grafana

Commit Graph

Author	SHA1	Message	Date
Alexander Zobnin	87d86e81ce	Zanzana: Evaluate permissions alongside with RBAC engine (#90064 ) * Zanzana: Evaluate permissions if feature flag enabled * Fix tests * adjust logs * fix spelling * remove unused * only evaluate implemented resources * refactor	1 year ago
William Wernert	006d0021e3	Alerting: Remove requirement for datasource query on rule read (#87349 ) * Remove requirement for datasource query for rule read * Address PR comments	2 years ago
Ieva	167151b211	Chore: Remove use of deprecated method in AC code (#87541 ) * switch from using cfg to using featuremgmt for checking a feature toggle in AC code * merge test fixes	2 years ago
Fayzal Ghantiwala	df25e9197e	Alerting: Get grafana-managed alert rule by UID (#86845 ) * Add auth checks and test * Check user is authorized to view rule and add tests * Change naming * Update Swagger params * Update auth test and swagger gen * Update swagger gen * Change response to GettableExtendedRuleNode * openapi3-gen * Update tests with refactors models pkg	2 years ago
Yuri Tseretyan	052082a927	Alerting: Refactor Alert Rule Generators (#86813 )	2 years ago
Dave Henderson	5687243d0b	Feature Flags: use FeatureToggles interface where possible (#85131 ) * Feature Flags: use FeatureToggles interface where possible Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * Replace TestFeatureToggles with existing WithFeatures Signed-off-by: Dave Henderson <dave.henderson@grafana.com> --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com>	2 years ago
Yuri Tseretyan	e593d36ed8	Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289 ) * require "folders:read" and "alert.rules:read" in all rules API requests (write and read). * add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup * check only access to datasource in rule testing API --------- Co-authored-by: William Wernert <william.wernert@grafana.com>	2 years ago
William Wernert	b7bbc5058f	Alerting: Don't validate rules on group update if they've only been reordered (#81841 ) --------- Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>	2 years ago
Yuri Tseretyan	1eebd2a4de	Alerting: Support for simplified notification settings in rule API (#81011 ) * Add notification settings to storage\domain and API models. Settings are a slice to workaround XORM mapping * Support validation of notification settings when rules are updated * Implement route generator for Alertmanager configuration. That fetches all notification settings. * Update multi-tenant Alertmanager to run the generator before applying the configuration. * Add notification settings labels to state calculation * update the Multi-tenant Alertmanager to provide validation for notification settings * update GET API so only admins can see auto-gen	2 years ago
Yuri Tseretyan	47546a4c72	Alerting: Update API to use folders' full paths (#81214 ) * update GetUserVisibleNamespaces to use FolderSeriver * update GetNamespaceByUID to use FolderService.GetFolders * update GetAlertRulesForScheduling to use FolderService.GetFolders * Update API and GetAlertRulesForScheduling to use the folder's full path * get full path of folder in RouteTestGrafanaRuleConfig * fix escaping of titles for MySQL	2 years ago
William Wernert	2203bc2a3d	Alerting: Refactor provisioning tests/fakes (#81205 ) * Fix up test Alertmanager config JSON * Move fake AM config and provisioning stores to fakes package	2 years ago
Sofia Papagiannaki	d1dab5828d	Alerting: Update rule API to address folders by UID (#74600 ) * Change ruler API to expect the folder UID as namespace * Update example requests * Fix tests * Update swagger * Modify FIle field in /api/prometheus/grafana/api/v1/rules * Fix ruler export * Modify folder in responses to be formatted as <parent UID>/<title> * Add alerting test with nested folders * Apply suggestion from code review * Alerting: use folder UID instead of title in rule API (#77166) Co-authored-by: Sonia Aguilar <soniaaguilarpeiron@gmail.com> * Drop a few more latent uses of namespace_id * move getNamespaceKey to models package * switch GetAlertRulesForScheduling to use folder table * update GetAlertRulesForScheduling to return folder titles in format `parent_uid/title`. * fi tests * add tests for GetAlertRulesForScheduling when parent uid * fix integration tests after merge * fix test after merge * change format of the namespace to JSON array this is needed for forward compatibility, when we migrate to full paths * update EF code to decode nested folder --------- Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com> Co-authored-by: Virginia Cepeda <virginia.cepeda@grafana.com> Co-authored-by: Sonia Aguilar <soniaaguilarpeiron@gmail.com> Co-authored-by: Alex Weaver <weaver.alex.d@gmail.com> Co-authored-by: Gilles De Mey <gilles.de.mey@gmail.com>	2 years ago
Yuri Tseretyan	2be7605794	Alerting: Fix fine-grained rule access control to use 403 for authorization error (#79239 ) * use 403 for authorization error * update silences API * add ForbiddenError to rule API responses	2 years ago
Yuri Tseretyan	7cec741bae	Alerting: Extract alerting rules authorization logic to a service (#77006 ) * extract alerting authorization logic to separate package * convert authorization logic to service	2 years ago
Yuri Tseretyan	027bd9356f	Alerting: Rule Modify Export APIs (#75322 ) * extend RuleStore interface to get namespace by UID * add new export API endpoints * implement request handlers * update authorization and wire handlers to paths * add folder error matchers to errorToResponse * add tests for export methods	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066 )	2 years ago
Yuri Tseretyan	b963defa44	Alerting: update rules POST API to validate query and condition only for rules that changed. (#68667 ) * replace condition validation with just structural validation * validate conditions of only new and updated rules * add integration tests for rule update\delete API Co-authored-by: George Robinson <george.robinson@grafana.com>	3 years ago
Ieva	d98813796c	RBAC: Remove legacy AC from HasAccess permission check (#68995 ) * remove unused HasAdmin and HasEdit permission methods * remove legacy AC from HasAccess method * remove unused function * update alerting tests to work with RBAC	3 years ago
Yuri Tseretyan	85a954cd81	Alerting: Update scheduler to get updates only from database (#64635 ) * stop using the scheduler's Update and Delete methods all communication must be via the database * update scheduler's registry to calculate diff before re-setting the cache * update fetcher to return the diff generated by registry * update processTick to update rule eval routine if the rule was updated and it is not going to be evaluated at this tick. * remove references to the scheduler from api package * remove unused methods in the scheduler	3 years ago
Yuri Tseretyan	f561e71de8	Alerting: decouple api models from domain\dto models: separate Provenance status + converters (#63594 ) * move conversions of domain models to api models and reverse from definition package to api package	3 years ago
idafurjes	6c5a573772	Chore: Move ReqContext to contexthandler service (#62102 ) * Chore: Move ReqContext to contexthandler service * Rename package to contextmodel * Generate ngalert files * Remove unused imports	3 years ago
idafurjes	080ea88af7	Nested Folders: Support getting of nested folder in folder service wh… (#58597 ) * Nested Folders: Support getting of nested folder in folder service when feature flag is set * Fix lint * Fix some tests * Fix ngalert test * ngalert fix * Fix API tests * Fix some tests and lint * Fix lint 2 * Fix library elements and panels * Add access control to get folder * Cleanup and minor test change	3 years ago
Alexander Weaver	c16317e5b8	Alerting: Move fake rule store to the test utilities package (#56062 ) * Move fakeRuleStore to tests/fakes package * Break stub dependencies on store * Update existing tests to point to new location * Remove unused stub of TimeNow * Rename fake to take advantage of package name	3 years ago
Yuriy Tseretyan	2d38664fe6	Alerting: Improve validation of query and expressions on rule submit (#53258 ) * Improve error messages of server-side expression * move validation of alert queries and a condition to eval package	3 years ago
Yuriy Tseretyan	41bd36eb97	Alerting: Update rules delete endpoint to handle rules in group (#53790 ) * update RouteDeleteAlertRules rules to update as a group * remove expecter from scheduler mock to support variadic function * create function to check for provisioning status + tests Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343 ) * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Alexander Weaver	c50cbea0bb	Alerting: Extract alert rule diff logic into separate file with exported API (#53083 ) * Refactor diff logic into separate file with exported API * Fix linter complaint	3 years ago
Alexander Weaver	0d9389e1f4	Alerting: Code-gen parsing of URL parameters and fix related bugs (#50731 ) * Extend template and generate * Generate and fix up alertmanager endpoints * Prometheus routes * fix up Testing endpoints * touch up ruler API * Update provisioning and fix 500 * Drop dead code * Remove more dead code * Resolve merge conflicts	4 years ago
Yuriy Tseretyan	4d02f73e5f	Alerting: Persist rule position in the group (#50051 ) Migrations: * add a new column alert_group_idx to alert_rule table * add a new column alert_group_idx to alert_rule_version table * re-index existing rules during migration API: * set group index on update. Use the natural order of items in the array as group index * sort rules in the group on GET * update the version of all rules of all affected groups. This will make optimistic lock work in the case of multiple concurrent request touching the same groups. UI: * update UI to keep the order of alerts in a group	4 years ago
Yuriy Tseretyan	81089b956a	Alerting: Update authorization rules for RouteGetNamespaceRulesConfig (#50965 ) * use authorizeAccessToRuleGroup * use toGettableRuleGroupConfig in get by namespace * add comments for controller methods	4 years ago
Yuriy Tseretyan	c1550d1f07	Alerting: Rule api to fail update if provisioned rules are affected (#50835 ) * add function that checks whether changes mention provisioned rules * update API that updates group of rules to fail if check does not pass	4 years ago
Karl Persson	44ffbfd6aa	RBAC: Refactor GetUserPermissions to use []accesscontrol.Permission (#50683 ) * Return slice of permissions instead of slice of pointers for permissions	4 years ago
Yuriy Tseretyan	ad25e2a20c	Alerting: Update RBAC for alert rules to consider access to rule as access to group it belongs (#49033 ) * update authz to exclude entire group if user does not have access to rule * change rule update authz to not return changes because if user does not have access to any rule in group, they do not have access to the rule * a new query that returns alerts in group by UID of alert that belongs to that group * collect all affected groups during calculate changes * update authorize to check access to groups * update tests for calculateChanges to assert new fields * add authorization tests	4 years ago
Yuriy Tseretyan	f7f2253072	Alerting: Fix anonymous access to alerting (#49203 ) * introduce a fallback handler that checks that role is Viewer. * update UI nav links to allow alerting tabs for anonymous user * update rule api to check for Viewer role instead of SignedIn when RBAC is disabled	4 years ago
Yuriy Tseretyan	952cb4fc0b	Alerting: introduce AlertRuleGroupKey and use it in API handlers (#48945 ) * create AlertGroupKey structure * update PrometheusSrv. - extract creation of RuleGroup to a separate method. Use group key for grouping * update RuleSrv - update calculateChanges to use groupKey - authorize to use groupkey	4 years ago
Jean-Philippe Quéméner	30d9cc81ec	Alerting: check provenance of alert rules in current API (#48694 )	4 years ago
Jean-Philippe Quéméner	9e21e4d1c1	Alerting: indicate whether an alertrule is provisioned (#48458 )	4 years ago
George Robinson	c5547123bc	Remove redundant queries in GetAlertRules and GetOrgAlertRules and replace with ListAlertRules (#48108 )	4 years ago
Yuriy Tseretyan	af9353caec	Alerting: Add check for datasource permission in alert rule read API (#47087 ) * add check for access to rule's data source in GET APIs * use more general method GetAlertRules instead of GetNamespaceAlertRules. * remove unused GetNamespaceAlertRules. Tests: * create a method to generate permissions for rules * extract method to create RuleSrv * add tests for RouteGetNamespaceRulesConfig	4 years ago
Yuriy Tseretyan	c1dbe7617c	fix scope for datasource:query action (#46973 )	4 years ago
Yuriy Tseretyan	e20d157a9b	Alerting: rules delete API to check data source authorization (#46906 ) * merge RuleSrv rule delete methods * remove unused store methods * implement delete by uid for fake store * add scheduler mock * implement tests for RouteDeleteAlertRules	4 years ago
Yuriy Tseretyan	4ee48c2e77	Alerting: Update GetRuleGroupAlertRules to accept optional rule group (#46889 ) * rename GetRuleGroupAlertRules to GetAlertRules * make rule group optional in GetAlertRulesQuery * simplify FakeStore. the current structure did not support optional rule group	4 years ago
Yuriy Tseretyan	288e8eeb15	Alerting: Do not update rule in database if it was not changed (#45980 ) * do not include update if no diff * refactor calculate changes to include diff (and log) Co-authored-by: George Robinson <george.robinson@grafana.com>	4 years ago
Yuriy Tseretyan	f75bea481d	Alerting: validate rules and calculate changes in API controller (#45072 ) * Update API controller - add validation of rules API model - add function to calculate changes between the submitted alerts and existing alerts - update RoutePostNameRulesConfig to validate input models, calculate changes and apply in a transaction * Update DBStore - delete unused storage method. All the logic is moved upstream. - upsert to not modify fields of new by values from the existing alert - if rule has UID do not try to pull it from db. (it is done upstream) * Add rule generator	4 years ago

45 Commits (00381711a48eab296f7970abd768cbbe71bbdcda)