grafana

Commit Graph

Author	SHA1	Message	Date
Ieva	048d1e7c86	RBAC: Annotation permission migration (#78899 ) * add annotation permissions to dashboard managed role and add migrations for annotation permissions * fix a bug with conditional access level definitions * add tests * Update pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * apply feedback * add batching, fix tests and a typo * add one more test * undo unneeded change * undo unwanted change * only check the default basic permissions for non-OSS instances * account for all wildcards and simplify the check a bit * error handling and extra conditionals to avoid test failures * fix a bug with admin permissions not appearing for folders * fix the OSS check --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
idafurjes	7e5544ab21	Add MFolderIDsServiceCount to count folderIDs in services pkg (#81237 )	1 year ago
Marcus Efraimsson	6768c6c059	Chore: Remove public vars in setting package (#81018 ) Removes the public variable setting.SecretKey plus some other ones. Introduces some new functions for creating setting.Cfg.	1 year ago
Ieva	def1b05a93	RBAC: Clean up data source permissions after data source deletion (#80654 ) * clean up data source permissions after data source deletion * remove a comment	1 year ago
Jo	0de66a8099	Authz: Remove use of SignedInUser copy for permission evaluation (#78448 ) * remove use of SignedInUserCopies * add extra safety to not cross assign permissions unwind circular dependency dashboardacl->dashboardaccess fix missing import * correctly set teams for permissions * fix missing inits * nit: check err * exit early for api keys	2 years ago
Kat Yang	3a2e96b0db	Chore: Deprecate FolderID from Dashboard (#77823 ) * Chore: Deprecate FolderID from Dashboard * chore: add two missing nolint comments	2 years ago
Ieva	159bb3c032	RBAC: Allow scoping access to root level dashboards (#76987 ) * correctly check permissions to list dashboards on the root * correctly display the access inherited from general folder for dashboards * Update pkg/services/sqlstore/permissions/dashboard.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update dashboard_filter_no_subquery.go --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
kay delaney	a12cb8cbf3	LibraryPanels: Add RBAC support (#73475 )	2 years ago
Jo	4474f19836	Service Accounts: Enable adding folder, dashboard and data source permissions to service accounts (#76133 ) * Add SAs to Datasource permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * add SAs to dashboards/folders managed permissions * Update public/app/core/components/AccessControl/Permissions.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * regenerate i18n * add doc --------- Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	2 years ago
Jo	26339f978b	Auth: Move access control API to SignedInUser interface (#73144 ) * move access control api to SignedInUser interface * remove unused code * add logic for reading perms from a specific org * move the specific org logic to org_user.go * add a comment --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	2 years ago
Ieva	cfa1a2c55f	RBAC: Split non-empty scopes into `kind`, `attribute` and `identifier` fields for better search performance (#71933 ) * add a feature toggle * add the fields for attribute, kind and identifier to permission Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * set the new fields when new permissions are stored * add migrations Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * remove comments * Update pkg/services/accesscontrol/migrator/migrator.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * feedback: put column migrations behind the feature toggle, added an index, changed how wildcard scopes are split * PR feedback: add a comment and revert an accidentally changed file * PR feedback: handle the case with : in resource identifier * switch from checking feature toggle through cfg to checking it through featuremgmt * don't put the column migrations behind a feature toggle after all - this breaks permission queries from db --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Jo	49e42d1a8d	AccessControl: Add resource permission deletion helper (#71222 ) * add method for deleting managed resource permissions * test method	2 years ago
Ieva	ee3d742c7d	RBAC: inherit folder permissions when resolving managed permissions (#62244 ) * add nested folder scope inheritance to managed permission services * add a more specific erorr * remove circular dependencies * use errutil for returning erorr * fix tests * fix tests * define a new error in ac package	2 years ago
Kristin Laemmert	e8b8a9e276	chore: move dashboard_acl models into dashboard service (#62151 )	2 years ago
idafurjes	b54b80f473	Chore: Remove Result from dashboard models (#61997 ) * Chore: Remove Result from dashboard models * Fix lint tests * Fix dashboard service tests * Fix API tests * Remove commented out code * Chore: Merge main - cleanup	2 years ago
Kristin Laemmert	857649e30b	chore: move models/licensing into licensing service (#61878 )	2 years ago
idafurjes	7c2522c477	Chore: Move dashboard models to dashboard pkg (#61458 ) * Copy dashboard models to dashboard pkg * Use some models from current pkg instead of models * Adjust api pkg * Adjust pkg services * Fix lint	2 years ago
idafurjes	490a787d9d	Chore: Move tem member models to team pkg (#61294 ) * Chore: Move tem member models to team pkg * Fix test lint	2 years ago
idafurjes	f2ffce4351	Chore: Move team models to models pkg (#61262 ) * Chore: Move team models to models pkg * Fix ACL tests * More ACL tests * Change Id to ID in conflict user command test * Remove team from models * Fix ac test lint	2 years ago
Eric Leijonmarck	371d7850a5	Auth: Service account store refactor (#58961 ) * refactor: renaming of files from database to store * refactor: make service account store private - moves store interface to manager package - adds an interface to the ProvideAPI constructor - refactors tests to use the store when necessary - adds mocks for the new interface implementations in the tests package * wip * refactor: make fakestore in service * wip * wip * wip * working tests * trailing whitespaces * Update pkg/services/serviceaccounts/api/api.go * Update pkg/services/serviceaccounts/tests/common.go * Update pkg/services/serviceaccounts/tests/common.go * refactor: doc string for retriever * fix import unused * remove: serviceaccount from featuretoggle * added: back legacy serviceaccounts feature toggle * added: docs * refactor: make query for the SearchQuery * add: validation of service input fields * add validation	2 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087 ) * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago
Kristin Laemmert	c61b5e85b4	chore: replace sqlstore.Store with db.DB (#57010 ) * chore: replace sqlstore.SQLStore with db.DB * more post-sqlstore.SQLStore cleanup	3 years ago
Kristin Laemmert	701f6d5436	UserService: use the UserService instead of calling sqlstore directly (#55745 ) * UserService: update callers to use the UserService instead of calling sqlstore directly There is one major change hiding in this PR. UserService.Delete originally called a number of services to delete user-related records. I moved everything except the actual call to the user table, and moved those into the API. This was done to avoid dependencies cycles; many of our services depend on the user service, so the user service itself should have as few dependencies as possible.	3 years ago
Serge Zaitsev	4c19e83ff0	Chore: Move team store implementation to a separate package (#55514 ) * Chore: move team store implementation to a separate package * trying to fix more tests * fix tests in service accounts and access control * fix common tests * restore commented out test * add todos	3 years ago
Karl Persson	870929b463	RBAC: Add cache for oss rbac permissions (#55098 ) * RBAC: Add cache for oss permissions * RBAC: include service account actions * RBAC: revert changes to fetch service account permissions * Update comment for setting * RBAC: Disable permission chache for tests	3 years ago
Karl Persson	ff35e35ce0	RBAC: Move service and evaluator to acimpl package (#54714 ) * RBAC: Move access control evaluator to acimpl package * RBAC: Move service to acimpl package	3 years ago
Karl Persson	5a1b9d2283	RBAC: Remove DeclareFixedRoles wrapper on Access control and inject service (#54153 ) * RBAC: Remove DeclareFixedRoles wrapper on Access control and inject service when needed	3 years ago
Karl Persson	552d3fec8d	RBAC: Fix resolver issue on wildcard resulting in wrong status code for endpoints (#54208 ) * RBAC: Test evaluation before attaching mutator * RBAC: Return error if no resolver is found for scope * RBAC: Sync changes to evaluation in mock * RBAC: Check for resolver not found error and just fail the evaluation in that case	3 years ago
Karl Persson	55c7b8add2	RBAC: Split up service into several components (#54002 ) * RBAC: Rename interface to Store * RBAC: Move ranme scopeInjector * RBAC: Rename files to service * RBAC: Rename to service * RBAC: Split up accesscontrol into two components * RBAC: Add DeclareFixedRoles to AccessControl interface * Wire: Fix wire bindings * RBAC: Move resolvers to root * RBAC: Remove invalid test * RBAC: Inject access control service * RBAC: Implement the RoleRegistry interface in fake	3 years ago
Karl Persson	4ff4aaab23	RBAC: Remove builtin role code (#53767 ) * remove rbacBuiltInRoleAssignmentEnabled from frontendsettings * RBAC: Remove RBACBuiltInRoleAssignmentEnabled * RBAC: Remove code for builtin role * RolePicker: Remove unused prop * RolePicker: Rename builtinRole to basicRole * RolePicker: Rename onBuiltinRoleChange to onBasicRoleChange * RolePicker: Rename properties	3 years ago
Karl Persson	1b933ff3ed	RBAC: Move resource permissions store to service package (#53815 ) * Rename file to store * Move resource permission specific database functions to resourcepermissions package * Wire: Remove interface bind * RBAC: Remove injection of resourcepermission Store * RBAC: Export store constructor * Tests: Use resource permission package to initiate store used in tests * RBAC: Remove internal types package and move to resourcepermissions package * RBAC: Run database tests as itegration tests	3 years ago
Karl Persson	57d87389e0	RBAC: Remove user permissions in org when user is removed (#53782 ) * RBAC: Add orgID to DeleteUserPermissions * RBAC: Refactor query to delete all permissions in specified org, 0 deletes all permissions * Delete user permission in org when user is removed * Remove call to delete permissions in frontend * Remove user permissions if removed orgs is detected during oauth sync Co-authored-by: Jo <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	d1df896962	Remove unsued dep (#53785 )	3 years ago
Karl Persson	4069fe1c39	RBAC: Update permission query to not join on team table (#53677 ) * RBAC: Add teamIDs to get permission query * RBAC: Remove join on team table and use team ids * RBAC: Pass team ids	3 years ago
Karl Persson	c08fe3a53c	RBAC: Enable rbac when creating new settings (#53531 ) * Settings: Set RBACEnabled to true by default * Remove accessControlEnabledFlag and explicitly set to false when needed * Disable rbac for tests	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343 ) * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Ieva	b3a10202d4	Revert "Service accounts: Add service account to teams" (#52710 ) * Revert "Service accounts: Add service account to teams (#51536)" This reverts commit `0f919671e7`. * remove unneeded line * fix test	3 years ago
Ieva	fc4fd47deb	change managed permissions for service accounts (#52709 )	3 years ago
Ieva	f9ef7cac11	allow setting team managed permissions for service accounts (#52467 )	3 years ago
idafurjes	c061b66d5f	Chore: Split delete user method (#52216 ) * Remove user from preferences, stars, orguser, team member * Fix lint * Add Delete user from org and dashboard acl * Delete user from user auth * Add DeleteUser to quota * Add test files and adjust user auth store * Rename package in wire for user auth * Import Quota Service interface in other services * do the same in tests * fix lint tests * Fix tests * Add some tests * Rename InsertUser and DeleteUser to InsertOrgUser and DeleteOrgUser * Rename DeleteUser to DeleteByUser in quota * changing a method name in few additional places * Fix in other places * Fix lint * Fix tests * Chore: Split Delete User method * Add fakes for userauth * Add mock for access control Delete User permossion, use interface * Use interface for ream guardian * Add simple fake for dashboard acl * Add go routines, clean up, use interfaces * fix lint * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Add wrapper for not service account error * fix indentation * Use fmt for error wrapper Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>	3 years ago
Ieva	d85df0a560	Service Accounts: Managed permissions for service accounts (#51818 ) * backend changes * frontend changes * linting * nit * import order * allow SA creator to access the SA page * fix merge * tests * fix frontend tests Co-authored-by: alexanderzobnin alexanderzobnin@gmail.com	3 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536 ) * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit `cbf71fbd7f`. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	b9bb0513e3	Remove version property from fixed roles (#51298 )	3 years ago
Karl Persson	44ffbfd6aa	RBAC: Refactor GetUserPermissions to use []accesscontrol.Permission (#50683 ) * Return slice of permissions instead of slice of pointers for permissions	3 years ago
Karl Persson	9fd9a2cded	RBAC: Remove workaround to check permissions on folders for dashboard actions (#50291 ) * remove workaround to check permissions on folders for dashboard actions	3 years ago
Karl Persson	c4a75f9eb3	RBAC: Add scope resolvers for dashboards (#50110 ) * Inject access control into dashboard service * Add function to parse id scopes * Add dashboard as return value * Update mock * Return only err to keep service interface * Add scope resolvers for dashboard id scopes * Add function to parse uid scopes * Add dashboard uid scope resolver * Register scope resolvers for dashboards Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
Karl Persson	896a101f48	RBAC: Extract method from access control impl to a function in domain packge (#49947 ) * Remove GetUserBuiltInRoles and create it as a util function in accesscontrol domain package	3 years ago
Karl Persson	bdff63d4a8	RBAC: Include alert.rules action when setting folder permissions (#49946 ) * Generate additional actions when setting folder permissions in acl list * Add migration for managed folder permissions to include alert rule actions	3 years ago
Karl Persson	d82eb5902d	AccessControl: Cleanup access control interface (#49783 ) * removed unused function * Rename interface	3 years ago

1 2 3

107 Commits (02c0f5929ca6c7fe22c3420ee0314688546c3f77)