40 Commits (2e2e89a81663dfdab284e945bc508c33a6eadddb)

Author	SHA1	Message	Date
Ieva	cc0ec349a4	RBAC: Allow passing in user UID when searching for user's permissions (#97125) ... * allow passing in user UID instead of ID when searching for user's permissions * fix tests	1 year ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551) ... * Revert "chore: add replDB to team service (#91799)" This reverts commit c6ae2d7999. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit 54177ca619. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit 299c142f6a. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit ac0b4bb34d. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit daedb358dd. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit af19f039b6. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit 27b52b1507. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit 8a6107cd35. * Revert "accesscontrol service read replica (#89963)" This reverts commit 77a4869fca. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit ab5a079bcc. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit d988f5c3b0. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit 50244ed4a1.	1 year ago
Jeff Levin	028e8ac59e	Instrument tracing across accesscontrol (#91864) ... Instrument tracing across accesscontrol --------- Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	1 year ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801) ... * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	1 year ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567)	1 year ago
Kristin Laemmert	77a4869fca	accesscontrol service read replica (#89963) ... * accesscontrol service read replica * now using the ReplDB interface * ReadReplica for GetUser	2 years ago
Ieva	34c40f959f	RBAC: Add and resolve action sets when searching user's permissions (#88694) ... * include and resolve action sets when fetching user's permissions * expand both action and action prefix (returns an empty set for the one that isn't specified) Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * if action is specified, check for exact match; also extend tests	2 years ago
Alexander Zobnin	82dea4b3e5	Access control: Cache basic roles and teams permissions (#87043) ... * RBAC: Cache basic roles permissions * Cache teams permissions * Set cache TTL to 1 minute * Add OSS implementation * Fetch basic role permissions correctly * fix conflict_user_command * Fix teams permissions query * Add traces for GetUserPermissions * Fix folders tests * Fix colflict user command * Update store mock * Fix linter error * Reuse GetUserPermissions for fetching basic roles * tests for GetTeamsPermissions * pre-allocate slice capacity * Fix linter	2 years ago
Gabriel MABILLE	5e48804364	RBAC: Fix slow user permission search query on MySQL (#85058) ... * Bench testing search user perm * Add BenchmarkSearchUsersPermissions_1K_1K * Clarify benchmark searches by action prefix * Make MySQL more efficient * Move all filter options * Expand after assignments union * update comments	2 years ago
Alexander Zobnin	82a88cc83f	Access control: Extend GetUserPermissions() to query permissions in org (#83392) ... * Access control: Extend GetUserPermissions() to query permissions in specific org * Use db query to fetch permissions in org * refactor * refactor * use conditional join * minor refactor * Add test cases * Search permissions correctly in OSS vs Enterprise * Get permissions from memory * Refactor * remove unused func * Add tests for GetUserPermissionsInOrg * fix linter	2 years ago
Gabriel MABILLE	8d9921a5ba	RBAC: Fix delete team permissions on team delete (#83442) ... * RBAC: Remove team permissions on delete * Remove unecessary deletes from store function * Nit on mock * Add test to the database * Nit on comment * Add another test to check that other permissions remain	2 years ago
Gabriel MABILLE	846eadff63	RBAC Search: Replace `userLogin` filter by `namespacedID` filter (#81810) ... * Add namespace ID * Refactor and add tests * Rename maxOneOption -> atMostOneOption * Add ToDo * Remove UserLogin & UserID for NamespaceID Co-authored-by: jguer <joao.guerreiro@grafana.com> * Remove unecessary import of the userSvc * Update pkg/services/accesscontrol/acimpl/service.go * fix 1 -> userID * Update pkg/services/accesscontrol/accesscontrol.go --------- Co-authored-by: jguer <joao.guerreiro@grafana.com>	2 years ago
Gabriel MABILLE	dce9d1e87c	RBAC: Search endpoint support wildcards (#80383) ... * RBAC: Search endpoint support wildcards * Allow wildcard filter with RAM permissions as well	2 years ago
Gabriel MABILLE	729f9a01a0	RBAC: Fix search user permissions (#74729) ... Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066)	2 years ago
Gabriel MABILLE	8c6b5a4319	RBAC: Add a function to save external service roles (#66299) ... * AuthN: Save external services RBAC roles * Add missing test * Placing roles in the same group * Split function to gen role and assignment * add test case and comments * Ensure we check external service roles are assigned once only * Update pkg/services/accesscontrol/models_test.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> --------- Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	3 years ago
Ieva	6aa5a79cad	Access control: endpoint for searching single user permissions (#59669) ... * initial commit * clean up * fix a bug and add tests * more tests * undo some unintended changes * undo some unintended changes * linting * PR feedback - add user ID to search options * simplify the query * Apply suggestions from code review Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * remove unneeded formatting changes Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
Karl Persson	6d1bcd9f40	DataSourcePermissions: Handle licensing properly for ds permissions (#59694) ... * RBAC: add viewer grand if dspermissions enforcement is not enabled * RBAC: Change permissions based on role prefix * RBAC: Add option to for permission service to add a license middleware * RBAC: Remove actions from query struct	3 years ago
Gabriel MABILLE	bf49c20050	RBAC: Add an endpoint to list all user permissions (#57644) ... * RBAC: Add an endpoint to see all user permissions Co-authored-by: Joey Orlando <joey.orlando@grafana.com> * Fix mock * Add feature flag * Fix merging * Return normal permissions instead of simplified ones * Fix test * Fix tests * Fix tests * Create benchtests * Split function to get basic roles * Comments * Reorg * Add two more tests to the bench * bench comment * Re-ran the test * Rename GetUsersPermissions to SearchUsersPermissions and prepare search options * Remove from model unused struct * Start adding option to get permissions by Action+Scope * Wrong import * Action and Scope * slightly tweak users permissions actionPrefix query param validation logic * Fix xor check * Lint * Account for suggeston Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add search * Remove comment on global scope * use union all and update test to make it run on all dbs * Fix MySQL needs a space * Account for suggestion. Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Joey Orlando <joey.orlando@grafana.com> Co-authored-by: Joey Orlando <joseph.t.orlando@gmail.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	7386f8652c	RBAC: Improve performance of dashboard filter query (#56813) ... * RBAC: Move UserRolesFilter to domain package * Dashboard Permissions: Rewrite rbac filter to check access in sql * RBAC: Add break when wildcard is found * RBAC: Add tests for dashboard filter * RBAC: Update tests * RBAC: Cover more test cases Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087) ... * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago
Kristin Laemmert	c61b5e85b4	chore: replace sqlstore.Store with db.DB (#57010) ... * chore: replace sqlstore.SQLStore with db.DB * more post-sqlstore.SQLStore cleanup	3 years ago
Eric Leijonmarck	f7de253cdd	fix: remove permission grouping (#56157)	3 years ago
Eric Leijonmarck	1e8f8dff4b	Auth: Adds validation and ingestion of conflict file (#53014) ... * add users-manager command * add users-manager command * rename files * refactor: imports and renaming * Command: add conflict merge user command - MergeUser will - replace all user_ids from conflicting users to the chosen userId - delete users whose user_ids are not the chosen user - SameIdentification will - update chosen user with chosen email,login details - delete users whose user_ids are not the chosen user * refactor: clean up * refactor: create structure for read, validate, ingest * feat: ls and generate-file for conflicting users * remove usagestats * added back pkg/services/login/authinfoservice/database/stats.go * Revert "added back pkg/services/login/authinfoservice/database/stats.go" This reverts commit 2ba6e3c4d6. * Revert "remove usagestats" This reverts commit 1e3fa97810. * cherry pick * Revert "cherry pick" This reverts commit 461626c306. * validation of picked merge user * fix test * make lint * make test run * tests for ingest working * clean up and refactored to align with downstream refactoring * formatting * refactor: name list instead of ls * fix: static lint error use trimprefix * WIP: permissions for validation * fix: remove unused functions in sqlstore * fix: remove unused function * handling of multiple users and resolve discarded users * fix tests * fix: bug that did not exclude the blocks * ioutil is blacklisted * WIP: validation * tests for merging a user working * add latest changes to output print * refactor: removed conflictEmail and conflictLogin that was not used * refactor: code clean up, showChanges working * test and linting fixes * test and linting fixes * refactor: removed logging of config and added more info for vlidation command * refactor: fix order of code * fix time now * refactor: no longer need for check casesensitive login/email * removed unnessecary loop * refactor: move functions around * test: working * docs: add docuemntationf for file * Add failing test for generating the conflict login block * Fix regex * Fix some stuff/tests Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com> * add: docs for conflict file * add: conflict_email, conflict_login fields * add: conflict_email, conflict_login fields * WIP * fix: tests working as intended * Update pkg/cmd/grafana-cli/commands/conflict_user_command.go Co-authored-by: linoman <2051016+linoman@users.noreply.github.com> * review comments * Update pkg/cmd/grafana-cli/commands/conflict_user_command.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * Update pkg/cmd/grafana-cli/commands/conflict_user_command.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * missspelling * trailing new line * update to use userimpl store * remove newline * remove newline * refactor: initializing of resolver for conflicts * fix: test sqlStore * refactor: removed lines * refactor: remove TODOs Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com> Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>	3 years ago
Karl Persson	b827df626d	RBAC: Initiate store in service (#55081) ... * RBAC: Dont inject store with wire * RBAC: Use Store interface * RBAC: Move store interface and initiate it from service	3 years ago
Karl Persson	1b933ff3ed	RBAC: Move resource permissions store to service package (#53815) ... * Rename file to store * Move resource permission specific database functions to resourcepermissions package * Wire: Remove interface bind * RBAC: Remove injection of resourcepermission Store * RBAC: Export store constructor * Tests: Use resource permission package to initiate store used in tests * RBAC: Remove internal types package and move to resourcepermissions package * RBAC: Run database tests as itegration tests	3 years ago
Karl Persson	57d87389e0	RBAC: Remove user permissions in org when user is removed (#53782) ... * RBAC: Add orgID to DeleteUserPermissions * RBAC: Refactor query to delete all permissions in specified org, 0 deletes all permissions * Delete user permission in org when user is removed * Remove call to delete permissions in frontend * Remove user permissions if removed orgs is detected during oauth sync Co-authored-by: Jo <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	4069fe1c39	RBAC: Update permission query to not join on team table (#53677) ... * RBAC: Add teamIDs to get permission query * RBAC: Remove join on team table and use team ids * RBAC: Pass team ids	3 years ago
Karl Persson	e4c45c4f98	RBAC: Remove sort and unique values when fetching permissions (#53461) ... * RBAC: remove sort and unique values for fetching permissions	3 years ago
lai	8f9a372ce2	Access Control: optimize GetUserPermissions sql (#53279) ... * Access Control: optimize GetUserPermissions sql	3 years ago
Gabriel MABILLE	00ff61cb9e	RBAC: Add an additional check on UserID before fetching the permissions (#53002) ... * RBAC: add an additional check before fetching permissions * Nit. * Readd removed test * change message	3 years ago
idafurjes	578ab71ba9	Copy delete user permission to access control service (#51747) ... * Copy delete user permission to access control service * Update pkg/services/accesscontrol/database/database_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
Karl Persson	44ffbfd6aa	RBAC: Refactor GetUserPermissions to use []accesscontrol.Permission (#50683) ... * Return slice of permissions instead of slice of pointers for permissions	4 years ago
Karl Persson	1c679e814b	AccessControl: Only return action and scope for user permissions and make them unique (#48939) ... * Only return action and scope for user permissions and make them unique	4 years ago
Karl Persson	58fa119270	sort user permissions by scope (#48928)	4 years ago
Karl Persson	e844b263c7	Access control: Load permissions from memory and database (#42080) ... * Load permission from both in memory and from database Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
Karl Persson	3c659f1ea0	Access Control: Move part of access control database (#40483) ... * Add accesscontrol migrations * Add ResourceStore interface and related structs * Add team/user/builtin-role * Add accesscontrol database with functions to handle managed roles and permissions * Add ResourceManager * Add GetUserPermissions * Update pkg/services/accesscontrol/accesscontrol.go Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Alexander Zobnin	823f0bc460	Access Control: move features to Enterprise (#32640) ... * Move db package WIP * Implement OSS access control * Register OSS access control * Fix linter error in tests * Fix linter error in evaluator * Simplify OSS tests * Optimize builtin roles * Chore: add comments to the exported functions * Remove init from ossaccesscontrol package (moved to ext) * Add access control as a dependency for http server * Modify middleware to receive fallback function * Middleware: refactor fallback function call * Move unused models to enterprise * Simplify AccessControl type * Chore: use bool IsDisabled() method instead of CanBeDisabled interface	5 years ago
Alexander Zobnin	20f6ba5ba4	Access-control: use role UID when adding/removing roles (#32438)	5 years ago
Alexander Zobnin	20bd591bea	Access control: Basic structure and functionality behind feature toggle (#31893) ... Co-authored-by: Alexander Zobnin <alexander.zobnin@grafana.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> Co-authored-by: Arve Knudsen <arve.knudsen@grafana.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@grafana.com>	5 years ago