119 Commits (32fde6dba4be14fc90d58b07d97d5b3585b50d86)

Author	SHA1	Message	Date
Gabriel MABILLE	c3505f0864	AuthZ: Make `NewGrpcTokenAuth` public (#101352) ... * AuthZ: Expose NewGrpcTokenAuth * Lint	3 months ago
Karl Persson	fa74d1c36d	Authn: Sync authlib and update how we construct authn client interceptor (#101124) ... * Sync authlib and update how we construct authn client interceptor * Remove namespace from checker	3 months ago
Karl Persson	74632a25c3	Authz: folder api tls settings (#101213) ... * Skip certificate verification * Add more settings for folder api	3 months ago
Todd Treece	9e80b0f913	K8s: Add error to GetRestConfig (#101147) ... K8s: Add error to RestConfigProvider return values	3 months ago
Karl Persson	14886410d6	Zanzana: Use shared auth interceptor for zanzana and pass tracer (#100968) ... * Use shared auth interceptor for zanzana and pass tracer	3 months ago
Alexander Zobnin	fcb88f6ccc	Zanzana: revert cluster store for fixed roles (#100958) ... * Zanzana: revert cluster store for fixed roles * update go workspace	3 months ago
Karl Persson	4df398c084	Authz: Sync authlib and update authz client setup code (#100817) ... * Sync authlib and update setup code for authz client	3 months ago
Karl Persson	e9b2f69137	Authz: Only have two modes for authz client (#100803) ... * Only have "inproc" and "clod" mode	3 months ago
Karl Persson	1b1954de28	Authz: add support to use folder api to fetch folder tree (#100038) ... * Add FolderStore interface * Authz: add implementation to use folders api and use it inproc with loopback config * Add tracing and add rest.Config for talking with folder api using access tokens * Restructure test to get rid of circular dependencies in tests * use correct group version kind --------- Co-authored-by: gamab <gabriel.mabille@grafana.com>	3 months ago
Alexander Zobnin	7234a17d1d	Zanzana: Use authzService audience (#100417)	4 months ago
Karl Persson	bfa4fa3c68	Authz: Refactor folder tree (#99554) ... * Refactor folder tree to its own structure * Make it possible to json encode the tree * Use iterations for Ancestors and Children --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	4 months ago
Karl Persson	011301f06f	Authz: client cache (#100195) ... * Reduce client permissions cache for authz client * Adjust server cache ttl	4 months ago
Karl Persson	d16374d339	Authz: For list collect all folder permisions into items (#99955) ... * For list collect all folder permisions into items --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 months ago
Alexander Zobnin	a95005eab5	Zanzana: Disable broken OpenFGA health check (#99818) ... * Zanzana: Disable broken OpenFGA health check * simplify return Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 months ago
Ieva	33a53d170b	AuthZ service: Add metrics (#99007) ... * add metrics for authZ MT service * remove metrics that are already tracked by the GRPC server metrics Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * undo unneeded change * test fix --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 months ago
Gabriel MABILLE	a9f0e15778	AuthZ: Change cache interface (#99058) ... * Authz: Switch to remotecache * Todos * lint * lint test * test readibility * Remove ttls * implement a cache wrap * Rm unused func * Comment * Update workspace: * Use cache * Fix comment	4 months ago
Karl Persson	b0347792cc	Zazana: Fix verb to relation mapping (#99409)	4 months ago
Ieva	723fa7ddf9	MT AuthZ: Resolve renderer permissions in MT authZ service (#99362) ... * resolve renderer permissions in MT authZ service * also include DS read perms * fix tests and linting	4 months ago
Karl Persson	d740f9fc60	Authz: Simplify mapper and only check folders if its supported (#99357) ... * Simplify mapper and only check folders if its supported	4 months ago
Ryan McKinley	680e6bc1f8	Authlib: Use types package rather than claims (#99243)	4 months ago
Karl Persson	7329d2c34b	Authz: Account for fixed roles when running oss and using authz service (#99244) ... * Extract "PermissionStore" from general store interface * Add static and union permission stores * Add GetStaticRoles * Use accesscontrol.Service for inproc to provide static permissions	4 months ago
Karl Persson	67252dfa46	Zanzana: Add grpc health and readiness checks for standalone zanzana (#99176) ... Add grpc health and readiness checks for standalone zanzana	4 months ago
Alexander Zobnin	c5f14407cc	Zanzana: Refactor stores listing (#99098) ... Zanzana: Refactor store loading	4 months ago
Karl Persson	2187a66f2b	Zanzana: Split up settings into client and server sections (#99066) ... * Split up zanzana settings into client and server sections * Update workspace	4 months ago
Ryan McKinley	cd46f1ddb9	Search: Remove history query (#99026)	4 months ago
Karl Persson	3f71a72c1a	Authz: Remove "wrapper" interface and only check feature toggle for grpc mode (#98933) ... * Remove "wrapper" interface and only check feature toggle for grpc and cloud mode * Only set name for update checks * Set dashboard permissions for admin user	4 months ago
Karl Persson	ce0d986673	Zanzana: Use cache for both streamed and non-stream version of list objects (#98882) ... * Add prefix constants and use string builders / string concatinations * Use cache for both streamed and non-stream versions of list objects * Remove unused constants	4 months ago
Gabriel MABILLE	4c86de2678	Chore: Update authlib (#98870) ... * Chore: Update authlib * AccessChecker -> AccessClient	4 months ago
Ieva	9b34a56d7c	AuthZ service: Take action sets into account when checking folder create permissions (#98751) ... take action sets into account when checking folder create permissions	4 months ago
Gabriel MABILLE	4d699d4810	AuthZ: Use M3 AuthZ Service (#98621) ... * AuthZ: Use M3 AuthZ Service Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Fix oss * fake auth info --------- Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	5 months ago
Karl Persson	0f9b107201	Zanzana: Consistently add context (#98862) ... * Zanzana: Reworks how contextuals are loaded * Cleanup listObjectWithStream * Run list test with streaming enabled	5 months ago
Alexander Zobnin	5922015fec	Zanzana: Setup GRPC authentication in client/server mode (#98680) ... * Zanzana: Setup GRPC authentication in client/server mode * don't use grpcutils * refactor Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Add a namespace stub for in-proc mode Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Read parameters from config * authorize server requests * add namespace to the tests context * use stack id from config * simplify authorize func * properly format namespace * return Unauthenticated if namespace is empty * use insecure cred only in dev env * check request namespace * Use CallCredentials API for client auth * provide config * fail if stack id is missing * improve error message * use insecure connection by default --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com>	5 months ago
Gabriel MABILLE	bc7e90bc28	AuthZ: Fix client dial options (#98827)	5 months ago
Karl Persson	c593b20465	Zanana: Add custom verb for get_permissions and set_permissions. (#98616) ... * Add custom verb for get_permissions and update_permissions. Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	5 months ago
Karl Persson	fb5783691d	Zanzana: Fix reconciliation of fixed roles (#98696) ... Remove "globalReconciler" and reuse the same one but only run them for cluster namespace	5 months ago
Ieva	338a41f178	AuthZ service: Add single flight groups for permission fetching (#98607) ... add single flight groups for user and anonymous permission checking	5 months ago
Karl Persson	9ed4bf3cd2	Zanzana: Support sub resources (#98201) ... * Create and use common ResourceInfo struct * Add support for formatting group resource with subresource * Add initial support for handling subresource * Add test for checking subresource for generic resource * Bump authlib	5 months ago
Alexander Zobnin	7e5cb7d8d6	Zanzana: Refactor fixed roles (use global store) (#97884) ... * Zanzana: Pass contextual tuples for authorization * global reconciler for fixed roles * inject tuples from global store * fix adding contextual tuples * cleanup * don't error on auth context fail * add todo * add context for List * add caching * remove unused * use constant for global namespace * Rename global namespace to cluster namespace	5 months ago
Ieva	5a98432ba6	AuthZ service: Add traces for authZ service and store (#98445) ... * add traces for authz service and store * fix tests	5 months ago
Ieva	1334caa6c8	AuthZ service: Support anonymous access (#98322) ... support anonymous access	5 months ago
Gabriel MABILLE	efb7cc0343	Chore: Authlib upgrade (#98319) ... * Chore: Authlib upgrade * Upgrade authlib * Uncommit file	5 months ago
Ieva	2503b31f53	AuthZ service: Implement listing (#98220) ... * listing implementation pt 1 * validate list request * register GRPC endpoint, pass the correct user UID and return folder identifiers not scopes * uncomment code that was only commented out for testing * fix tests * remove unneeded changes * remove unused import * Update pkg/services/authz/rbac/service.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * refactor to improve efficiency Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * use variable names when logging * adding tests for listing --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	5 months ago
Gabriel MABILLE	55f8be62a1	AuthZ Service: Use singleflight group to fetch and build the folder tree (#98299) ... * AuthZ Service: Use singleflight group to fetch and build the folder tree * Change the sfgroup key * Future proof	5 months ago
Gabriel MABILLE	c175722dfd	AuthZService: Cache folder tree (#98210) ... * AuthZService: Cache folder tree * Remove fmt * Suggestion * Add tests	5 months ago
Ieva	30321a59a9	Fix broken builds (#98198) ... * fix broken builds * fix broken builds	5 months ago
Ieva	40a9f7162a	AuthZ service: Build folder tree and check inherited permissions (#98074) ... * build folder tree and check inherited permissions * don't fetch dashboards * remove unused queries	5 months ago
Gabriel MABILLE	961211b21a	AuthZ Service: Add caching (#98008) ... * AuthZ Service: Add caching * split in functions * Test getUserTeams * Add tests to getUserBasicRole * Test getUserPermissions * Cache user identifiers * fix test	5 months ago
Karl Persson	5c0cb09d27	Zanzana: Remove capabilities (#97918) ... Remove capabilities	6 months ago
Ieva	32554c78a8	Direct DB perm checks: check that the namespaces match (#97828) ... check that the namespace of the caller matches the namespace in the request	6 months ago
Ieva	ded90fa28d	App platform: Implement perm check with direct db access (#97579) ... * implement perm check with direct db access * add tests * more tests * Update pkg/services/authz/rbac/service.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/authz/rbac/service.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * allow fetching permissions for a user who is not a member of the org * linting * fix typo --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	6 months ago