121 Commits (0cce224adb641a3bccec8cee8b38eaf4d0f49327)

Author	SHA1	Message	Date
Jo	9f43724b57	AccessControl: Use UIDs for Resource permissions frontend (#95552) ... * frontend can use uids to set resource permissions * lint * add uids to folder acl * Update public/app/core/components/Select/UserPicker.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * simplify conditions --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	7 months ago
Jo	90d2f4659e	Users: Allow specifying user UIDs in params (#95424) ... * add user ID API translation * add uid to user frontend * use users' UIDs in admin pages * fix ldapSync page * use global user search for user by UID * remove active org filtering * remove orgID params	7 months ago
Jo	2b867d9850	AccessControl: Resource permission translator (#95423) ... * Standardize Resource Translator in options * Add resource UID translator for resource permissions * fix comments * fix comments	7 months ago
Matthew Jacobson	4aad44e848	Alerting: Fix per-receiver RBAC for receivers with long names (#95084) ... * Implement uidToResourceID * add middleware * Move uidToResourceID to alerting package * Only hash uid if it's too long * Use hashed uid in access control * Move ReceiverUidToResourceId to ScopeProvider * resolve uid in middleware only if param exists * Tests * Linting --------- Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>	7 months ago
Jo	acd13e05ef	Teams: Support team UIDs in APIs (#94011) ... * support team UIDs in APIs * unify middleware logic and add team tests * add UID test to resource permissions * remove unused middleware	8 months ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551) ... * Revert "chore: add replDB to team service (#91799)" This reverts commit c6ae2d7999. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit 54177ca619. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit 299c142f6a. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit ac0b4bb34d. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit daedb358dd. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit af19f039b6. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit 27b52b1507. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit 8a6107cd35. * Revert "accesscontrol service read replica (#89963)" This reverts commit 77a4869fca. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit ab5a079bcc. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit d988f5c3b0. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit 50244ed4a1.	8 months ago
Ieva	46e81e98cf	RBAC: Always store action sets (#92833) ... always store action sets, even if FT is disabled	9 months ago
Jeff Levin	372d0acec8	Instrument tracing across dashboards (#91937) ... Add tracing across dashboards and accesscontrol	9 months ago
Jeff Levin	028e8ac59e	Instrument tracing across accesscontrol (#91864) ... Instrument tracing across accesscontrol --------- Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	9 months ago
Kristin Laemmert	c6ae2d7999	chore: add replDB to team service (#91799)	10 months ago
Ieva	6e7bc028d0	RBCA: Better separation between action set svc and store (#91491) ... better separation between action set svc and store	10 months ago
Ieva	2e2ddc5c42	Folders: Allow folder editors and admins to create subfolders without any additional permissions (#91215) ... * separate permissions for root level folder creation and subfolder creation * fix tests * fix tests * fix tests * frontend fix * Update pkg/api/accesscontrol.go Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> * fix frontend when action sets are disabled --------- Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>	10 months ago
Ieva	9bb2cf4968	RBAC: Allow omitting default permissions when a new resource is created (#90720) ... * Cfg: Move rbac settings to own struct * Cfg: Add setting to control if resource should generate managed permissions when created * Dashboards: Check if we should generate default permissions when dashboard is created * Folders: Check if we should generate default permissions when folder is created * Datasource: Check if we should generate default permissions when datasource is created * ServiceAccount: Check if we should generate default permissions when service account is created * Cfg: Add option to specify resources for wich we should default seed * ManagedPermissions: Move providers to their own files * Dashboards: Default seed all possible managed permissions if configured * Folders: Default seed all possible managed permissions if configured * Cfg: Remove service account from list * RBAC: Move utility function * remove managed permission settings from the config file examples, change the setting names * remove ini file changes from the PR * fix setting reading * fix linting errors * fix tests * fix wildcard role seeding --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: jguer <me@jguer.space>	10 months ago
Ieva	4c7d8c8cdd	RBAC: Refactor RBAC plugin interface code (#90679) ... move plugin RBAC registration ifaces to pluginsintegrations	10 months ago
Eric Leijonmarck	248af65f9c	Actionsets: Add ability for plugins to add actions for core actionsets (i.e. `folders:edit`) (#88776) ... * initial commit * Action sets stored remove the dependancy for actionsets got the actionsets registered storing the permissions * fix golanglinting * remove unused struct field * wip * actionset registry for a plugin from the actionsetservice * update to make declareactionset the primary way of plugin registration and modification * declare actually extends actionsets * tests fixed * tests skipped * skip tests * skip tests * skip tests * skip tests * change to warning instead * remove step from pipeline to see if it fails due to plugin not registering * reintroduce step but remove features dependancy * add back the tests that were failing * remove comments and another skip test * fix a comment and remove unneeded changes * fix and clean up, put the behaviour behind a feature toggle * clean up * fixing tests * hard-code allowed action sets for plugins * Apply suggestions from code review Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * small cleanup --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	10 months ago
Alexander Zobnin	87d86e81ce	Zanzana: Evaluate permissions alongside with RBAC engine (#90064) ... * Zanzana: Evaluate permissions if feature flag enabled * Fix tests * adjust logs * fix spelling * remove unused * only evaluate implemented resources * refactor	11 months ago
Jeff Levin	cfe8317d45	Add auth spans and remove deduplication code for scopes (#89804) ... Adds more spans for timing in accesscontrol and remove permission deduplicating code after benchmarking --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	11 months ago
Ieva	4e3294cd8d	RBAC: Fix the check for whether an action set should be added (#89219) ... fox the check for whether an action set should be added	12 months ago
Ieva	bd35fa10f1	RBAC: Resolve action sets when `GetPermissions` is called (#89046) ... * resolve action sets when GetPermissions is called * a fix to ensure that dashboard permissions that override parent folder permissions are displayed on top of the inherited permission * linting * linting pt2	12 months ago
Ieva	1ac395b785	RBAC: Only store action sets for dashboards and folders (#89053) ... * don't store action sets for resources other than dashboards and folders * remove unneeded comment	12 months ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	12 months ago
Ieva	34c40f959f	RBAC: Add and resolve action sets when searching user's permissions (#88694) ... * include and resolve action sets when fetching user's permissions * expand both action and action prefix (returns an empty set for the one that isn't specified) Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * if action is specified, check for exact match; also extend tests	12 months ago
Eric Leijonmarck	910553df20	Actionsets: Add cfg option for only writing actionsets (#88367) ... * test * test * missed test * fix review comments	1 year ago
Ieva	bd2b248f0e	RBAC: Clean up action set code (#88147) ... * remove unused action set code, refactor the existing code * fix import ordering * use a separate interface for permission expansion after all, to avoid circular dependencies * add comments, fix a test	1 year ago
Ieva	3e77768144	RBAC: Expand action sets when fetching permissions (#87967) ... * logic to expand action set to the underlying actions when permissions are fetched from the DB * updates needed for dependency injection * clean up some code, also deduplicate scopes when grouping scopes and actions * expand on a comment * rename a method	1 year ago
Ieva	167151b211	Chore: Remove use of deprecated method in AC code (#87541) ... * switch from using cfg to using featuremgmt for checking a feature toggle in AC code * merge test fixes	1 year ago
Ieva	105313f5c2	RBAC: Adding action set resolver for RBAC evaluation (#86801) ... * add action set resolver * rename variables * some fixes and some tests * more tests * more tests, and put action set storing behind a feature toggle * undo change from cfg to feature mgmt - will cover it in a separate PR due to the amount of test changes * fix dependency cycle, update some tests * add one more test * fix for feature toggle check not being set on test configs * linting fixes * check that action set name can be split nicely * clean up tests by turning GetActionSetNames into a function * undo accidental change * test fix * more test fixes	1 year ago
Ieva	9a824bdf0a	RBAC: Don't set empty action sets (#87398) ... * don't set empty action sets * extend comment	1 year ago
Eric Leijonmarck	6b218b11cf	Actionsets: fix remove printf (#87439) ... fix: remove printf	1 year ago
Eric Leijonmarck	601485c74d	Actionsets: Fix downgrade of permission to add the actionset permission (#87328) ... * check for missingActions empty and add actionset * spelling	1 year ago
Karl Persson	a2cba3d0b5	User: Add tracing (#87028) ... * Inject tracer in tests * Annotate with traces Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
Ieva	cee713e34c	Chore: Add tracing to team service (#86999) ... * add tracing to team service * another test fix * pass in context for team creation and membership checking	1 year ago
Ieva	8028d1c3e1	Chore: Update tests to use team membership hooks (#86846) ... * update tests to use team membership hooks * linting	1 year ago
Serge Zaitsev	522a98c126	Chore: Make Cfg field private in SQLStore (#85593) ... * make cfg private in sqlstore * fix db init in tests * fix case * fix folder test init * fix imports * make another Cfg private * remove another Cfg * remove unused variable * use store cfg, it has side-effects * fix mutated cfg in tests	1 year ago
Eric Leijonmarck	ddabef9895	RBAC: Add actionsets struct and write path (#86108) ... * Add actionsets struct and failing test * update from review * review comments * review comments update * refactor: create interface * actionset service * fix tests * move from wireoss to wire * Apply suggestions from code review remove unnecessary comments Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * nil for the actionsetservice * Revert "nil for the actionsetservice" This reverts commit e3d3cc8171. --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 year ago
Aaron Godin	d409d8e860	IAM - Fix error messages for resource permissions endpoints (#85773) ... * IAM: fix many error messages in access-related code to provide more information * Remove debug statement * Refactor resourcepermissions package to use errutil * Replace a few more errors with errutil and wrap errors found in users and teams services * Apply diff of openAPI spec	1 year ago
Serge Zaitsev	faa1244518	Chore: Replace sqlstore with db interface (#85366) ... * replace sqlstore with db interface in a few packages * remove from stats * remove sqlstore in admin test * remove sqlstore from api plugin tests * fix another createUser * remove sqlstore in publicdashboards * remove sqlstore from orgs * clean up orguser test * more clean up in sso * clean up service accounts * further cleanup * more cleanup in accesscontrol * last cleanup in accesscontrol * clean up teams * more removals * split cfg from db in testenv * few remaining fixes * fix test with bus * pass cfg for testing inside db as an option * set query retries when no opts provided * revert golden test data * rebase and rollback	1 year ago
Jo	cc3b088b6c	Teams: Fix missing context in team service (#83327) ... fix missing context in team service	1 year ago
Karl Persson	1315c67c8b	Team/User: UID migrations (#82298) ... * Add user uid migration to run on every startup to protect against empty values in a upgrade downgrade scenario * Add team uid migration to run on every startup to protect against empty values in a upgrade downgrade scenario * Run team uid migration	1 year ago
Dan Cech	790e1feb93	Chore: Update test database initialization (#81673) ... * streamline initialization of test databases, support on-disk sqlite test db * clean up test databases * introduce testsuite helper * use testsuite everywhere we use a test db * update documentation * improve error handling * disable entity integration test until we can figure out locking error	1 year ago
Jo	7852ea012d	Access: Remove split scopes feature toggle (#81874) ... * remove split scopes FT * Revert "remove split scopes FT" This reverts commit 349fb081d3. * make toggle deprecated instead * fix gen	1 year ago
Ieva	dc9e590b7b	RBAC: Return the underlying error instead of internal server or bad request for managed permission endpoints (#80974) ... * return not found instead of an internal server error when listing/updating permissions * openapi gen	1 year ago
Marcus Efraimsson	6768c6c059	Chore: Remove public vars in setting package (#81018) ... Removes the public variable setting.SecretKey plus some other ones. Introduces some new functions for creating setting.Cfg.	1 year ago
Julien Duchesne	c7f515b9b2	fix(swagger): POST -> GET method for two access control endpoints (#80082) ... Missed those here: https://github.com/grafana/grafana/pull/80053	1 year ago
Julien Duchesne	5e74c19628	fix(swagger): Add new access control endpoints (#80053) ... There were a few errors that prevented these endpoints (which are the most up-to-date ones) from being present in the openapi spec: - The `enterprise` tag excluded the endpoints from being generated - `okRespoonse` typo - Invalid templating on the parameters - Missing parameter structs	1 year ago
Aaron Godin	eb490193b9	[IAM] - Add swagger docs for resource permissions API (#79525) ... * IAM: Apply swagger-go comments for generating docs on resource permissions endpoints * Update pkg/services/accesscontrol/resourcepermissions/api.go Clarifies swagger note on assigning to service accounts Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 year ago
Karl Persson	0f0249abea	RBAC: Fix filter so that check for access on service account is correct (#78907) ... Fix filter so that check for access on service account is in correct place	2 years ago
Karl Persson	1c270b1dc2	RBAC: Adjust filter for acl list to check for permissions on service accounts (#78681) ... Adjust filter to check for permissions on service accounts	2 years ago
Ryan McKinley	f69fd3726b	FeatureToggles: Add context and and an explicit global check (#78081)	2 years ago
Jo	4474f19836	Service Accounts: Enable adding folder, dashboard and data source permissions to service accounts (#76133) ... * Add SAs to Datasource permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * add SAs to dashboards/folders managed permissions * Update public/app/core/components/AccessControl/Permissions.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * regenerate i18n * add doc --------- Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	2 years ago