grafana

Commit Graph

Author	SHA1	Message	Date
Yuriy Tseretyan	896eeb65a9	Alerting: Fix alerting evaluation to use proper permissions (#55127 ) * access control to log user name if it does not have permissions * update ngalert Evaluator to accept user instead of creating a pseudo one * update alerting eval (rule\query testing) API to provide the real user to the Evaluator * update scheduler to create a pseudo user with proper permissions	3 years ago
Karl Persson	d896db6d30	RBAC: Batch permission creation (#55075 )	3 years ago
Karl Persson	d1b9849946	RBAC: Fix background users to include permissions (#55147 ) * RBAC: add function to construct background users * PluginDashboards: Set rbac permissions for user * Dashboards: use background user constructor	3 years ago
Karl Persson	870929b463	RBAC: Add cache for oss rbac permissions (#55098 ) * RBAC: Add cache for oss permissions * RBAC: include service account actions * RBAC: revert changes to fetch service account permissions * Update comment for setting * RBAC: Disable permission chache for tests	3 years ago
Gabriel MABILLE	101349fe49	RBAC: Add permissions to install and configure plugins (#51829 ) * RBAC: Allow app plugins restriction Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * Moving declaration to HttpServer Co-Authored-By: marefr <marcus.efraimsson@gmail.com> * Picking changes from the other branch Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Rename plugins.settings to plugins Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * Account for PluginAdminExternalManageEnabled Co-authored-by: Will Browne <will.browne@grafana.com> * Set metadata on instantiation Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: marefr <marcus.efraimsson@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> Co-authored-by: Will Browne <will.browne@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	bcd7afd1f5	RBAC: Remove service dependency in Evaluator component (#54910 ) * RBAC: Remove service dependency for Evaluator component * RBAC: Add service and load permissions in target org if they are not there * RBAC: Use service if we need to load permissions for org * API: remove service injection into evaluator * API: set new user for each request in tests * PublicDashboards: Use fake service to provide permissions * RBAC: Set org id for dashboard provisioning user	3 years ago
Karl Persson	ff35e35ce0	RBAC: Move service and evaluator to acimpl package (#54714 ) * RBAC: Move access control evaluator to acimpl package * RBAC: Move service to acimpl package	3 years ago
Karl Persson	9d2f5ef62f	RBAC: Add function to generate wildcards from prefix (#54275 ) * RBAC: Move metadata to own file * RBAC: Rename test files * RBAC: Add wildcard structure and helper function to generate wildcards from prefix * RBAC: Refactor filter to use WildcardsFromPrefix * RBAC: Refactor GetResourceMetadata to use WildcardsFromPrefix	3 years ago
Karl Persson	5a1b9d2283	RBAC: Remove DeclareFixedRoles wrapper on Access control and inject service (#54153 ) * RBAC: Remove DeclareFixedRoles wrapper on Access control and inject service when needed	3 years ago
Karl Persson	552d3fec8d	RBAC: Fix resolver issue on wildcard resulting in wrong status code for endpoints (#54208 ) * RBAC: Test evaluation before attaching mutator * RBAC: Return error if no resolver is found for scope * RBAC: Sync changes to evaluation in mock * RBAC: Check for resolver not found error and just fail the evaluation in that case	3 years ago
Karl Persson	55c7b8add2	RBAC: Split up service into several components (#54002 ) * RBAC: Rename interface to Store * RBAC: Move ranme scopeInjector * RBAC: Rename files to service * RBAC: Rename to service * RBAC: Split up accesscontrol into two components * RBAC: Add DeclareFixedRoles to AccessControl interface * Wire: Fix wire bindings * RBAC: Move resolvers to root * RBAC: Remove invalid test * RBAC: Inject access control service * RBAC: Implement the RoleRegistry interface in fake	3 years ago
Karl Persson	cc78486535	RBAC: Display indicator if a permission is inherited (#54080 ) * RBAC: Add IsInherited property * PermissionList: Display inherited indicator	3 years ago
Karl Persson	4ff4aaab23	RBAC: Remove builtin role code (#53767 ) * remove rbacBuiltInRoleAssignmentEnabled from frontendsettings * RBAC: Remove RBACBuiltInRoleAssignmentEnabled * RBAC: Remove code for builtin role * RolePicker: Remove unused prop * RolePicker: Rename builtinRole to basicRole * RolePicker: Rename onBuiltinRoleChange to onBasicRoleChange * RolePicker: Rename properties	3 years ago
Karl Persson	1b933ff3ed	RBAC: Move resource permissions store to service package (#53815 ) * Rename file to store * Move resource permission specific database functions to resourcepermissions package * Wire: Remove interface bind * RBAC: Remove injection of resourcepermission Store * RBAC: Export store constructor * Tests: Use resource permission package to initiate store used in tests * RBAC: Remove internal types package and move to resourcepermissions package * RBAC: Run database tests as itegration tests	3 years ago
Karl Persson	57d87389e0	RBAC: Remove user permissions in org when user is removed (#53782 ) * RBAC: Add orgID to DeleteUserPermissions * RBAC: Refactor query to delete all permissions in specified org, 0 deletes all permissions * Delete user permission in org when user is removed * Remove call to delete permissions in frontend * Remove user permissions if removed orgs is detected during oauth sync Co-authored-by: Jo <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	d1df896962	Remove unsued dep (#53785 )	3 years ago
idafurjes	fa2e74cd6e	Chore: Remove GetSignedInUserWithCacheCtx from store interface (#53734 ) * Remove delete suer from store interface * Remove get signed in user with cache ctx from store interface * Support options when setting up access control tests * Fix broken tests * Fix lint * Add user fake to middleware * Fix middleware tests, remove usertest being initialised twice Co-authored-by: Karl Persson <kalle.persson@grafana.com>	3 years ago
Karl Persson	4069fe1c39	RBAC: Update permission query to not join on team table (#53677 ) * RBAC: Add teamIDs to get permission query * RBAC: Remove join on team table and use team ids * RBAC: Pass team ids	3 years ago
Karl Persson	91ef08de68	RBAC: Remove unused code (#53649 )	3 years ago
Karl Persson	c08fe3a53c	RBAC: Enable rbac when creating new settings (#53531 ) * Settings: Set RBACEnabled to true by default * Remove accessControlEnabledFlag and explicitly set to false when needed * Disable rbac for tests	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343 ) * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Karl Persson	e4c45c4f98	RBAC: Remove sort and unique values when fetching permissions (#53461 ) * RBAC: remove sort and unique values for fetching permissions	3 years ago
sh0rez	534ece064b	pkg/web: closure-style middlewares (#51238 ) * pkg/web: closure-style middlewares Switches the middleware execution model from web.Handlers in a slice to web.Middleware. Middlewares are temporarily kept in a slice to preserve ordering, but prior to execution they are applied, forming a giant call-stack, giving granular control over the execution flow. * pkg/middleware: adapt to web.Middleware * pkg/middleware/recovery: use c.Req over req c.Req gets updated by future handlers, while req stays static. The current recovery implementation needs this newer information * pkg/web: correct middleware ordering * pkg/webtest: adapt middleware * pkg/web/hack: set w and r onto web.Context By adopting std middlewares, it may happen they invoke next(w,r) without putting their modified w,r into the web.Context, leading old-style handlers to operate on outdated fields. pkg/web now takes care of this * pkg/middleware: selectively use future context * pkg/web: accept closure-style on Use() * webtest: Middleware testing adds a utility function to web/webtest to obtain a http.ResponseWriter, http.Request and http.Handler the same as a middleware that runs would receive * : cleanup pkg/web: don't wrap Middleware from Router * pkg/web: require chain to write response * : remove temp files webtest: don't require chain write * *: cleanup	3 years ago
lai	8f9a372ce2	Access Control: optimize GetUserPermissions sql (#53279 ) * Access Control: optimize GetUserPermissions sql	3 years ago
Gabriel MABILLE	00ff61cb9e	RBAC: Add an additional check on UserID before fetching the permissions (#53002 ) * RBAC: add an additional check before fetching permissions * Nit. * Readd removed test * change message	3 years ago
Ieva	b3a10202d4	Revert "Service accounts: Add service account to teams" (#52710 ) * Revert "Service accounts: Add service account to teams (#51536)" This reverts commit `0f919671e7`. * remove unneeded line * fix test	3 years ago
Ieva	fc4fd47deb	change managed permissions for service accounts (#52709 )	3 years ago
Ieva	f9ef7cac11	allow setting team managed permissions for service accounts (#52467 )	3 years ago
idafurjes	d3d8fdd878	Chore: Move user errors to user service (#52460 ) * Move user not found err to user service * User ErrCaseInsensitive from user pkg * User ErrUserAlreadyExists from user pkg * User ErrLastGrafanaAdmin from user pkg * Remove errors from model	3 years ago
idafurjes	c061b66d5f	Chore: Split delete user method (#52216 ) * Remove user from preferences, stars, orguser, team member * Fix lint * Add Delete user from org and dashboard acl * Delete user from user auth * Add DeleteUser to quota * Add test files and adjust user auth store * Rename package in wire for user auth * Import Quota Service interface in other services * do the same in tests * fix lint tests * Fix tests * Add some tests * Rename InsertUser and DeleteUser to InsertOrgUser and DeleteOrgUser * Rename DeleteUser to DeleteByUser in quota * changing a method name in few additional places * Fix in other places * Fix lint * Fix tests * Chore: Split Delete User method * Add fakes for userauth * Add mock for access control Delete User permossion, use interface * Use interface for ream guardian * Add simple fake for dashboard acl * Add go routines, clean up, use interfaces * fix lint * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Add wrapper for not service account error * fix indentation * Use fmt for error wrapper Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>	3 years ago
Ieva	d85df0a560	Service Accounts: Managed permissions for service accounts (#51818 ) * backend changes * frontend changes * linting * nit * import order * allow SA creator to access the SA page * fix merge * tests * fix frontend tests Co-authored-by: alexanderzobnin alexanderzobnin@gmail.com	3 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536 ) * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit `cbf71fbd7f`. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
idafurjes	578ab71ba9	Copy delete user permission to access control service (#51747 ) * Copy delete user permission to access control service * Update pkg/services/accesscontrol/database/database_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
idafurjes	6c43eb0b4d	Split Create User (#50502 ) * Split Create User * Use new create user and User from package user * Add service to wire * Making create user work * Replace user from user pkg * One more * Move Insert to orguser Service/Store * Remove unnecessary conversion * Cleaunp * Fix Get User and add fakes * Fixing get org id for user logic, adding fakes and other adjustments * Add some tests for ourguser service and store * Fix insert org logic * Add comment about deprecation * Fix after merge with main * Move orguser service/store to org service/store * Remove orguser from wire * Unimplement new Create user and use User from pkg user * Fix wire generation * Fix lint * Fix lint - use only User and CrateUserCommand from user pkg * Remove User and CreateUserCommand from models * Fix lint 2	3 years ago
Kristin Laemmert	945f015770	backend/datasources: move datasources models into the datasources service package (#51267 ) * backend/datasources: move datasources models into the datasources service pkg	3 years ago
Karl Persson	b9bb0513e3	Remove version property from fixed roles (#51298 )	3 years ago
Karl Persson	2698e37291	RBAC: Add access control metadata to folder dtos (#51158 ) * RBAC: Add access control metadata to Folder dto * Add access control metadata to folder dto response * Add test to verify that access control metadata is attached * Attach access control metadata to multiple folders * Add access control metadata to frontend folder dto	3 years ago
Karl Persson	44ffbfd6aa	RBAC: Refactor GetUserPermissions to use []accesscontrol.Permission (#50683 ) * Return slice of permissions instead of slice of pointers for permissions	3 years ago
Yuriy Tseretyan	54fa04263b	Alerting: Add RBAC actions and role for provisioning API routes (#50459 ) * add alert provisioning actions and role * linter	3 years ago
Karl Persson	9fd9a2cded	RBAC: Remove workaround to check permissions on folders for dashboard actions (#50291 ) * remove workaround to check permissions on folders for dashboard actions	3 years ago
Karl Persson	c4a75f9eb3	RBAC: Add scope resolvers for dashboards (#50110 ) * Inject access control into dashboard service * Add function to parse id scopes * Add dashboard as return value * Update mock * Return only err to keep service interface * Add scope resolvers for dashboard id scopes * Add function to parse uid scopes * Add dashboard uid scope resolver * Register scope resolvers for dashboards Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
Yuriy Tseretyan	c85567f490	fix logging of resolving scopes (#50173 )	3 years ago
Kat Yang	bc8578524b	Chore: Remove last build tag (#50120 )	3 years ago
Karl Persson	896a101f48	RBAC: Extract method from access control impl to a function in domain packge (#49947 ) * Remove GetUserBuiltInRoles and create it as a util function in accesscontrol domain package	3 years ago
Ieva	5dbea9996b	RBAC: Make RBAC action names more consistent (#49730 ) * update action names * correctly retrieve teams for signed in user * remove test * undo swagger changes * undo swagger changes pt2 * add migration from old action names to the new ones * rename from list to read * linting * also update alertign actions * fix migration	3 years ago
Karl Persson	bdff63d4a8	RBAC: Include alert.rules action when setting folder permissions (#49946 ) * Generate additional actions when setting folder permissions in acl list * Add migration for managed folder permissions to include alert rule actions	3 years ago
Karl Persson	d82eb5902d	AccessControl: Cleanup access control interface (#49783 ) * removed unused function * Rename interface	3 years ago
Karl Persson	5caf97be40	AccessControl: Replace IsEnterprise checks with license checks (#49572 )	3 years ago
sh0rez	3ca3a59079	pkg/web: remove dependency injection (#49123 ) * pkg/web: store http.Handler internally * pkg/web: remove injection Removes any injection code from pkg/web. It already was no longer functional, as we already only injected into `http.Handler`, meaning we only inject ctx.Req and ctx.Resp. Any other types (Context, ReqContext) were already accessed using the http.Request.Context.Value() method. * : remove type mappings Removes any call to the previously removed TypeMapper, as those were non-functional already. pkg/web: remove Context.Invoke was no longer used outside of pkg/web and also no longer functional	3 years ago

1 2 3 4 5 ...

309 Commits (2848be90355d77e446c783fd339a7f4d49ed1199)