiple actions #106335