grafana

Commit Graph

Author	SHA1	Message	Date
Sofia Papagiannaki	8a24e891fe	Nested folders: Fix search query for empty self-contained permissions (#72727 ) * Add tests * Fix query for nested folders with zero self-contained permissions * Fix query behind permissionsFilterRemoveSubquery flag * Apply suggestion from code review	2 years ago
Sofia Papagiannaki	2c26a02b82	Search v1: Remove unnecessary subqueries (#72388 ) * Add feature flag * Introduce interface and dummy implementation * Add tests for the new filter * accessControlDashboardPermissionFilterNoFolderSubquery implementation * join only if it's necessary * force ordering for tests * Temporarily enable new query for benchmarks	2 years ago
Ieva	25c4292a5f	RBAC: search v1 permission filter part 1 - cleanup & updating tests (#71913 ) * update tests and remove some AC disabled checks * remove test for old permission filter builder	2 years ago
Misi	5efc3386d3	AuthZ: Extend /api/search to work with self-contained permissions (#70749 ) * Search sql filter draft, unfinished * Search works for empty roles * Add current AuthModule to SignedInUser * clean up, changes to the search * Use constant prefixes * Change AuthModule to AuthenticatedBy * Add tests for using the permissions from the SignedInUser * Refactor and simplify code * Fix sql generation for pg and mysql * Fixes, clean up * Add test for empty permission list * Fix * Fix any vs all in case of edit permission * Update pkg/services/authn/authn.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/sqlstore/permissions/dashboard_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Fixes, changes based on the review --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Sofia Papagiannaki	988a120d6d	Search v1: Add support for inherited folder permissions if nested folders are enabled (#63275 ) * Add features dependency to SQLBuilder * Add features dependency to AccessControlDashboardPermissionFilter * Add test for folder inheritance * Dashboard permissions: Return recursive query * Recursive query for inherited folders * Modify search builder * Adjust db.SQLBuilder * Pass flag to SQLbuilder if CTEs are supported * Add support for mysql < 8.0 * Add benchmarking for search with nested folders * Set features to AlertStore * Update pkg/infra/db/sqlbuilder.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Set features to LibraryElementService * SQLBuilder tests with nested folder flag set * Apply suggestion from code review Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	2 years ago
Kristin Laemmert	e8b8a9e276	chore: move dashboard_acl models into dashboard service (#62151 )	2 years ago
idafurjes	b573b19ca3	Chore: Remove dashboards from models pkg (#61578 ) * Copy dashboard models to dashboard pkg * Use some models from current pkg instead of models * Adjust api pkg * Adjust pkg services * Fix lint * Chore: Remove dashboards models * Remove dashboards from models pkg * Fix lint in tests * Fix lint in tests 2 * Fix for import in auth * Remove newline * Revert unused fix	2 years ago
Karl Persson	db0be6bc95	RBAC: fix wildcard check (#61666 ) RBAC: break correct loop	2 years ago
Karl Persson	68b43a24e2	RBAC: dashboard permission filter (#60582 ) * PermissionFilter: Handle all search type and only check one action for dashboards * PermissionFilter: Still handle multiple action but take short cut when only one action is required	2 years ago
Karl Persson	7386f8652c	RBAC: Improve performance of dashboard filter query (#56813 ) * RBAC: Move UserRolesFilter to domain package * Dashboard Permissions: Rewrite rbac filter to check access in sql * RBAC: Add break when wildcard is found * RBAC: Add tests for dashboard filter * RBAC: Update tests * RBAC: Cover more test cases Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Karl Persson	2738d1c557	Access Control: Move dashboard actions and create scope provider (#48618 ) * Move dashboard actions and create scope provider	3 years ago
Yuriy Tseretyan	51114527dc	Alerting: handle folder permissions when fine-grained access enabled (#47035 ) * Use alert:create action for folder search with edit permissions. This matches the action that is used to query dashboards (the update will be addressed later) * Update rule store to use FindDashboards instead of folder service to list folders the user has access to view alerts. Folder service does not support query type and additional filters. * Do not check whether the user can save to folder if FGAC is enabled because it is checked on API level.	3 years ago
Karl Persson	a5e4a533fa	Access control: use uid for dashboard and folder scopes (#46807 ) * use uid:s for folder and dashboard permissions * evaluate folder and dashboard permissions based on uids * add dashboard.uid to accept list * Check for exact suffix * Check parent folder on create * update test * drop dashboard:create actions with dashboard scope * fix typo * AccessControl: test id 0 scope conversion * AccessControl: store only parent folder UID * AccessControl: extract general as a constant * FolderServices: Prevent creation of a folder uid'd general * FolderServices: Test folder creation prevention * Update pkg/services/guardian/accesscontrol_guardian.go * FolderServices: fix mock call expect * FolderServices: remove uneeded mocks Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727 ) * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	3 years ago
Yuriy Tseretyan	ea815d640f	Search Service to support search for folders available for alerting (#46483 ) * support new query type "alert-folder" * move action calculation to the constructor of the filter * update filter to support query type `dash-folder-alerting` and empty dashboard actions * require folders:read to access alert rules	3 years ago
Karl Persson	8688073564	Access control: Support filter on several actions (#46524 ) * Add support for several actions when creating a acccess control sql filter	3 years ago
Yuriy Tseretyan	314be36a7c	Move datasource scopes and actions to access control package (#46334 ) * create scope provider * move datasource actions and scopes to datasource package + add provider * change usages to use datasource scopes and update data source name resolver to use provider * move folder permissions to dashboard package and update usages	3 years ago
Karl Persson	1f3f4ebe21	Support permission filter in access control search filter (#46317 )	3 years ago
Karl Persson	4982ca3b1d	Access control: Use access control for dashboard and folder (#44702 ) * Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Selene	bdbd199910	Remove unnecesary joins from queries (#43626 )	3 years ago
Arve Knudsen	5070f7a75b	Chore: Start harmonizing linting with plugin SDK (#25854 ) * Chore: Harmonize linting with plugin SDK Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * Chore: Fix linting issues Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Emil Tullstedt	55c306eb6d	Refactor search (#23550 ) Co-Authored-By: Arve Knudsen <arve.knudsen@grafana.com> Co-Authored-By: Leonard Gram <leonard.gram@grafana.com>	5 years ago

23 Commits (1cc226e689b1e74ae9e87cac87f93155a3af28cb)