grafana

Commit Graph

Author	SHA1	Message	Date
github-actions[bot]	5e30a9ec08	apply security patch: release-11.6.1/364-202504020728.patch commit 5697757c8006732776de7f4385c2029bb01f67c6 Author: Andres Martinez Gotor <andres.martinez@grafana.com> Date: Mon Mar 31 12:15:52 2025 +0200 Sanitize paths before evaluating access to route	2 months ago
Gabriel MABILLE	f3433fd472	RBAC: Remove accessControlOnCall feature toggle (#101222 ) * RBAC: Remove accessControlOnCall feature toggle * Leave the other one in place * Tests * frontend * Readd empty ft to frontend test * Remove legacy RBAC check * Fix test * no need for context * Remove unused variable * Remove unecessary param * remove unecessary param from tests * More tests :D	4 months ago
Ryan McKinley	680e6bc1f8	Authlib: Use types package rather than claims (#99243 )	5 months ago
Alexander Zobnin	cbb688e910	Zanzana: Remove usage from legacy access control (#98883 ) * Zanzana: Remove usage from legacy access control * remove unused * remove zanzana client from services where it's not used * remove unused metrics * fix linter	6 months ago
Syerikjan Kh	b7809b7350	Fix: Double encoding of URLs when using data proxy (#98494 ) fix: unescape raw path and set to req path	6 months ago
Misi	84b8296ffb	OAuth: Use the attached external session data in OAuthToken and OAuthTokenSync (#96655 ) * wip * wip + tests * wip * wip opt2 * Use authn.Identity struct's SessionToken * Merge fixes * Handle disabling the feature flag correctly * Fix test * Cleanup * Remove HasOAuthEntry from the OAuthTokenService interface * Remove unused function	7 months ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763 )	11 months ago
Ryan McKinley	728150bdbd	Identity: extend k8s user.Info (#90937 )	11 months ago
Kevin Minehart	c326d865c5	RBAC: Allow plugins to use scoped actions (#90946 ) Co-authored-by: gamab <gabriel.mabille@grafana.com>	11 months ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567 )	11 months ago
Alexander Zobnin	87d86e81ce	Zanzana: Evaluate permissions alongside with RBAC engine (#90064 ) * Zanzana: Evaluate permissions if feature flag enabled * Fix tests * adjust logs * fix spelling * remove unused * only evaluate implemented resources * refactor	12 months ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116 )	1 year ago
Marcus Efraimsson	fe3e5917f1	Plugins: Preserve trailing slash in plugin proxy (#86859 ) * Plugins: Preserve trailing slash in plugin proxy * enable toggle by default	1 year ago
Andres Martinez Gotor	60ce523b72	Refactor plugin context initialization (#88343 )	1 year ago
Ryan McKinley	ffc2702552	Plugins: Support Admission validation hooks (#87718 )	1 year ago
Ieva	167151b211	Chore: Remove use of deprecated method in AC code (#87541 ) * switch from using cfg to using featuremgmt for checking a feature toggle in AC code * merge test fixes	1 year ago
Karl Persson	d8fbbdefea	Identity: Use typed namespace id (#87121 ) * Use typed namespace id	1 year ago
Jo	5340a6e548	Auth: Extended JWT client for OBO and Service Authentication (#83814 ) * reenable ext-jwt-client * fixup settings struct * add user and service auth * lint up * add user auth to grafana ext * fixes * Populate token permissions Co-authored-by: jguer <joao.guerreiro@grafana.com> * fix tests * fix lint * small prealloc * small prealloc * use special namespace for access policies * fix access policy auth * fix tests * fix uncalled settings expander * add feature toggle * small feedback fixes * rename entitlements to permissions * add authlibn * allow viewing the signed in user info for non user namespace * fix invalid namespacedID * use authlib as verifier for tokens * Update pkg/services/authn/clients/ext_jwt.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/authn/clients/ext_jwt_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix parameter names * change asserts to normal package * add rule for assert * fix ownerships * Local diff * test and lint * Fix test * Fix ac test * Fix pluginproxy test * Revert testdata changes * Force revert on test data --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
Dan Cech	790e1feb93	Chore: Update test database initialization (#81673 ) * streamline initialization of test databases, support on-disk sqlite test db * clean up test databases * introduce testsuite helper * use testsuite everywhere we use a test db * update documentation * improve error handling * disable entity integration test until we can figure out locking error	1 year ago
Eugene Klimov	702e22806c	Plugins Proxy: Allow using {{ .URL }} inside "routes" section in plugin.json (#80858 ) Signed-off-by: Slach <bloodjazman@gmail.com> Co-authored-by: Andres Martinez Gotor <andres.mgotor@gmail.com>	1 year ago
Andres Martinez Gotor	1dd97301e5	Chore: Adapt GetDataSourcesByType to plugins with aliases (#76637 )	2 years ago
Karl Persson	684d68365e	IDforwarding: forward signed id to plugins (#75651 ) * Plugins: Add client middlware that forwards the signed grafana id token if present * DsProxy: Set grafana id header if id token exists * Add util function to apply id token to header * Only add id forwarding middleware if feature toggle is enabled * Add feature toggles to ds proxy and check if id forwarding is enabled * Clean up test setup * Change to use backend.ForwardHTTPHeaders interface * PluginProxy: Forward signed identity when feature toggle is enabled * PluginProxy: forrward signed id header	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066 )	2 years ago
Jo	fe1563882a	Chore: Port oauth token service to identity requester (#73988 ) * port oauth token service to identity requester * fix broken test * no need to check for render	2 years ago
idafurjes	23c27cffb3	Chore: Rename Id to ID in alerting models (#62777 ) * Chore: Rename Id to ID in alerting models * Add xorm tags for datasource * Add xorm tag for uid	2 years ago
Kristin Laemmert	9256a520a4	chore: move user_auth models to (mostly) login service (#62269 ) * chore: move user_auth models to (mostly) login service	2 years ago
idafurjes	6c5a573772	Chore: Move ReqContext to contexthandler service (#62102 ) * Chore: Move ReqContext to contexthandler service * Rename package to contextmodel * Generate ngalert files * Remove unused imports	2 years ago
Sasha Melentyev	f0adc69ada	Chore: Change fmt.Errorf to errors.New when there is no formatting required (#58600 ) Signed-off-by: Sasha Melentyev <sasha@melentyev.io>	3 years ago
Sofia Papagiannaki	9855e74b92	Chore: Refactor quota service (#58643 ) Chore: Refactor quota service (#57586) * Chore: refactore quota service * Apply suggestions from code review	3 years ago
Sofia Papagiannaki	96cdf77995	Revert "Chore: Refactor quota service (#57586 )" (#58394 ) This reverts commit `326ea86a57`.	3 years ago
Sofia Papagiannaki	326ea86a57	Chore: Refactor quota service (#57586 ) * Chore: refactore quota service * Apply suggestions from code review	3 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087 ) * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago
Misi	9c954d06ab	Auth: Refresh OAuth access_token automatically using the refresh_token (#56076 ) * Verify OAuth token expiration for oauth users in the ctx handler middleware * Use refresh token to get a new access token * Refactor oauth_token.go * Add tests for the middleware changes * Align other tests * Add tests, wip * Add more tests * Add InvalidateOAuthTokens method * Fix ExpiryDate update to default * Invalidate OAuth tokens during logout * Improve logout * Add more comments * Cleanup * Fix import order * Add error to HasOAuthEntry return values * add dev debug logs * Fix tests Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
Guilherme Caulada	f25c7f6ddd	Chore: Refactor secrets kvstore to organize testing and migrations (#54249 ) * Refactor migrations and tests for secrets kvstore * Use fake secrets store as a shortcut on tests * Update wire * Use global migration logger * Fix ds proxy tests * Fix linting issues * Rename data source test setup function	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343 ) * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
Jo	062d255124	Handle ioutil deprecations (#53526 ) * replace ioutil.ReadFile -> os.ReadFile * replace ioutil.ReadAll -> io.ReadAll * replace ioutil.TempFile -> os.CreateTemp * replace ioutil.NopCloser -> io.NopCloser * replace ioutil.WriteFile -> os.WriteFile * replace ioutil.TempDir -> os.MkdirTemp * replace ioutil.Discard -> io.Discard	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Kristin Laemmert	945f015770	backend/datasources: move datasources models into the datasources service package (#51267 ) * backend/datasources: move datasources models into the datasources service pkg	3 years ago
Serge Zaitsev	ae9491c3a7	Chore: Make test tracer noop and return no errors (#50797 )	3 years ago
Marcus Efraimsson	36c3398c6d	Datasource: Remove support for unencrypted passwords (#49987 ) * Datasource: Remove support for unencrypted passwords * regenerate swagger * [WIP] Remove references to datasource password and basic auth password fields (#50015) * try delete moar tings * delete provisioning stuff * remove from yaml * update snapshots * remove lingering snapshot fields * fix ds http settings * Re-generate swagger and fix swagger-api-spec make target Co-authored-by: Will Browne <will.browne@grafana.com> Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Karl Persson	61772a66b6	AccessControl: Create own interface and impl for each permission service (#48871 ) * Create own interfaces for team, folder, dashboard and data source permissions services * Remove service container and inject them individually	3 years ago
Guilherme Caulada	a367ad730c	Secrets: Implement basic unified secret store service (#45804 ) * wip: Implement kvstore for secrets * wip: Refactor kvstore for secrets * wip: Add format key function to secrets kvstore sql * wip: Add migration for secrets kvstore * Remove unused Key field from secrets kvstore * Remove secret values from debug logs * Integrate unified secrets with datasources * Fix minor issues and tests for kvstore * Create test service helper for secret store * Remove encryption tests from datasources * Move secret operations after datasources * Fix datasource proxy tests * Fix legacy data tests * Add Name to all delete data source commands * Implement decryption cache on sql secret store * Fix minor issue with cache and tests * Use secret type on secret store datasource operations * Add comments to make create and update clear * Rename itemFound variable to isFound * Improve secret deletion and cache management * Add base64 encoding to sql secret store * Move secret retrieval to decrypted values function * Refactor decrypt secure json data functions * Fix expr tests * Fix datasource tests * Fix plugin proxy tests * Fix query tests * Fix metrics api tests * Remove unused fake secrets service from query tests * Add rename function to secret store * Add check for error renaming secret * Remove bus from tests to fix merge conflicts * Add background secrets migration to datasources * Get datasource secure json fields from secrets * Move migration to secret store * Revert "Move migration to secret store" This reverts commit `7c3f872072`. * Add secret service to datasource service on tests * Fix datasource tests * Remove merge conflict on wire * Add ctx to data source http transport on prometheus stats collector * Add ctx to data source http transport on stats collector test	3 years ago
Serge Zaitsev	e86b6662a1	Chore: Remove bus.Bus field (#47695 ) * Chore: Remove bus.Bus field * fix integration test	3 years ago
Marcus Efraimsson	4bc582570e	Instrumentation: Proxy status code correction and various improvements (#47473 ) For a proxied request, e.g. Grafana's datasource or plugin proxy: If the request is cancelled, e.g. from the browser, the HTTP status code is now 499 Client closed request instead of 502 Bad gateway. If the request times out, e.g. takes longer time than allowed, the HTTP status code is now 504 Gateway timeout instead of 502 Bad gateway. This also means that request metrics and logs will get their status codes adjusted according to above. Fixes #46337 Fixes #46338	3 years ago
Serge Zaitsev	18e93c7077	Chore: Remove bus (#47511 ) * Chore: Remove bus * remove unused const	3 years ago
Sergey Kostrukov	656ade9884	Shared Azure middleware between Azure Monitor and Prometheus datasources (#46002 ) * Scopes in Azure middleware * Enable Azure middleware without feature flag * Use common Azure middleware in Azure Monitor * Apply feature flag to JsonData configuration of Azure auth * Enforce feature flag in Prometheus datasource * Prometheus provider tests * Datasource service tests * Fix http client provider tests * Pass sdkhttpclient.Options by reference * Add middleware to httpclient.Options * Remove dependency on Grafana settings * Unit-tests updated * Fix ds_proxy_test * Fix service_test	3 years ago
Ezequiel Victorero	c717320942	Adding FGAC annotations validation for creation and deletion (#46736 ) Access Control: Adding FGAC annotations validation for creation and deletion Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	cdc08105c2	Access control: Set default permissions for data sources when using access control (#45482 ) * Rename interfaces and use then with wire injection * Set default permissions when creating new data source	3 years ago
Marcus Efraimsson	6a776c78d4	Datasource: Fixes storing of secureJSONData when creating/updating datasource (#45290 ) Fixes an issue introduced by #44987 where bus dispatch was replaced by calling sqlstore directly instead of the datasource service. Fixes #45273	3 years ago
Dimitris Sotirakis	605d056136	Security: Sync security changes on main (#45083 ) * * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search * Teams: Ensure that users searching for teams are only able see teams they have access to * Teams: Require teamGuardian admin privileges to list team members * Teams: Prevent org viewers from administering teams * Teams: Add org_id condition to team count query * Teams: clarify permission requirements in teams api docs * Teams: expand scenarios for team search tests * Teams: mock teamGuardian in tests Co-authored-by: Dan Cech <dcech@grafana.com> * remove duplicate WHERE statement * Fix for CVE-2022-21702 (cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e) * Lint and test fixes (cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981) * check content type properly (cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98) * basic csrf origin check (cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1) * compare origin to host (cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42) * simplify url parsing (cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d) * check csrf for GET requests, only compare origin (cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709) * parse content type properly (cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0) * mentioned get in the comment (cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345) * add content-type: application/json to test HTTP requests * fix pluginproxy test * Fix linter when comparing errors Co-authored-by: Kevin Minehart <kmineh0151@gmail.com> Co-authored-by: Dan Cech <dcech@grafana.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com>	3 years ago

1 2 3

123 Commits (5e30a9ec0848c10b16baf6615436d5d6557ffb92)