grafana

Commit Graph

Author	SHA1	Message	Date
Karl Persson	8cea8fdaea	Access Control: Filter out hidden permissions in access control dashboard guardian (#46177 ) * Implement GetHiddenACL to handle legacy api correctly	3 years ago
Karl Persson	4982ca3b1d	Access control: Use access control for dashboard and folder (#44702 ) * Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	18cbfba596	Access control: Filter users and teams by read permissions (#45968 ) * pass signed in user and filter based on permissions	3 years ago
Gabriel MABILLE	14bee49f9a	AccessControl: Compute metadata from context permissions (#45578 ) * AccessControl: Compute metadata from context permissions * Remove nil Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Check user permissions are set Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	cdc08105c2	Access control: Set default permissions for data sources when using access control (#45482 ) * Rename interfaces and use then with wire injection * Set default permissions when creating new data source	3 years ago
Ezequiel Victorero	4f815e3d8e	Access control: adding FGAC to annotation GET endpoints and fixed roles (#45102 ) * Access control: adding FGAC to annotation GET endpoints and fixed roles Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Gabriel MABILLE	6fbf346747	AccessControl: Add endpoint to get user permissions (#45309 ) * AccessControl: Add endpoint to get user permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Fix SA tests * Linter is wrong :p * Wait I was wrong * Adding the route for teams:creator too Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	3 years ago
Karl Persson	d2b9da9dde	Access control: Support uids for resource permissions (#45226 ) * add middleware to solve uid -> id for requests	3 years ago
Gabriel MABILLE	78fc0258b1	AccessControl: Implement SQL filters for team members filtering (#44898 ) * AccessControl: Filter team members * Modify GetTeamMembersByUser comment * Fix postgres failing test due to quoting * Rename GetTeamMembersByUser to GetUserTeamMemberships * Update TeamStore interface	3 years ago
Gabriel MABILLE	01b88adb3a	AccessControl: SQL filters for team search (#44557 ) * AccessControl: SQL filters for team search Set test config * Remove userIdFilter when FGAC is on	3 years ago
Ieva	4f4b1cb5ea	Access control: hide team role picker if user doesn't have access to it (#45068 ) * hide team role column * hide or disable the role picker as needed * add SWL filtering for role listing	3 years ago
Karl Persson	01d961c824	update mock (#45010 )	3 years ago
Karl Persson	922b9465ec	Access Control: Add function to set several permissions on a resource in one transaction (#44768 )	3 years ago
Gabriel MABILLE	178193c84b	AccessControl: Use an SQLFilter struct (#44887 )	3 years ago
Ieva	602d62ebcc	Access control: FGAC for team sync endpoints (#44673 ) * add actions for team group sync * extend the hook to allow specifying whether the user is external * move user struct to type package * interface for permission service to allow mocking it * reuse existing permissions * test fix * refactor * linting	3 years ago
idafurjes	1b286e6bb5	Remove bus from quota, preferences, plugins, user_token (#44762 ) * Remove bus from quota, preferences, plugins, user_token * Bind sqlstore.Store to sqlstore.SQLStore Fix test * Fix sqlstore wire injection, dependency	3 years ago
Gabriel MABILLE	f81b9c8150	AccessControl: Read team permissions from db (#44727 )	3 years ago
Karl Persson	5ca9d2895b	Add viewer grant to `fixed:datasources:reader` if viewers_can_edit is set to true (#44657 )	3 years ago
Karl Persson	16e62965f5	handle case when scope is wildcard (#44654 )	3 years ago
Karl Persson	e844b263c7	Access control: Load permissions from memory and database (#42080 ) * Load permission from both in memory and from database Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
J Guerreiro	2894f07f05	AccessControl: improve denied message (#44551 ) * AccessControl: improve denied message * AccessControl: tweak permission denied	3 years ago
J Guerreiro	153b231521	AccessControl: Refine interface for AC store (#44536 ) * AccessControl: Refine interface for AC store * Update pkg/services/accesscontrol/database/resource_permissions.go	3 years ago
J Guerreiro	cb6e5ae8ce	AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add tests for AC guards in update/delete * AccessControl: add fixed role for team writer * AccessControl: ensure team related AC is deleted with team * Update pkg/api/team_test.go	3 years ago
Karl Persson	bf63ccbe00	Access control: Rewrite access control SQL filter (#44488 ) * Rewrite access control sql filter	3 years ago
Ryan McKinley	5d66194ec5	FeatureFlags: define features outside settings.Cfg (take 3) (#44443 )	3 years ago
Gabriel MABILLE	d4f682190f	AccessControl: Implement teams resource service (#43951 ) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * moving resourceservice to the main wire file pt2 * move team related actions so that they can be reused * PR feedback * fix * typo * Access Control: adding hooks for team member endpoints (#43991) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * add access control to list and add team member endpoint, and hooks for adding team members * member permission type is 0 * add ID scope for team permission checks * add more team actions, use Member for member permission name * protect team member update endpoint with FGAC permissions * update SQL functions for teams and the corresponding tests * also protect team member removal endpoint with FGAC permissions and add a hook to permission service * a few small fixes, provide team permission service to test setup * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * remove resource services from wireexts * remove unneeded actions * linting fix * remove comments * feedback fixes * feedback * simplifying * remove team member within the same transaction * fix a mistake with the error * call the correct sql fction * linting * Access control: tests for team member endpoints (#44177) * tests for team member endpoints * clean up and fix the tests * fixing tests take 2 * don't import enterprise test license * don't import enterprise test license * remove unused variable Co-authored-by: gamab <gabi.mabs@gmail.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Katarina Yang	92ca38bedf	Refactor: Change sqlstore.inTransaction to SQLStore.WithTransactionalDBSession in misc files (#43926 ) * Refactor: Change sqlstore.inTransaction to SQLStore.WithTransactionalDBSession in misc files * Refactor: Change .inTransaction in org.go file * Refactor: Update init() to proper SQLStore handlers * Refactor: Update funcs in tests to be sqlStore methods * Refactor: Update API funcs to receive HTTPServer * Fix: define methods on sqlstore * Adjust GetSignedInUser calls * Refactor: Add sqlStore to Service struct * Chore: Add back black spaces to remove file from PR Co-authored-by: Ida Furjesova <ida.furjesova@grafana.com>	3 years ago
Karl Persson	de2c5783fa	Access Control: Pass db session to hooks (#44428 ) * Move hook calls to database and pass session	3 years ago
Agnès Toulet	65bdb3a899	FeatureFlags: Revert managing feature flags outside of settings.Cfg (#44382 ) * Revert "FeatureToggles: register all enterprise feature toggles (#44336)" This reverts commit `f53b3fb007`. * Revert "FeatureFlags: manage feature flags outside of settings.Cfg (#43692)" This reverts commit `f94c0decbd`.	3 years ago
idafurjes	00c389933b	Chore: Remove bus from team (#44218 ) * Remove bus from team * Fix api team test * Remove bus from team members	3 years ago
Ryan McKinley	f94c0decbd	FeatureFlags: manage feature flags outside of settings.Cfg (#43692 )	3 years ago
Gabriel MABILLE	54280fc9d7	AccessControl: Resolve `attribute` based scopes to `id` based scopes (#40742 ) * AccessControl: POC scope attribute resolution Refactor based on ScopeMutators test errors and calls to cache Add comments to tests Rename logger Create keywordMutator only once * AccessControl: Add AttributeScopeResolver registration Co-authored-by: gamab <gabriel.mabille@grafana.com> * AccessControl: Add AttributeScopeResolver to datasources Co-authored-by: gamab <gabriel.mabille@grafana.com> * Test evaluation with translation * fix imports * AccessControl: Test attribute resolver * Fix trailing white space * Make ScopeResolver public for enterprise redefine * Handle wildcard Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
ying-jeanne	7422789ec7	Remove Macaron ParamsInt64 function from code base (#43810 ) * draft commit * change all calls * Compilation errors	3 years ago
Karl Persson	f999910dc6	Access control: Add access control sql filter to org user queries (#43961 ) * Add access control SQL filter to org user queries	3 years ago
Ieva	a06564fb0d	Access control: allow granting a fixed role dynamically based on the startup settings (#43867 ) * allow granting a fixed role dynamically depending on startup config * move role definition for team writing * undo test changes * nicer naming	3 years ago
Ieva	41b709d08d	Access control: permissions for team creation (#43506 ) * FGAC for team creation * tests * fix snapshot for UI tests * linting * update snapshots * Remove unecessary class and update tests Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Make the condition slightly easier Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	3 years ago
Karl Persson	d350ed0f35	Access Control: SQL filter (#43560 ) * Add the accesscontrol sql filter utility Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	3 years ago
Gabriel MABILLE	92c568e9f7	AccessControl: Remove unused error from `GetResourcesMetadata` (#43710 ) * AccessControl: Remove unused error from GetResourcesMetadata Co-authored-by: J Guerreiro <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	2425828a0b	quote reserved keyword (#43652 )	3 years ago
Karl Persson	ee690a7bb0	Add org_id in join (#43648 )	3 years ago
J Guerreiro	a0cf57b5b8	AccessControl: Reduce tone of access error (#43601 )	3 years ago
Karl Persson	0ace9695a6	Access control: Add optional hooks (#43372 ) * Add optional OnSet hooks	3 years ago
Karl Persson	2409d8dc1f	check the value of the feature toggle (#43433 )	3 years ago
Karl Persson	b3d5a607d4	Access Control: Add option to filter only managed permissions (#43371 ) * Add option to filter only managed permissions	3 years ago
idafurjes	ff3cf94b56	Chore: Remove context.TODO() from services (#42555 ) * Remove context.TODO() from services * Fix live test	3 years ago
Karl Persson	c3ca2d214d	Access control: Refactor managed permission system to create api and frontend components (#42540 ) * Refactor resource permissions * Add frondend components for resource permissions Co-authored-by: kay delaney <45561153+kaydelaney@users.noreply.github.com> Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Gabriel MABILLE	c7cabdfd6f	AccessControl: Add accesscontrol metadata to datasources DTOs (#42675 ) * AccessControl: Provide scope to frontend * Covering datasources with accesscontrol metadata * Write benchmark tests for GetResourcesMetadata * Add accesscontrol util and interface * Add the hasPermissionInMetadata function in the frontend access control code * Use IsDisabled rather that performing a feature toggle check Co-authored-by: Karl Persson <kalle.persson@grafana.com>	4 years ago
Karl Persson	9558c09a7c	Access Control: Store permissions on SignedInUser (#43040 ) * add permission structure to signedinuser * add middleware to load user permissions into signedinuser struct * apply LoadPermissionsMiddleware to http server * check for permissions in signedinuser struct Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Alexander Zobnin	da2c99a2e1	Access control: use delegatable flag to check if role can be granted (#42070 ) * Access control: use delegatable flag to check if role can be granted or not * Fix naming	4 years ago
Gabriel MABILLE	0ee0a0b7a0	AccessControl: FGAC permissions for orgs endpoint on frontend (#41050 ) * AccessControl: FGAC permissions for orgs endpoint on frontend Protect org update endpoints add or refactor missing right messages cover org page * removing scopes from orgs * Perform permission control with global org * Perform the error handling in case of 403 * Simplify frontend code by requiring read access for sure * Remove roles I added to decrease the number of changes * Remove the check for server admin to reduce the number of changes * change error message * Cleaning todos * Remove unecessary changes * Fix tests * Update test snapshot * Update pkg/api/roles.go Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Format AdminEditOrgPage for linting * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Vardan Torosyan <vardants@gmail.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Update public/app/features/admin/AdminListOrgsPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Commit suggestions * Commit suggestion canRead canWrite * fix typo Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	4 years ago

... 3 4 5 6 7

309 Commits (2848be90355d77e446c783fd339a7f4d49ed1199)