554 Commits (0d9d392834c9121384828d15c7d528b08ac926aa)

Author	SHA1	Message	Date
Alexander Zobnin	e0ca1e5b1c	[release-11.6.3] RBAC: Dont additionally cache all users permissions (#106146) ... RBAC: Don't additionally cache all users permissions (#105607) * RBAC: Don't additionally cache all users permissions * remove unused tests (cherry picked from commit cfba630f5c)	2 months ago
Matheus Macabu	b110754c9a	Hackaton: Add more unit tests, take 2 (#101473) ... * login/social/socialimpl: add assertions for usage stats, support bundle and oauthinfo methods * accesscontrol/acimpl: add tests for GetRoleByName * anonymous/sortopts: add tests for Sorter * cloudmigration/gmsclient: add basic test cases for all methods * shorturls/shorturlimpl: add more edge test cases * tag/tagimpl: add test to cover duplicate tag kv and nil pairs * updatechecker: add test cases for module	5 months ago
Sven Grossmann	b5faf5d9a1	Drilldown: Require `datasources:explore` RBAC action (#101366) ... Drilldown: Require `datasources:explore` acton	5 months ago
Karl Persson	fa74d1c36d	Authn: Sync authlib and update how we construct authn client interceptor (#101124) ... * Sync authlib and update how we construct authn client interceptor * Remove namespace from checker	5 months ago
Gabriel MABILLE	f3433fd472	RBAC: Remove accessControlOnCall feature toggle (#101222) ... * RBAC: Remove accessControlOnCall feature toggle * Leave the other one in place * Tests * frontend * Readd empty ft to frontend test * Remove legacy RBAC check * Fix test * no need for context * Remove unused variable * Remove unecessary param * remove unecessary param from tests * More tests :D	5 months ago
Gabriel MABILLE	0290da6aaa	AccessControl: Allow plugin roles to include `plugins:write` (#101089)	5 months ago
Andre Pereira	e54149e551	Explore: Move drilldown apps from Explore to a new navbar item "Drilldown" (#100409) ... * Move drilldown apps from Explore to a new navbar item "Drilldown" * Commit make i18n-extract * Update drilldown icon * Added alert to explore with call out to drilldown apps * Add isNew field for nav item which shows a "New!" badge on the navbar and expands it by default * Fix e2e test	5 months ago
Ryan McKinley	5a40c84568	DualWriter: Support managed DualWriter (#100881)	5 months ago
Alexander Zobnin	fcb88f6ccc	Zanzana: revert cluster store for fixed roles (#100958) ... * Zanzana: revert cluster store for fixed roles * update go workspace	5 months ago
Stephanie Hingtgen	3e6f40c873	K8s: Move to one feature toggle for folders and dashboards (#100911)	5 months ago
Stephanie Hingtgen	67be9aeed6	K8s: Search fallback: Support all sort by methods (#100776)	5 months ago
Peter Štibraný	1856d47e47	Remove GetResourceClient hack from unified package. (#100636) ... * Remove GetResourceClient hack from unified package.	5 months ago
Alexander Zobnin	5118e82e8c	Zanzana: Run reconciliation in its own service (#100361) ... * Zanzana: Start reconciliation in its own service * cleanup * update go workspaces * refactor * remove unused code * move func definition	5 months ago
Karl Persson	39d94eabcd	Auth: Fix function name (#100122) ... Fix spelling	5 months ago
Stephanie Hingtgen	8ac9c47222	Folders: Validator: add temporary fix (#100019)	6 months ago
Karl Persson	c85a175212	RBAC: only query folder service when fetching parent folders (#99893) ... * only query folder service when fetching parent folders * Perform validation and inehrited scopes solvers as service instead of caller	6 months ago
Arati R.	a2097fbc2f	Folders: Add user service to folder service implementation (#99518) ... Add user service to folder service implementation	6 months ago
Misi	437b7a565d	Auth: Add access token to in-proc communication and ServiceIdentity (#98926) ... Use fake access token for in-proc grpc and add ServiceIdentity --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Karl Persson <23356117+kalleep@users.noreply.github.com>	6 months ago
Ezequiel Victorero	3a94057ec8	PublicDashboards: Delete on folder deletion (#99040)	6 months ago
Todd Treece	2622449718	Dashboards: Use dashboard service in access control (#99053)	6 months ago
Ryan McKinley	680e6bc1f8	Authlib: Use types package rather than claims (#99243)	6 months ago
Karl Persson	7329d2c34b	Authz: Account for fixed roles when running oss and using authz service (#99244) ... * Extract "PermissionStore" from general store interface * Add static and union permission stores * Add GetStaticRoles * Use accesscontrol.Service for inproc to provide static permissions	6 months ago
Alexander Zobnin	cbb688e910	Zanzana: Remove usage from legacy access control (#98883) ... * Zanzana: Remove usage from legacy access control * remove unused * remove zanzana client from services where it's not used * remove unused metrics * fix linter	6 months ago
maicon	766d645d82	Filewalkwithme/unistore refactor folder service to hit folder apiserver (#98409) ... Refactor folder service to use Unified Storage Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com> Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>	6 months ago
Karl Persson	c593b20465	Zanana: Add custom verb for get_permissions and set_permissions. (#98616) ... * Add custom verb for get_permissions and update_permissions. Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	6 months ago
Stephanie Hingtgen	9488bf2915	Dashboards: use service for quotas (#98756)	6 months ago
Karl Persson	fb5783691d	Zanzana: Fix reconciliation of fixed roles (#98696) ... Remove "globalReconciler" and reuse the same one but only run them for cluster namespace	6 months ago
Karl Persson	9ed4bf3cd2	Zanzana: Support sub resources (#98201) ... * Create and use common ResourceInfo struct * Add support for formatting group resource with subresource * Add initial support for handling subresource * Add test for checking subresource for generic resource * Bump authlib	6 months ago
Alexander Zobnin	7e5cb7d8d6	Zanzana: Refactor fixed roles (use global store) (#97884) ... * Zanzana: Pass contextual tuples for authorization * global reconciler for fixed roles * inject tuples from global store * fix adding contextual tuples * cleanup * don't error on auth context fail * add todo * add context for List * add caching * remove unused * use constant for global namespace * Rename global namespace to cluster namespace	6 months ago
Arati R.	6957e1f7b7	Folders: Replace sql query with folder service call when collecting folder tree (#98443) ... * Replace sql query with folder service call when collecting folder tree * Update provider for folder service implementation for wire * Refactor provisioning of oss service in folder permissions test util	6 months ago
maicon	d2639f6080	Ensure all internal Services are using FolderService and not FolderStore (#98370) ... * Ensure all internal Services are using FolderService and not FolderStore Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	7 months ago
Jo	40d3b02648	Auth: Separate anonymous settings to its own struct (#97791) ... separate anonymous settings to its own struct	7 months ago
Alexander Zobnin	61d71ec5b1	Zanzana: Handle anonymous users (#97171) ... * add anonymous users to schema * sync anonymous user role * remove unused * fix linter * only add anonymous reconciler if feature is enabled	7 months ago
Karl Persson	718612aabf	Zanzana: Update relation names (#97638) ... * Update relation names to match k8s verbs * Only check namespace if relation is valid * Only list for valid relations	7 months ago
Karl Persson	e4fbae03a1	RBAC: remove dead code (#97234) ... This code is unused and always have been	8 months ago
Ieva	cc0ec349a4	RBAC: Allow passing in user UID when searching for user's permissions (#97125) ... * allow passing in user UID instead of ID when searching for user's permissions * fix tests	8 months ago
Matheus Macabu	f2b96593ea	SQL: close rows to release connection (#97147) ... * SQL: close rows to release connection * dont return err from rows.Close()	8 months ago
Alexander Zobnin	c8caf787d4	Zanzana: handle service accounts (#97123) ... * add service account to the schema * sync managed permissions for service accounts * sync SA basic roles * sync SA roles * Fix endless loop in reconciler while read openfga	8 months ago
Karl Persson	3990637af9	IAM: remove duplicated functions (#96989) ... * Remove duplicated function and use the one provided by claims package	8 months ago
Alexander Zobnin	170e0e1813	Zanzana: List then search implementation (#96705) ... * Zanzana: Search with list * Allow to pass werb into list request * split list search into 2 functions * fix listing resources * remove unused * refactor * remove unused function * Add more logging to reconciler * Fix search for users with access to all resources * fix findFoldersZanzanaList * search for folders as well by default * refactor * use compile for list and search * remove list from client * remove only from client * remove list from interface * run compile once * refactor * refactor * add search tests * fix tests * Fix linter	8 months ago
Karl Persson	e995d4f682	Zanzana: Add setting zanzana reconciliation interval (#96687) ... Add config option under RBAC for zanzana reconciliation interval	8 months ago
Ieva	a60953c8f9	GAS: Show mapped roles in role picker (#96681) ... * add group mapping UID returned mapped roles * request mapped roles from the frontend, but don't attempt to update mapped roles * lock mapped roles and show a pop-up message about why a role is locked * update role selectors to not allow deselecting a mapped role * swagger gen * simplify and set mapped as bool instead of mapping UID array * swagger gen	8 months ago
Karl Persson	7e442efa9c	Zanzana: sync roles and bindings (#96661) ... * Sync fix and custom roles and team bindings. * Add collector for user role bindings	8 months ago
Karl Persson	1f34096fdf	Zanzana: reconcile basic roles and bindings (#96473) ... * Add reconciler for basic roles * Add reconciler for basic role bindings	8 months ago
Karl Persson	db6422c8a3	Zanzana: Use correct namespace when evaluating permission (#96258) ... Use correct namespace	8 months ago
Gabriel MABILLE	cc9cdbe82d	Authz: Move extension proto up a layer (#96254) ... * Authz: Move extension proto up a layer * Lint	8 months ago
Alexander Zobnin	b1fb581ab1	Zanzana: Evaluate access with Check request (server-side) (#96213) ... * Zanzana: Evaluate access with Check request (server-side) * Pass parent folder for checking access * Review suggestions * remove fixme comment	8 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205) ... * Special handling for zanzana reconciliation if stack id is configured * remove sync call	8 months ago
Alexander Zobnin	910ec7e7dc	Zanzana: Use separate store for each org (#96015) ... * Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter	8 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019) ... * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	8 months ago