9 Commits (4d49cc31185e7085a289bba7f3263db47033ddd5)

Author	SHA1	Message	Date
Yuri Tseretyan	06d5850396	Alerting: Update alerting state history API to authorize access using RBAC (#89579) ... * add method CanReadAllRules to rule authorization service * add alias type Namespace for Folder in ngalert's models package. It implements the Namespacer interface that is used by authz logic * update state history's backends to authorize access to rules. * update Loki to add folders UIDs to query. * Update BuildLogQuery to drop filter by folders if it's too long and fall back to in-memory filtering.	11 months ago
Yuri Tseretyan	92f10b73a8	Alerting: Move interface Namespaced from accesscontrol to models package (#89439) ... move Namespaced interface from accesscontrol to models	11 months ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	11 months ago
Matthew Jacobson	8418aca823	Alerting: Add single rule checks to alert rule access control (#88307) ... * Alerting: Add single rule checks to alert rule access control Modifies ruler api single rule read to no longer fetch entire groups and instead use the new single rule ac check. Simplifies provisioning api getAlertRuleAuthorized logic to always load a single rule instead of conditionally loading the entire group when provisioning permissions are not present. * Swap out Has/AuthorizeAccessToRule for Has/AuthorizeAccessInFolder	12 months ago
William Wernert	006d0021e3	Alerting: Remove requirement for datasource query on rule read (#87349) ... * Remove requirement for datasource query for rule read * Address PR comments	1 year ago
Yuri Tseretyan	509691b416	Alerting: Introduce authorization logic for operations on silences (#85418) ... * extract genericService from RuleService just to reuse it later * implement silence service --------- Co-authored-by: William Wernert <william.wernert@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	1 year ago
Yuri Tseretyan	e593d36ed8	Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289) ... * require "folders:read" and "alert.rules:read" in all rules API requests (write and read). * add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup * check only access to datasource in rule testing API --------- Co-authored-by: William Wernert <william.wernert@grafana.com>	1 year ago
Yuri Tseretyan	64feeddc23	Alerting: Update rule access control to return errutil errors (#78284) ... * update rule access control to return errutil errors * use alerting in msgID	1 year ago
Yuri Tseretyan	7cec741bae	Alerting: Extract alerting rules authorization logic to a service (#77006) ... * extract alerting authorization logic to separate package * convert authorization logic to service	2 years ago