127 Commits (0d9d392834c9121384828d15c7d528b08ac926aa)

Author	SHA1	Message	Date
Sven Grossmann	b5faf5d9a1	Drilldown: Require `datasources:explore` RBAC action (#101366) ... Drilldown: Require `datasources:explore` acton	5 months ago
Andre Pereira	e54149e551	Explore: Move drilldown apps from Explore to a new navbar item "Drilldown" (#100409) ... * Move drilldown apps from Explore to a new navbar item "Drilldown" * Commit make i18n-extract * Update drilldown icon * Added alert to explore with call out to drilldown apps * Add isNew field for nav item which shows a "New!" badge on the navbar and expands it by default * Fix e2e test	5 months ago
Ieva	a60953c8f9	GAS: Show mapped roles in role picker (#96681) ... * add group mapping UID returned mapped roles * request mapped roles from the frontend, but don't attempt to update mapped roles * lock mapped roles and show a pop-up message about why a role is locked * update role selectors to not allow deselecting a mapped role * swagger gen * simplify and set mapped as bool instead of mapping UID array * swagger gen	8 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019) ... * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	8 months ago
Jo	9f43724b57	AccessControl: Use UIDs for Resource permissions frontend (#95552) ... * frontend can use uids to set resource permissions * lint * add uids to folder acl * Update public/app/core/components/Select/UserPicker.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * simplify conditions --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	9 months ago
Yuri Tseretyan	2deced7d40	Alerting: Notifications Routes API (#91550) ... * Introduce new models RoutingTree, RouteDefaults and Route and api-server to serve them that is backed by provisioning notification policy service. * update method UpdatePolicyTree of notification policy service to return route and new version * declare new actions alert.notifications.routes:read and alert.notifications.routes:write and two corresponding fixed roles. --------- Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	9 months ago
Alexander Zobnin	e642e1a804	Zanzana: Pass parent folder for the checks in search queries (#94541) ... * Pass parent folder as a contextual tuple in Check request * Search by listing folders and dashboards * skip dashboards listing if limit reached * remove unused * add some comments * only add ContextualTuples if parent provided * Remove parent relation for dashboards from schema and perform separate checks	9 months ago
Ieva	d7aca7d0fe	Role mapping: Add `group_mapping_uid` column to `user_role` table (#93810) ... * add group_mapping_uid column to user_role table * add group mapping UID to user role struct	10 months ago
Yuri Tseretyan	27c7e33217	Alerting: Update permissions to reciever and template test API (#94282) ... * add action "alert.notifications.receivers:test" to receiver creator * update API permissions to accept new granular actions	10 months ago
Alexander Zobnin	5d724c2482	Zanzana: Initial dashboard search (#93093) ... * Zanzana: Search in a background and compare results * refactor * Search with check * instrument zanzana client * add single_read option * refactor * refactor move check into separate function * Fix tests * refactor * refactor getFindDashboardsFn * add resource type to span attributes * run ListObjects concurrently * Use list and search in less cases * adjust metrics buckets * refactor: move Check and ListObjects to AccessControl implementation * Revert "Fix tests" This reverts commit b0c2f072a2. * refactor: use own types for Check and ListObjects inside accesscontrol package * Fix search scenario with low limit and empty query string * more accurate search with checks * revert * fix linter * Revert "revert" This reverts commit ee5f14eea8. * add search errors metric * fix query performance under some conditions * simplify check strategy * fix pagination * refactor findDashboardsZanzanaList * Iterate over multiple pages while making check request * refactor listUserResources * avoid unnecessary db call * remove unused zclient * Add notes for SkipAccessControlFilter * use more accurate check loop * always use check for search with provided UIDs * rename single_read to zanzana_only_evaluation * refactor * update go workspace * fix linter * don't use deprecated fields * refactor * fail if no org specified * refactor * initial integration tests * Fix tests * fix linter errors * fix linter * Fix tests * review suggestions Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix limit * refactor * refactor tests * fix db config in tests * fix migrator (postgres) --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	10 months ago
Yuri Tseretyan	10582e48f7	Alerting: Notifications Templates API (#91349)	10 months ago
Matthew Jacobson	1ede1e32b8	Alerting: Receiver resource permissions service (#93552)	10 months ago
linoman	a0c886922e	Auth: Add LDAP scope to Grafana Admin (#92990) ... Add LDAP scope to Grafana Admin	11 months ago
Matthew Jacobson	32f06c6d9c	Alerting: Receiver API complete core implementation (#91738) ... * Replace global authz abstraction with one compatible with uid scope * Replace GettableApiReceiver with models.Receiver in receiver_svc * GrafanaIntegrationConfig -> models.Integration * Implement Create/Update methods * Add optimistic concurrency to receiver API * Add scope to ReceiversRead & ReceiversReadSecrets migrates existing permissions to include implicit global scope * Add receiver create, update, delete actions * Check if receiver is used by rules before delete * On receiver name change update in routes and notification settings * Improve errors * Linting * Include read permissions are requirements for create/update/delete * Alias ngalert/models to ngmodels to differentiate from v0alpha1 model * Ensure integration UIDs are valid, unique, and generated if empty * Validate integration settings on create/update * Leverage UidToName to GetReceiver instead of GetReceivers * Remove some unnecessary uses of simplejson * alerting.notifications.receiver -> alerting.notifications.receivers * validator -> provenanceValidator * Only validate the modified receiver stops existing invalid receivers from preventing modification of a valid receiver. * Improve error in Integration.Encrypt * Remove scope from alert.notifications.receivers:create * Add todos for receiver renaming * Use receiverAC precondition checks in k8s api * Linting * Optional optimistic concurrency for delete * make update-workspace * More specific auth checks in k8s authorize.go * Add debug log when delete optimistic concurrency is skipped * Improve error message on authorizer.DecisionDeny * Keep error for non-forbidden errutil errors	11 months ago
Dave Henderson	df3d8915ba	Chore: Bump Go to 1.23.0 (#92105) ... * chore: Bump Go to 1.23.0 Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * update swagger files Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * chore: update .bingo/README.md formatting to satisfy prettier Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * chore(lint): Fix new lint errors found by golangci-lint 1.60.1 and Go 1.23 Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * keep golden file * update openapi * add name to expected output * chore(lint): rearrange imports to a sensible order Signed-off-by: Dave Henderson <dave.henderson@grafana.com> --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Ryan McKinley <ryantxu@gmail.com>	11 months ago
Alexander Zobnin	0e5d7633f7	Access Control: Make it possible to exclude role grants (#91647)	12 months ago
Alexander Zobnin	87d86e81ce	Zanzana: Evaluate permissions alongside with RBAC engine (#90064) ... * Zanzana: Evaluate permissions if feature flag enabled * Fix tests * adjust logs * fix spelling * remove unused * only evaluate implemented resources * refactor	1 year ago
Yuri Tseretyan	b075926202	Alerting: Time Intervals API (#88201) ... * expose ngalert API to public * add delete action to time-intervals * introduce time-interval model generated by app-platform-sdk from CUE model the fields of the model are chosen to be compatible with the current model * implement api server * add feature flag alertingApiServer ---- Test Infra * update helper to support creating custom users with enterprise permissions * add generator for Interval model	1 year ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	1 year ago
Aaron Godin	59a6a6513f	Prevent moving a k6 folder (#88884) ... * iam-716 - prevent a folder move operation when the folder's uid or any of its parents uids begin with k6-app * fox folder move check and only list non-k6 folders to users * adding tests for moving * add a test for listing folders * fix the other tests * use method that adds folder parent --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	1 year ago
Yuri Tseretyan	356a29592b	Alerting: Add two sets of provisioning actions for rules and notifications (#87149)	1 year ago
Yuri Tseretyan	509691b416	Alerting: Introduce authorization logic for operations on silences (#85418) ... * extract genericService from RuleService just to reuse it later * implement silence service --------- Co-authored-by: William Wernert <william.wernert@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	1 year ago
Karl Persson	504870f10a	Auth: Decouple client and hook registration (#85084)	1 year ago
Yuri Tseretyan	48de8657c9	Alerting: Editor role can access all provisioning API (#85022)	1 year ago
Ieva	7aa0ba8c59	Teams: Display teams page to team reader if they also have the access to list team permissions (#84650) ... * display teams to team reader if they also have the access to list team permissions * fix a typo in the docs	1 year ago
Alexander Zobnin	fd9031ca37	Access Control: Get org from request data for authorization (#84359) ... * Access Control: Get org from request data for authorization * move type to models * Update pkg/services/accesscontrol/middleware.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * refactor * refactor * Fix linter --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 year ago
Gabriel MABILLE	80d6bf6da0	AuthN: Remove embedded oauth server (#83146) ... * AuthN: Remove embedded oauth server * Restore main * go mod tidy * Fix problem * Remove permission intersection * Fix test and lint * Fix TestData test * Revert to origin/main * Update go.mod * Update go.mod * Update go.sum	1 year ago
William Wernert	2ab7d3c725	Alerting: Receivers API (read only endpoints) (#81751) ... * Add single receiver method * Add receiver permissions * Add single/multi GET endpoints for receivers * Remove stable tag from time intervals See end of PR description here: https://github.com/grafana/grafana/pull/81672	1 year ago
Yuri Tseretyan	d1073deefd	Alerting: Time intervals API (read only endpoints) (#81672) ... * declare new API and models GettableTimeIntervals, PostableTimeIntervals * add new actions alert.notifications.time-intervals:read and alert.notifications.time-intervals:write. * update existing alerting roles with the read action. Add to all alerting roles. * add integration tests	1 year ago
Gabriel MABILLE	3df0611f81	RBAC: Fix authorize in org (#81552) ... * RBAC: Fix authorize in org * Implement option 2 * Fix typo * Fix alerting test * Add test to cover the not member case	1 year ago
Alexander Zobnin	08082104e1	Access control: Add permissions cache hit/miss metrics (#80883) ... * Access control: Add permissions cache hit/miss metrics * Add metrics to OSS * Fix imports	2 years ago
Julien Duchesne	b232c64d9a	`accesscontrol` swagger: Add `global` field to `RoleDTO` type (#79351) ... * `accesscontrol` swagger: Add `global` field to `RoleDTO` type The field is currently added in the MarshalJSON function so it isn't reflected in the spec This PR sets the "static" version of the RoleDTO, that has the global field, as the swagger model * Revert the marshalling logic	2 years ago
Gabriel MABILLE	72d32eed27	ExtSvcAuth: Assign roles locally (#78669) ... * ExtSvcAuth: Assign roles locally * Fix test * HandlePluginStateChanged in the OrgID * Remove Global from command * Use AssignmentOrgID instead of OrgID * Remove unecessary test case	2 years ago
Misi	7ae0ff1309	RBAC: Add OAuth provider scopes separately to fixed:authentication.config:writer (#78202) ... Add OAuth provider setting scopes to fixed:authentication writer * Change SSO Settings api scopes * Remove unused RBAC Action	2 years ago
Karl Persson	ae5e03034b	RBAC: generated prefixed uids for external service role (#76601) ... * Replace FixedRoleUID function with a common function to generate these prefixes * Use common function to generate prefixed uid for external service accounts Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com> --------- Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com>	2 years ago
kay delaney	a12cb8cbf3	LibraryPanels: Add RBAC support (#73475)	2 years ago
Gabriel MABILLE	9dd38de5c1	RBAC: Make fixed role UIDs deterministic (#76239) ... * Add fixed role UID Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Use base64 url encoding --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com>	2 years ago
Jo	4474f19836	Service Accounts: Enable adding folder, dashboard and data source permissions to service accounts (#76133) ... * Add SAs to Datasource permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * add SAs to dashboards/folders managed permissions * Update public/app/core/components/AccessControl/Permissions.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * regenerate i18n * add doc --------- Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	2 years ago
linoman	c4bc90ff5b	Chore: Add const variables for No Basic Role (#74868) ... * Add const variables for No Basic Role	2 years ago
Marcus Efraimsson	040b7d2571	Chore: Add errutils helpers (#73577) ... Add helpers for the errutil package in favor of errutil.NewBase.	2 years ago
Michael Mandrus	779e0fe311	Feature Toggles: Create API for updating feature toggle state from the feature toggle admin page (#73022) ... * create roles for writing feature toggles * create update endpoint / handler * api changes * add feature toggle validations * hide toggles based on their state * make FlagFeatureToggle read only * add username log * add username string * refactor for better readability * refactor unit tests so we can do more validations * some skeletoning for the set tests * write unit tests for updater * break helper functions out * update sample ini to match defaults * add more logic to ReadOnly label * add user documentation * fix lint issue * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: J Stickler <julie.stickler@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: J Stickler <julie.stickler@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: J Stickler <julie.stickler@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: J Stickler <julie.stickler@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: J Stickler <julie.stickler@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: J Stickler <julie.stickler@grafana.com> --------- Co-authored-by: IbrahimCSAE <ibrahim.mdev@gmail.com> Co-authored-by: J Stickler <julie.stickler@grafana.com>	2 years ago
Yuri Tseretyan	6b4a9d73d7	Alerting: Export contact points to check access control action instead legacy role (#71990) ... * introduce a new action "alert.provisioning.secrets:read" and role "fixed:alerting.provisioning.secrets:reader" * update alerting API authorization layer to let the user read provisioning with the new action * let new action use decrypt flag * add action and role to docs	2 years ago
João Calisto	4ba83173ea	Feature toggles management: Define get feature toggles api (#72106) ... * Feature Toggle Management: Define get feature toggles api * lint	2 years ago
Ieva	cfa1a2c55f	RBAC: Split non-empty scopes into `kind`, `attribute` and `identifier` fields for better search performance (#71933) ... * add a feature toggle * add the fields for attribute, kind and identifier to permission Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * set the new fields when new permissions are stored * add migrations Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * remove comments * Update pkg/services/accesscontrol/migrator/migrator.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * feedback: put column migrations behind the feature toggle, added an index, changed how wildcard scopes are split * PR feedback: add a comment and revert an accidentally changed file * PR feedback: handle the case with : in resource identifier * switch from checking feature toggle through cfg to checking it through featuremgmt * don't put the column migrations behind a feature toggle after all - this breaks permission queries from db --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Gabriel MABILLE	edf1775d49	AuthN: Embed an OAuth2 server for external service authentication (#68086) ... * Moving POC files from #64283 to a new branch Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Adding missing permission definition Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Force the service instantiation while client isn't merged Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Merge conf with main Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Leave go-sqlite3 version unchanged Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * tidy Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * User SearchUserPermissions instead of SearchUsersPermissions * Replace DummyKeyService with signingkeys.Service * Use user🆔<id> as subject * Fix introspection endpoint issue * Add X-Grafana-Org-Id to get_resources.bash script * Regenerate toggles_gen.go * Fix basic.go * Add GetExternalService tests * Add GetPublicKeyScopes tests * Add GetScopesOnUser tests * Add GetScopes tests * Add ParsePublicKeyPem tests * Add database test for GetByName * re-add comments * client tests added * Add GetExternalServicePublicKey tests * Add other test case to GetExternalServicePublicKey * client_credentials grant test * Add test to jwtbearer grant * Test Comments * Add handleKeyOptions tests * Add RSA key generation test * Add ECDSA by default to EmbeddedSigningKeysService * Clean up org id scope and audiences * Add audiences to the DB * Fix check on Audience * Fix double import * Add AC Store mock and align oauthserver tests * Fix test after rebase * Adding missing store function to mock * Fix double import * Add CODEOWNER * Fix some linting errors * errors don't need type assertion * Typo codeowners * use mockery for oauthserver store * Add feature toggle check * Fix db tests to handle the feature flag * Adding call to DeleteExternalServiceRole * Fix flaky test * Re-organize routes comments and plan futur work * Add client_id check to Extended JWT client * Clean up * Fix * Remove background service registry instantiation of the OAuth server * Comment cleanup * Remove unused client function * Update go.mod to use the latest ory/fosite commit * Remove oauth2_server related configs from defaults.ini * Add audiences to DTO * Fix flaky test * Remove registration endpoint and demo scripts. Document code * Rename packages * Remove the OAuthService vs OAuthServer confusion * fix incorrect import ext_jwt_test * Comments and order * Comment basic auth * Remove unecessary todo * Clean api * Moving ParsePublicKeyPem to utils * re ordering functions in service.go * Fix comment * comment on the redirect uri * Add RBAC actions, not only scopes * Fix tests * re-import featuremgmt in migrations * Fix wire * Fix scopes in test * Fix flaky test * Remove todo, the intersection should always return the minimal set * Remove unecessary check from intersection code * Allow env overrides on settings * remove the term app name * Remove app keyword for client instead and use Name instead of ExternalServiceName * LogID remove ExternalService ref * Use Name instead of ExternalServiceName * Imports order * Inline * Using ExternalService and ExternalServiceDTO * Remove xorm tags * comment * Rename client files * client -> external service * comments * Move test to correct package * slimmer test * cachedUser -> cachedExternalService * Fix aggregate store test * PluginAuthSession -> AuthSession * Revert the nil cehcks * Remove unecessary extra * Removing custom session * fix typo in test * Use constants for tests * Simplify HandleToken tests * Refactor the HandleTokenRequest test * test message * Review test * Prevent flacky test on client as well * go imports * Revert changes from 526e48ad45 * AuthN: Change the External Service registration form (#68649) * AuthN: change the External Service registration form * Gen default permissions * Change demo script registration form * Remove unecessary comment * Nit. * Reduce cyclomatic complexity * Remove demo_scripts * Handle case with no service account * Comments * Group key gen * Nit. * Check the SaveExternalService test * Rename cachedUser to cachedClient in test * One more test case to database test * Comments * Remove last org scope Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Update pkg/services/oauthserver/utils/utils_test.go * Update pkg/services/sqlstore/migrations/oauthserver/migrations.go Remove comment * Update pkg/setting/setting.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> --------- Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>	2 years ago
Gabriel MABILLE	3ffff632be	RBAC: Refine validation of external services permissions (#68633) ... * RBAC: Refine validation of external services permissions * Forgot to log the ext-id	2 years ago
Gabriel MABILLE	8c6b5a4319	RBAC: Add a function to save external service roles (#66299) ... * AuthN: Save external services RBAC roles * Add missing test * Placing roles in the same group * Split function to gen role and assignment * add test case and comments * Ensure we check external service roles are assigned once only * Update pkg/services/accesscontrol/models_test.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> --------- Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	2 years ago
Ieva	533f8caafd	SAML: change the config option for making SAML UI accessible to org Admins (#67399) ... * change from role grant overrides to SAML UI specific config option * update permissions needed to access SAML UI * PR feedback: change config name, change required perms to write, add a comment	2 years ago
Gabriel MABILLE	3b63844390	RBAC: Feature to override default assignments (#66561) ... * RBAC: Feature to override default assignments Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * Add test and trim spaces * Pass linting * Apply the rbac overrides to fixed_authentication.config_writer * Removing from the default ini file for now * Add grants overrides section to cfg * slimmer handleGrantOverrides function --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com>	2 years ago
Alexander Zobnin	7476219b0c	SAML: Configuration UI (#64054) ... * Add initial authentication config page skeleton * Add initial SAML config page WIP * Add few more pages * Add connect to IdP page * Assertion mappings page stub and url params * Able to save settings * Some tweaks for authentication page * Tweak behaviour * Tweak provider name * Move SAML config pages to enterprise * minor refactor * Able to reset settings * Configure key and cert from UI * Refactor WIP * Tweak styles * Optional save button * Some tweaks for the page * Don't show info popup when save settings * Improve key/cert validation * Fetch provider status and display on auth page * Add settings list to the auth page * Show call to action card if no auth configured * clean up * Show authentication page only if SAML available * Add access control for SSO config page * Add feature toggle for auth config UI * Add code owners for auth config page * Auth config UI disabled by default * Fix feature toggle check * Apply suggestions from review * Refactor: use forms for steps * Clean up * Improve authentication page loading * Fix CTA link * Minor tweaks * Fix page route * Fix formatting * Fix generated code formatting	2 years ago