grafana

Commit Graph

Author	SHA1	Message	Date
Torkel Ödegaard	09f4068849	NavTree: Refactor out the navtree building from api/index.go and into it's own service (#55552 )	3 years ago
Ieva	6f93630e97	RBAC: add check for whether a role is managed (#55617 ) * add check for whether a role is managed * fix typo	3 years ago
Karl Persson	55c7b8add2	RBAC: Split up service into several components (#54002 ) * RBAC: Rename interface to Store * RBAC: Move ranme scopeInjector * RBAC: Rename files to service * RBAC: Rename to service * RBAC: Split up accesscontrol into two components * RBAC: Add DeclareFixedRoles to AccessControl interface * Wire: Fix wire bindings * RBAC: Move resolvers to root * RBAC: Remove invalid test * RBAC: Inject access control service * RBAC: Implement the RoleRegistry interface in fake	3 years ago
Karl Persson	cc78486535	RBAC: Display indicator if a permission is inherited (#54080 ) * RBAC: Add IsInherited property * PermissionList: Display inherited indicator	3 years ago
Karl Persson	4069fe1c39	RBAC: Update permission query to not join on team table (#53677 ) * RBAC: Add teamIDs to get permission query * RBAC: Remove join on team table and use team ids * RBAC: Pass team ids	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Ieva	b3a10202d4	Revert "Service accounts: Add service account to teams" (#52710 ) * Revert "Service accounts: Add service account to teams (#51536)" This reverts commit `0f919671e7`. * remove unneeded line * fix test	3 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536 ) * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit `cbf71fbd7f`. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Yuriy Tseretyan	54fa04263b	Alerting: Add RBAC actions and role for provisioning API routes (#50459 ) * add alert provisioning actions and role * linter	4 years ago
Ieva	5dbea9996b	RBAC: Make RBAC action names more consistent (#49730 ) * update action names * correctly retrieve teams for signed in user * remove test * undo swagger changes * undo swagger changes pt2 * add migration from old action names to the new ones * rename from list to read * linting * also update alertign actions * fix migration	4 years ago
Yuriy Tseretyan	258b3ab18b	Alerting: Fix RBAC actions for notification policies (#49185 ) * squash actions "alert.notifications:update", "alert.notifications:create", "alert.notifications:delete" to "alert.notifications:write" * add migration * update UI to use the write action * update docs * changelog	4 years ago
Karl Persson	f5ec4bcbd2	remove action to manage plugin that is not used or documented (#49309 )	4 years ago
Karl Persson	2738d1c557	Access Control: Move dashboard actions and create scope provider (#48618 ) * Move dashboard actions and create scope provider	4 years ago
Jguer	6a303bb6b8	AccessControl: Rename builtin role roles to basic roles (#48519 ) * AccessControl: Rename grafana:builtins roles to basic * AccessControl: rename macro references to basic Co-authored-by: gamab <gabi.mabs@gmail.com>	4 years ago
Gabriel MABILLE	9ed7e48454	AccessControl: Modify provisioning to prevent built-in role assignment (#48031 ) * Add basic and managed prefixes to avoid magic strings For now let's stick with grafana_builtins add function isBasic to RoleDTO add function isBasic to Role Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Add team store to wire Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	4 years ago
Jguer	3456793e0f	AccessControl: fix value copying in method access and add LogID (#47694 ) * AccessControl: fix value copying in method access and add LogID Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Lint. Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	4 years ago
Gabriel MABILLE	8bd825e16c	AccessControl: Make the built-in role definitions public (#47525 ) * AccessControl: Make the built-in role definitions public * Add context to RegisterFixedRoles Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Making BuiltInRolesWithParents public to the AccessControl package Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	4 years ago
Ieva	ef4c2672b3	Access control: SQL filtering for annotation listing (#47467 ) * pass in user to attribute scope resolver * add SQL filter to annotation listing * check annotation FGAC permissions before exposing them for commenting * remove the requirement to be able to list all annotations from annotation listing endpoint * adding tests for annotation listing * remove changes that got moved to a different PR * unused var * Update pkg/services/sqlstore/annotation.go Co-authored-by: Ezequiel Victorero <evictorero@gmail.com> * remove unneeded check * remove unneeded check * undo accidental change * undo accidental change * doc update * move tests * redo the approach for passing the user in for scope resolution * accidental change * cleanup * error handling Co-authored-by: Ezequiel Victorero <evictorero@gmail.com>	4 years ago
Ieva	bc9b5325a0	update docs, simplify actions and scopes (#47067 )	4 years ago
Karl Persson	a5e4a533fa	Access control: use uid for dashboard and folder scopes (#46807 ) * use uid:s for folder and dashboard permissions * evaluate folder and dashboard permissions based on uids * add dashboard.uid to accept list * Check for exact suffix * Check parent folder on create * update test * drop dashboard:create actions with dashboard scope * fix typo * AccessControl: test id 0 scope conversion * AccessControl: store only parent folder UID * AccessControl: extract general as a constant * FolderServices: Prevent creation of a folder uid'd general * FolderServices: Test folder creation prevention * Update pkg/services/guardian/accesscontrol_guardian.go * FolderServices: fix mock call expect * FolderServices: remove uneeded mocks Co-authored-by: jguer <joao.guerreiro@grafana.com>	4 years ago
Karl Persson	faf4a3f751	Access Control: Rename global users scope (#46794 ) * Rename scope from global:users to global.users to match scope convention	4 years ago
Ezequiel Victorero	c717320942	Adding FGAC annotations validation for creation and deletion (#46736 ) Access Control: Adding FGAC annotations validation for creation and deletion Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727 ) * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	4 years ago
Ieva	f2450575b3	Access control: FGAC for annotation updates (#46462 ) * proposal * PR feedback * fix canSave bug * update scope naming * linting * linting Co-authored-by: Ezequiel Victorero <ezequiel.victorero@grafana.com>	4 years ago
Karl Persson	4df7bf5ab2	Access control: Display inherited folder permissions in dashboards (#46421 )	4 years ago
Karl Persson	7192b7caee	Access control: Move licensing actions to licensing package (#46588 ) * Move licensing actions to licensing package	4 years ago
Yuriy Tseretyan	468def0c00	Alerting: fixed roles for fine-grained access control (#46553 ) * move alerting actions to accesscontrol to avoid cycledeps * define new actions and fixed roles for alerting * add folder permission to alert reader role	4 years ago
Ieva	510c69ec91	Access control: allow hiding roles (#46358 ) * allow hiding roles * extend docs * docs feedback * extend provisioning docs * formatting Co-authored-by: Leonard Gram <leo@xlson.com>	4 years ago
Karl Persson	8688073564	Access control: Support filter on several actions (#46524 ) * Add support for several actions when creating a acccess control sql filter	4 years ago
Yuriy Tseretyan	314be36a7c	Move datasource scopes and actions to access control package (#46334 ) * create scope provider * move datasource actions and scopes to datasource package + add provider * change usages to use datasource scopes and update data source name resolver to use provider * move folder permissions to dashboard package and update usages	4 years ago
J Guerreiro	7f1e8cee2b	APIKeys: Add AC controls for legacy API keys (#46255 ) * APIKeys: Add AC controls for legacy API keys * pluralize actions	4 years ago
Karl Persson	4982ca3b1d	Access control: Use access control for dashboard and folder (#44702 ) * Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	4 years ago
Ezequiel Victorero	4f815e3d8e	Access control: adding FGAC to annotation GET endpoints and fixed roles (#45102 ) * Access control: adding FGAC to annotation GET endpoints and fixed roles Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	922b9465ec	Access Control: Add function to set several permissions on a resource in one transaction (#44768 )	4 years ago
Gabriel MABILLE	178193c84b	AccessControl: Use an SQLFilter struct (#44887 )	4 years ago
Karl Persson	e844b263c7	Access control: Load permissions from memory and database (#42080 ) * Load permission from both in memory and from database Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
J Guerreiro	cb6e5ae8ce	AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add tests for AC guards in update/delete * AccessControl: add fixed role for team writer * AccessControl: ensure team related AC is deleted with team * Update pkg/api/team_test.go	4 years ago
Gabriel MABILLE	d4f682190f	AccessControl: Implement teams resource service (#43951 ) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * moving resourceservice to the main wire file pt2 * move team related actions so that they can be reused * PR feedback * fix * typo * Access Control: adding hooks for team member endpoints (#43991) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * add access control to list and add team member endpoint, and hooks for adding team members * member permission type is 0 * add ID scope for team permission checks * add more team actions, use Member for member permission name * protect team member update endpoint with FGAC permissions * update SQL functions for teams and the corresponding tests * also protect team member removal endpoint with FGAC permissions and add a hook to permission service * a few small fixes, provide team permission service to test setup * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * remove resource services from wireexts * remove unneeded actions * linting fix * remove comments * feedback fixes * feedback * simplifying * remove team member within the same transaction * fix a mistake with the error * call the correct sql fction * linting * Access control: tests for team member endpoints (#44177) * tests for team member endpoints * clean up and fix the tests * fixing tests take 2 * don't import enterprise test license * don't import enterprise test license * remove unused variable Co-authored-by: gamab <gabi.mabs@gmail.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	de2c5783fa	Access Control: Pass db session to hooks (#44428 ) * Move hook calls to database and pass session	4 years ago
Ieva	41b709d08d	Access control: permissions for team creation (#43506 ) * FGAC for team creation * tests * fix snapshot for UI tests * linting * update snapshots * Remove unecessary class and update tests Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Make the condition slightly easier Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	4 years ago
Karl Persson	b3d5a607d4	Access Control: Add option to filter only managed permissions (#43371 ) * Add option to filter only managed permissions	4 years ago
Karl Persson	c3ca2d214d	Access control: Refactor managed permission system to create api and frontend components (#42540 ) * Refactor resource permissions * Add frondend components for resource permissions Co-authored-by: kay delaney <45561153+kaydelaney@users.noreply.github.com> Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	4 years ago
Alexander Zobnin	da2c99a2e1	Access control: use delegatable flag to check if role can be granted (#42070 ) * Access control: use delegatable flag to check if role can be granted or not * Fix naming	4 years ago
Ieva	dcae138379	Access Control: adding group field to roles (#41465 ) * add group field to roles in AC models * change to using group_name as the column name * add a migration for group column	4 years ago
Karl Persson	3c659f1ea0	Access Control: Move part of access control database (#40483 ) * Add accesscontrol migrations * Add ResourceStore interface and related structs * Add team/user/builtin-role * Add accesscontrol database with functions to handle managed roles and permissions * Add ResourceManager * Add GetUserPermissions * Update pkg/services/accesscontrol/accesscontrol.go Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Eric Leijonmarck	b88cd08177	feat: fallback for displayname of non-fixed role without displayname (#40277 )	4 years ago
Gabriel MABILLE	458371c8eb	AccessControl: Extend scope parameters with extra params from context (#39722 ) * AccessControl: Extend scope parameters with extra params from context Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Eric Leijonmarck	5374eaca89	fix: marshal displayname RoleDTO (#40015 )	4 years ago
Ieva	52220b2470	AccessControl: frontend changes for adding FGAC to licensing (#39484 ) * refactor licenseURL function to use context and export permission evaluation fction * remove provisioning file * refactor licenseURL to take in a bool to avoid circular dependencies * remove function for appending nav link, as it was only used once and move the function to create admin node * better argument names * create a function for permission checking * extend permission checking when displaying server stats * enable the use of enterprise access control actions when evaluating permissions * import ordering * move licensing FGAC action definitions to models package to allow access from oss * move evaluatePermissions for routes to context serve * change permission evaluator to take in more permissions * move licensing FGAC actions again to appease wire * avoid index out of bounds issue in case no children are passed in when creating server admin node * simplify syntax for permission checking Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> * update loading state for server stats * linting * more linting * fix test * fix a frontend test * update "licensing.reports:read" action naming * UI doesn't allow reading only licensing reports and not the rest of licensing info Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>	4 years ago
Eric Leijonmarck	f384288183	AccessControl: Add displayname field to Role (#39904 ) * feat: add displayname * refactor: marshal role for fallback displayname * refactor: moved to private heuristic function for displaynames * refactor: display name trimspace and remove prefix * refactor: renaming of fallbackFunction * refactor: moved methods below struct types	4 years ago

1 2

69 Commits (09f40688497f3433d96dbb2dcc2b46d8b5d0b6ac)