grafana

Commit Graph

Author	SHA1	Message	Date
Arati R.	6957e1f7b7	Folders: Replace sql query with folder service call when collecting folder tree (#98443 ) * Replace sql query with folder service call when collecting folder tree * Update provider for folder service implementation for wire * Refactor provisioning of oss service in folder permissions test util	6 months ago
Ieva	cc0ec349a4	RBAC: Allow passing in user UID when searching for user's permissions (#97125 ) * allow passing in user UID instead of ID when searching for user's permissions * fix tests	8 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205 ) * Special handling for zanzana reconciliation if stack id is configured * remove sync call	8 months ago
Aaron Godin	d89235aa8c	IAM: fix GetSearchPermissionCacheKey uniqueness (#95192 ) * fix: Change users permissions search to use a consistent key without collisions * Move HashString to cacheutils * Change error handling logic for what to do with a cache key * Add a test that confirms search cache key consistency	9 months ago
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752 ) * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	9 months ago
Alexander Zobnin	5d724c2482	Zanzana: Initial dashboard search (#93093 ) * Zanzana: Search in a background and compare results * refactor * Search with check * instrument zanzana client * add single_read option * refactor * refactor move check into separate function * Fix tests * refactor * refactor getFindDashboardsFn * add resource type to span attributes * run ListObjects concurrently * Use list and search in less cases * adjust metrics buckets * refactor: move Check and ListObjects to AccessControl implementation * Revert "Fix tests" This reverts commit `b0c2f072a2`. * refactor: use own types for Check and ListObjects inside accesscontrol package * Fix search scenario with low limit and empty query string * more accurate search with checks * revert * fix linter * Revert "revert" This reverts commit `ee5f14eea8`. * add search errors metric * fix query performance under some conditions * simplify check strategy * fix pagination * refactor findDashboardsZanzanaList * Iterate over multiple pages while making check request * refactor listUserResources * avoid unnecessary db call * remove unused zclient * Add notes for SkipAccessControlFilter * use more accurate check loop * always use check for search with provided UIDs * rename single_read to zanzana_only_evaluation * refactor * update go workspace * fix linter * don't use deprecated fields * refactor * fail if no org specified * refactor * initial integration tests * Fix tests * fix linter errors * fix linter * Fix tests * review suggestions Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix limit * refactor * refactor tests * fix db config in tests * fix migrator (postgres) --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	10 months ago
Gabriel MABILLE	7928245eb6	ManagedServiceAccounts: Add a config option to disable the feature on-prem (#93571 ) * ManagedServiceAccounts: Add a config option to disabled by default * Update log in pkg/services/extsvcauth/registry/service.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	10 months ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551 ) * Revert "chore: add replDB to team service (#91799)" This reverts commit `c6ae2d7999`. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit `54177ca619`. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit `299c142f6a`. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit `ac0b4bb34d`. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit `daedb358dd`. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit `af19f039b6`. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit `27b52b1507`. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit `8a6107cd35`. * Revert "accesscontrol service read replica (#89963)" This reverts commit `77a4869fca`. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit `ab5a079bcc`. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit `d988f5c3b0`. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit `50244ed4a1`.	10 months ago
Alexander Zobnin	88259da745	RBAC: Optimize permissions caching (#92673 ) * Access control: Use composite cache key for team permissions * use composite key for teams * use cache for hotpath (getCachedUserPermissions) * don't cache empty teams set * don't pass permissions as argument * early return if no teams found * reload cache correctly * optimize allocations * Clear user's teams cache * remove composite cache for teams * fix linter * don't clear teams permissions * pre-allocate memory for basic roles permissions	11 months ago
Gabriel MABILLE	2a1a43fc9b	PermissionRegistry: Error on unknown kind (#91469 ) * PermissionRegistry: Error on unknown kind * Account for PR feedback Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> * Add missing alerting scope --------- Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>	11 months ago
Aaron Godin	86e8e3b75d	Revert "RBAC: Optimize permissions caching" (#92548 ) Revert "RBAC: Optimize permissions caching (#92412)" This reverts commit `488e994d37`. Co-authored-by: gamab <gabriel.mabille@grafana.com>	11 months ago
Alexander Zobnin	488e994d37	RBAC: Optimize permissions caching (#92412 ) * Access control: Use composite cache key for team permissions * use composite key for teams * use cache for hotpath (getCachedUserPermissions) * fix linter * fix sorting --------- Co-authored-by: Jeff Levin <jeff@levinology.com>	11 months ago
Jeff Levin	028e8ac59e	Instrument tracing across accesscontrol (#91864 ) Instrument tracing across accesscontrol --------- Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	11 months ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801 ) * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	11 months ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763 )	11 months ago
Karl Persson	bcfb66b416	Identity: remove GetTypedID (#91745 )	12 months ago
Gabriel MABILLE	8988e04044	RBAC: Add permission registry (#91247 ) * RBAC: Permission registry * Populate permission registry * Wire * conflic_user_cmd * Update pkg/services/accesscontrol/permreg/permreg_test.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * PR feedback Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Remove ToDo, tackle in subsequent PR --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	12 months ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567 )	1 year ago
Ieva	9bb2cf4968	RBAC: Allow omitting default permissions when a new resource is created (#90720 ) * Cfg: Move rbac settings to own struct * Cfg: Add setting to control if resource should generate managed permissions when created * Dashboards: Check if we should generate default permissions when dashboard is created * Folders: Check if we should generate default permissions when folder is created * Datasource: Check if we should generate default permissions when datasource is created * ServiceAccount: Check if we should generate default permissions when service account is created * Cfg: Add option to specify resources for wich we should default seed * ManagedPermissions: Move providers to their own files * Dashboards: Default seed all possible managed permissions if configured * Folders: Default seed all possible managed permissions if configured * Cfg: Remove service account from list * RBAC: Move utility function * remove managed permission settings from the config file examples, change the setting names * remove ini file changes from the PR * fix setting reading * fix linting errors * fix tests * fix wildcard role seeding --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: jguer <me@jguer.space>	1 year ago
Ieva	4c7d8c8cdd	RBAC: Refactor RBAC plugin interface code (#90679 ) move plugin RBAC registration ifaces to pluginsintegrations	1 year ago
Kristin Laemmert	77a4869fca	accesscontrol service read replica (#89963 ) * accesscontrol service read replica * now using the ReplDB interface * ReadReplica for GetUser	1 year ago
Jeff Levin	cfe8317d45	Add auth spans and remove deduplication code for scopes (#89804 ) Adds more spans for timing in accesscontrol and remove permission deduplicating code after benchmarking --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 year ago
Karl Persson	e568b86ac0	Zanzana: Initial work to allow partial data migrations (#89919 ) * Zanana: Add Write method to interface * Zanzana: Add utilities for translating RBAC to openFGA tuple keys * RBAC: Add zanzana synchronizer * Run zanzana sync in access controll provider	1 year ago
Jeff Levin	ed13959e33	Optimize memory allocations in permissions cache (#89645 ) This PR reduces the number of allocations made while caching permissions from the database, fixes the hierarchy of spans and adds new spans for tracing. --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	1 year ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116 )	1 year ago
Ieva	34c40f959f	RBAC: Add and resolve action sets when searching user's permissions (#88694 ) * include and resolve action sets when fetching user's permissions * expand both action and action prefix (returns an empty set for the one that isn't specified) Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * if action is specified, check for exact match; also extend tests	1 year ago
Ieva	3e77768144	RBAC: Expand action sets when fetching permissions (#87967 ) * logic to expand action set to the underlying actions when permissions are fetched from the DB * updates needed for dependency injection * clean up some code, also deduplicate scopes when grouping scopes and actions * expand on a comment * rename a method	1 year ago
Gabriel MABILLE	e7d5622969	RBAC: No need to filter permissions on cache hit (#87941 )	1 year ago
Alexander Zobnin	0302b75721	Access control: Use search options for computing permissions cache key (#87589 )	1 year ago
Alexander Zobnin	d1c582815a	Access control: Fix searching permissions from cache (#87489 ) * Fix searching permissions from cache * Write permissions to cache	1 year ago
Alexander Zobnin	82dea4b3e5	Access control: Cache basic roles and teams permissions (#87043 ) * RBAC: Cache basic roles permissions * Cache teams permissions * Set cache TTL to 1 minute * Add OSS implementation * Fetch basic role permissions correctly * fix conflict_user_command * Fix teams permissions query * Add traces for GetUserPermissions * Fix folders tests * Fix colflict user command * Update store mock * Fix linter error * Reuse GetUserPermissions for fetching basic roles * tests for GetTeamsPermissions * pre-allocate slice capacity * Fix linter	1 year ago
Alexander Zobnin	3127566a20	Access control: Use ResolveIdentity() for authorizing in org (#85549 ) * Access control: Use ResolveIdentity() for authorizing in org * Fix tests * Fix middleware tests * Use ResolveIdentity in HasGlobalAccess() function * remove makeTmpUser * Cleanup * Fix linter errors * Fix test build * Remove GetUserPermissionsInOrg()	1 year ago
Jo	5340a6e548	Auth: Extended JWT client for OBO and Service Authentication (#83814 ) * reenable ext-jwt-client * fixup settings struct * add user and service auth * lint up * add user auth to grafana ext * fixes * Populate token permissions Co-authored-by: jguer <joao.guerreiro@grafana.com> * fix tests * fix lint * small prealloc * small prealloc * use special namespace for access policies * fix access policy auth * fix tests * fix uncalled settings expander * add feature toggle * small feedback fixes * rename entitlements to permissions * add authlibn * allow viewing the signed in user info for non user namespace * fix invalid namespacedID * use authlib as verifier for tokens * Update pkg/services/authn/clients/ext_jwt.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/authn/clients/ext_jwt_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix parameter names * change asserts to normal package * add rule for assert * fix ownerships * Local diff * test and lint * Fix test * Fix ac test * Fix pluginproxy test * Revert testdata changes * Force revert on test data --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
Alexander Zobnin	82a88cc83f	Access control: Extend GetUserPermissions() to query permissions in org (#83392 ) * Access control: Extend GetUserPermissions() to query permissions in specific org * Use db query to fetch permissions in org * refactor * refactor * use conditional join * minor refactor * Add test cases * Search permissions correctly in OSS vs Enterprise * Get permissions from memory * Refactor * remove unused func * Add tests for GetUserPermissionsInOrg * fix linter	1 year ago
Gabriel MABILLE	8d9921a5ba	RBAC: Fix delete team permissions on team delete (#83442 ) * RBAC: Remove team permissions on delete * Remove unecessary deletes from store function * Nit on mock * Add test to the database * Nit on comment * Add another test to check that other permissions remain	1 year ago
Gabriel MABILLE	80d6bf6da0	AuthN: Remove embedded oauth server (#83146 ) * AuthN: Remove embedded oauth server * Restore main * go mod tidy * Fix problem * Remove permission intersection * Fix test and lint * Fix TestData test * Revert to origin/main * Update go.mod * Update go.mod * Update go.sum	1 year ago
Alexander Zobnin	9bbb7f67e0	Chore: Move store interface to top level (#83153 ) * Chore: Move store interface to top level * Update store mock	1 year ago
Gabriel MABILLE	846eadff63	RBAC Search: Replace `userLogin` filter by `namespacedID` filter (#81810 ) * Add namespace ID * Refactor and add tests * Rename maxOneOption -> atMostOneOption * Add ToDo * Remove UserLogin & UserID for NamespaceID Co-authored-by: jguer <joao.guerreiro@grafana.com> * Remove unecessary import of the userSvc * Update pkg/services/accesscontrol/acimpl/service.go * fix 1 -> userID * Update pkg/services/accesscontrol/accesscontrol.go --------- Co-authored-by: jguer <joao.guerreiro@grafana.com>	1 year ago
Jo	7852ea012d	Access: Remove split scopes feature toggle (#81874 ) * remove split scopes FT * Revert "remove split scopes FT" This reverts commit `349fb081d3`. * make toggle deprecated instead * fix gen	1 year ago
Gabriel MABILLE	08f305797f	RBAC: Add metric to count search user permissions cache hits (#81451 )	1 year ago
Gabriel MABILLE	722b78f3e0	RBAC: Add userLogin filter to the permission search endpoint (#81137 ) * RBAC: Search add user login filter * Switch to a userService resolving instead * Remove unused error * Fallback to use the cache * account for userID filter * Account for the error * snake case * Add test cases * Add api tests * Fix return on error * Re-order imports	2 years ago
Alexander Zobnin	08082104e1	Access control: Add permissions cache hit/miss metrics (#80883 ) * Access control: Add permissions cache hit/miss metrics * Add metrics to OSS * Fix imports	2 years ago
Gabriel MABILLE	dce9d1e87c	RBAC: Search endpoint support wildcards (#80383 ) * RBAC: Search endpoint support wildcards * Allow wildcard filter with RAM permissions as well	2 years ago
Karl Persson	7b58f71b33	AuthN: Add auth hook that can sync grafana cloud role to rbac cloud role (#80416 ) * AuthnSync: Rename files and structures * AuthnSync: register rbac cloud role sync if feature toggle is enabled * RBAC: Add new sync function to service interface * RBAC: add common prefix and role names for cloud fixed roles * AuthnSync+RBAC: implement rbac cloud role sync Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Gabriel MABILLE	48ff532ca8	RBAC: Add histogram metric on search endpoint (#80553 ) RBAC: Add histogram on search endpoint	2 years ago
Ryan McKinley	1caaa56de0	FeatureFlags: Use interface rather than manager (#80000 )	2 years ago
Alexander Zobnin	959ebf82da	Folders: Show dashboards and folders with directly assigned permissions in "Shared" folder (#78465 ) * Folders: Show folders user has access to at the root level * Refactor * Refactor * Hide parent folders user has no access to * Skip expensive computation if possible * Fix tests * Fix potential nil access * Fix duplicated folders * Fix linter error * Fix querying folders if no managed permissions set * Update benchmark * Add special shared with me folder and fetch available non-root folders on demand * Fix parents query * Improve db query for folders * Reset benchmark changes * Fix permissions for shared with me folder * Simplify dedup * Add option to include shared folder permission to user's permissions * Fix nil UID * Remove duplicated folders from shared list * Folders: Fix fetching empty folder * Nested folders: Show dashboards with directly assigned permissions * Fix slow dashboards fetch * Refactor * Fix cycle dependencies * Move shared folder to models * Fix shared folder links * Refactor * Use feature flag for permissions * Use feature flag * Review comments * Expose shared folder UID through frontend settings * Add frontend type for sharedWithMeFolderUID option * Refactor: apply review suggestions * Fix parent uid for shared folder * Fix listing shared dashboards for users with access to all folders * Prevent creating folder with "shared" UID * Add tests for shared folders * Add test for shared dashboards * Fix linter * Add metrics for shared with me folder * Add metrics for shared with me dashboards * Fix tests * Tests: add metrics as a dependency * Fix access control metadata for shared with me folder * Use constant for shared with me * Optimize parent folders access check, fetch all folders in one query. * Use labels for metrics	2 years ago
Jo	0de66a8099	Authz: Remove use of SignedInUser copy for permission evaluation (#78448 ) * remove use of SignedInUserCopies * add extra safety to not cross assign permissions unwind circular dependency dashboardacl->dashboardaccess fix missing import * correctly set teams for permissions * fix missing inits * nit: check err * exit early for api keys	2 years ago
Ryan McKinley	f69fd3726b	FeatureToggles: Add context and and an explicit global check (#78081 )	2 years ago
Ryan McKinley	3509a5abb9	FeatureFlags: Cleanup usage of cfg.IsFeatureToggleEnabled (#78014 )	2 years ago

1 2

79 Commits (37404446b135d878ade3976bffa71eebe515acdb)