grafana

Commit Graph

Author	SHA1	Message	Date
Ieva	602d62ebcc	Access control: FGAC for team sync endpoints (#44673 ) * add actions for team group sync * extend the hook to allow specifying whether the user is external * move user struct to type package * interface for permission service to allow mocking it * reuse existing permissions * test fix * refactor * linting	3 years ago
idafurjes	1b286e6bb5	Remove bus from quota, preferences, plugins, user_token (#44762 ) * Remove bus from quota, preferences, plugins, user_token * Bind sqlstore.Store to sqlstore.SQLStore Fix test * Fix sqlstore wire injection, dependency	3 years ago
Gabriel MABILLE	f81b9c8150	AccessControl: Read team permissions from db (#44727 )	3 years ago
Karl Persson	5ca9d2895b	Add viewer grant to `fixed:datasources:reader` if viewers_can_edit is set to true (#44657 )	3 years ago
Karl Persson	16e62965f5	handle case when scope is wildcard (#44654 )	3 years ago
Karl Persson	e844b263c7	Access control: Load permissions from memory and database (#42080 ) * Load permission from both in memory and from database Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
J Guerreiro	2894f07f05	AccessControl: improve denied message (#44551 ) * AccessControl: improve denied message * AccessControl: tweak permission denied	3 years ago
J Guerreiro	153b231521	AccessControl: Refine interface for AC store (#44536 ) * AccessControl: Refine interface for AC store * Update pkg/services/accesscontrol/database/resource_permissions.go	3 years ago
J Guerreiro	cb6e5ae8ce	AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add tests for AC guards in update/delete * AccessControl: add fixed role for team writer * AccessControl: ensure team related AC is deleted with team * Update pkg/api/team_test.go	3 years ago
Karl Persson	bf63ccbe00	Access control: Rewrite access control SQL filter (#44488 ) * Rewrite access control sql filter	3 years ago
Ryan McKinley	5d66194ec5	FeatureFlags: define features outside settings.Cfg (take 3) (#44443 )	3 years ago
Gabriel MABILLE	d4f682190f	AccessControl: Implement teams resource service (#43951 ) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * moving resourceservice to the main wire file pt2 * move team related actions so that they can be reused * PR feedback * fix * typo * Access Control: adding hooks for team member endpoints (#43991) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * add access control to list and add team member endpoint, and hooks for adding team members * member permission type is 0 * add ID scope for team permission checks * add more team actions, use Member for member permission name * protect team member update endpoint with FGAC permissions * update SQL functions for teams and the corresponding tests * also protect team member removal endpoint with FGAC permissions and add a hook to permission service * a few small fixes, provide team permission service to test setup * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * remove resource services from wireexts * remove unneeded actions * linting fix * remove comments * feedback fixes * feedback * simplifying * remove team member within the same transaction * fix a mistake with the error * call the correct sql fction * linting * Access control: tests for team member endpoints (#44177) * tests for team member endpoints * clean up and fix the tests * fixing tests take 2 * don't import enterprise test license * don't import enterprise test license * remove unused variable Co-authored-by: gamab <gabi.mabs@gmail.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Katarina Yang	92ca38bedf	Refactor: Change sqlstore.inTransaction to SQLStore.WithTransactionalDBSession in misc files (#43926 ) * Refactor: Change sqlstore.inTransaction to SQLStore.WithTransactionalDBSession in misc files * Refactor: Change .inTransaction in org.go file * Refactor: Update init() to proper SQLStore handlers * Refactor: Update funcs in tests to be sqlStore methods * Refactor: Update API funcs to receive HTTPServer * Fix: define methods on sqlstore * Adjust GetSignedInUser calls * Refactor: Add sqlStore to Service struct * Chore: Add back black spaces to remove file from PR Co-authored-by: Ida Furjesova <ida.furjesova@grafana.com>	3 years ago
Karl Persson	de2c5783fa	Access Control: Pass db session to hooks (#44428 ) * Move hook calls to database and pass session	3 years ago
Agnès Toulet	65bdb3a899	FeatureFlags: Revert managing feature flags outside of settings.Cfg (#44382 ) * Revert "FeatureToggles: register all enterprise feature toggles (#44336)" This reverts commit `f53b3fb007`. * Revert "FeatureFlags: manage feature flags outside of settings.Cfg (#43692)" This reverts commit `f94c0decbd`.	3 years ago
idafurjes	00c389933b	Chore: Remove bus from team (#44218 ) * Remove bus from team * Fix api team test * Remove bus from team members	3 years ago
Ryan McKinley	f94c0decbd	FeatureFlags: manage feature flags outside of settings.Cfg (#43692 )	3 years ago
Gabriel MABILLE	54280fc9d7	AccessControl: Resolve `attribute` based scopes to `id` based scopes (#40742 ) * AccessControl: POC scope attribute resolution Refactor based on ScopeMutators test errors and calls to cache Add comments to tests Rename logger Create keywordMutator only once * AccessControl: Add AttributeScopeResolver registration Co-authored-by: gamab <gabriel.mabille@grafana.com> * AccessControl: Add AttributeScopeResolver to datasources Co-authored-by: gamab <gabriel.mabille@grafana.com> * Test evaluation with translation * fix imports * AccessControl: Test attribute resolver * Fix trailing white space * Make ScopeResolver public for enterprise redefine * Handle wildcard Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
ying-jeanne	7422789ec7	Remove Macaron ParamsInt64 function from code base (#43810 ) * draft commit * change all calls * Compilation errors	3 years ago
Karl Persson	f999910dc6	Access control: Add access control sql filter to org user queries (#43961 ) * Add access control SQL filter to org user queries	3 years ago
Ieva	a06564fb0d	Access control: allow granting a fixed role dynamically based on the startup settings (#43867 ) * allow granting a fixed role dynamically depending on startup config * move role definition for team writing * undo test changes * nicer naming	3 years ago
Ieva	41b709d08d	Access control: permissions for team creation (#43506 ) * FGAC for team creation * tests * fix snapshot for UI tests * linting * update snapshots * Remove unecessary class and update tests Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Make the condition slightly easier Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	3 years ago
Karl Persson	d350ed0f35	Access Control: SQL filter (#43560 ) * Add the accesscontrol sql filter utility Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	3 years ago
Gabriel MABILLE	92c568e9f7	AccessControl: Remove unused error from `GetResourcesMetadata` (#43710 ) * AccessControl: Remove unused error from GetResourcesMetadata Co-authored-by: J Guerreiro <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	2425828a0b	quote reserved keyword (#43652 )	3 years ago
Karl Persson	ee690a7bb0	Add org_id in join (#43648 )	3 years ago
J Guerreiro	a0cf57b5b8	AccessControl: Reduce tone of access error (#43601 )	3 years ago
Karl Persson	0ace9695a6	Access control: Add optional hooks (#43372 ) * Add optional OnSet hooks	3 years ago
Karl Persson	2409d8dc1f	check the value of the feature toggle (#43433 )	3 years ago
Karl Persson	b3d5a607d4	Access Control: Add option to filter only managed permissions (#43371 ) * Add option to filter only managed permissions	3 years ago
idafurjes	ff3cf94b56	Chore: Remove context.TODO() from services (#42555 ) * Remove context.TODO() from services * Fix live test	3 years ago
Karl Persson	c3ca2d214d	Access control: Refactor managed permission system to create api and frontend components (#42540 ) * Refactor resource permissions * Add frondend components for resource permissions Co-authored-by: kay delaney <45561153+kaydelaney@users.noreply.github.com> Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Gabriel MABILLE	c7cabdfd6f	AccessControl: Add accesscontrol metadata to datasources DTOs (#42675 ) * AccessControl: Provide scope to frontend * Covering datasources with accesscontrol metadata * Write benchmark tests for GetResourcesMetadata * Add accesscontrol util and interface * Add the hasPermissionInMetadata function in the frontend access control code * Use IsDisabled rather that performing a feature toggle check Co-authored-by: Karl Persson <kalle.persson@grafana.com>	4 years ago
Karl Persson	9558c09a7c	Access Control: Store permissions on SignedInUser (#43040 ) * add permission structure to signedinuser * add middleware to load user permissions into signedinuser struct * apply LoadPermissionsMiddleware to http server * check for permissions in signedinuser struct Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Alexander Zobnin	da2c99a2e1	Access control: use delegatable flag to check if role can be granted (#42070 ) * Access control: use delegatable flag to check if role can be granted or not * Fix naming	4 years ago
Gabriel MABILLE	0ee0a0b7a0	AccessControl: FGAC permissions for orgs endpoint on frontend (#41050 ) * AccessControl: FGAC permissions for orgs endpoint on frontend Protect org update endpoints add or refactor missing right messages cover org page * removing scopes from orgs * Perform permission control with global org * Perform the error handling in case of 403 * Simplify frontend code by requiring read access for sure * Remove roles I added to decrease the number of changes * Remove the check for server admin to reduce the number of changes * change error message * Cleaning todos * Remove unecessary changes * Fix tests * Update test snapshot * Update pkg/api/roles.go Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Format AdminEditOrgPage for linting * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Vardan Torosyan <vardants@gmail.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Update public/app/features/admin/AdminListOrgsPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Commit suggestions * Commit suggestion canRead canWrite * fix typo Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	4 years ago
Ieva	b7f47561b6	Access control: add roles to fixed groups (#41673 ) * add roles to fixed groups * add global to group name	4 years ago
Karl Persson	d623285fcc	Access Control: Rename fixed roles (#41288 ) * Rename fixed roles * Update descriptions * Update docs for fixed roles and permissions Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>	4 years ago
Gabriel MABILLE	818b8739c0	AccessControl: Remove scopes from orgs endpoints (#41709 ) * AccessControl: Check permissions in target org * Remove org scopes and add an authorizeInOrg middleware * Use query result org id and perform users permission check globally for GetOrgByName * Remove scope translation for orgs current * Suggestion from Ieva	4 years ago
Ieva	dcae138379	Access Control: adding group field to roles (#41465 ) * add group field to roles in AC models * change to using group_name as the column name * add a migration for group column	4 years ago
Karl Persson	3c659f1ea0	Access Control: Move part of access control database (#40483 ) * Add accesscontrol migrations * Add ResourceStore interface and related structs * Add team/user/builtin-role * Add accesscontrol database with functions to handle managed roles and permissions * Add ResourceManager * Add GetUserPermissions * Update pkg/services/accesscontrol/accesscontrol.go Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Jeremy Price	69c5370e94	Accesscontrol: Add additional API keys to service account, move cloneserviceaccount to sqlstore (#41189 ) * Add additional api key, move cloneserviceaccount * Remove TODOs, for now * Error messages * Linter * Security check * Add comments * Take service account id from correct variable * Update user.go	4 years ago
ying-jeanne	54de1078c8	remove the global log error/warn etc functions (#41404 ) * remove the global log error/warn etc functions and use request context logger whenever possible	4 years ago
Emil Tullstedt	3b637f4b44	Access control: Redirect non-API calls (#41100 )	4 years ago
idafurjes	9340430723	Chore: Add alert ctx (#41161 ) * Add context for alert * Remove context.TODO * Remove xorm * Remove context.TODO * Fix UsageStatsQuerier interface	4 years ago
ying-jeanne	681218275e	remove crit and trace (#40320 )	4 years ago
Gabriel MABILLE	6a3ce8bd38	AccessControl: tidy scope resolution (#40677 ) * AccessControl: tidy scope resolution	4 years ago
Jeremy Price	6dbb6408d4	Access Control: Add service accounts (#38994 ) * Add extra fields to OSS types to support enterprise * Create a service account at the same time as the API key * Use service account credentials when accessing API with APIkey * Add GetRole to service, merge RoleDTO and Role structs This patch merges the identical OSS and Enterprise data structures, which improves the code for two reasons: 1. Makes switching between OSS and Enterprise easier 2. Reduces the chance of incompatibilities developing between the same functions in OSS and Enterprise * If API key is not linked to a service account, continue login as usual * Fallback to old auth if no service account linked to key * Add CloneUserToServiceAccount * Adding LinkAPIKeyToServiceAccount * Handle api key link error * Better error messages for OSS accesscontrol * Set an invalid user id as default * Re-arrange field names * ServiceAccountId is integer * Better error messages Co-authored-by: Hugo Häggmark <hugo.haggmark@grafana.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
Gabriel MABILLE	fbc6febb0e	AccessControl: keyword scope resolution (#40229 )	4 years ago
Eric Leijonmarck	b88cd08177	feat: fallback for displayname of non-fixed role without displayname (#40277 )	4 years ago

1 2

95 Commits (1680e284e5cc3f7e0a7ff747cbc007f966fce830)