240 Commits (7180f8a7d15a323ca8d0aa0294dc65bab7e6d51c)

Author	SHA1	Message	Date
Alexander Zobnin	87d86e81ce	Zanzana: Evaluate permissions alongside with RBAC engine (#90064) ... * Zanzana: Evaluate permissions if feature flag enabled * Fix tests * adjust logs * fix spelling * remove unused * only evaluate implemented resources * refactor	1 year ago
Marcus Andersson	04f39457cf	Chore: Remove sensitive information from presigned URLs prior to logging (#87035) ... Co-authored-by: Will Browne <wbrowne@users.noreply.github.com> Co-authored-by: Dan Cech <dcech@grafana.com> Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>	2 years ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	2 years ago
Marcus Efraimsson	fe3e5917f1	Plugins: Preserve trailing slash in plugin proxy (#86859) ... * Plugins: Preserve trailing slash in plugin proxy * enable toggle by default	2 years ago
Andres Martinez Gotor	60ce523b72	Refactor plugin context initialization (#88343)	2 years ago
Ryan McKinley	ffc2702552	Plugins: Support Admission validation hooks (#87718)	2 years ago
Aaron Godin	0072e4a92d	Update DS Proxy to use RBAC action (#87517) ... iam-team: Update DS Proxy to use RBAC action	2 years ago
Ieva	167151b211	Chore: Remove use of deprecated method in AC code (#87541) ... * switch from using cfg to using featuremgmt for checking a feature toggle in AC code * merge test fixes	2 years ago
Aaron Godin	0bc8992dfa	Revert #86466 (#87405) ... Revert "Apply plugin route ReqAction to ds_proxy authorization (#86466)" This reverts commit 53f94ac50d.	2 years ago
Karl Persson	d8fbbdefea	Identity: Use typed namespace id (#87121) ... * Use typed namespace id	2 years ago
Aaron Godin	53f94ac50d	Apply plugin route ReqAction to ds_proxy authorization (#86466) ... * Apply plugin route ReqAction to ds_proxy authorization Co-authored-by: Eric Leijonmarck <eleijonmarck@users.noreply.github.com> * fix: move ds_proxy route Evaluator out of plugins pkg * move DataSourceProxy route authorization to method --------- Co-authored-by: Eric Leijonmarck <eleijonmarck@users.noreply.github.com>	2 years ago
Jo	5340a6e548	Auth: Extended JWT client for OBO and Service Authentication (#83814) ... * reenable ext-jwt-client * fixup settings struct * add user and service auth * lint up * add user auth to grafana ext * fixes * Populate token permissions Co-authored-by: jguer <joao.guerreiro@grafana.com> * fix tests * fix lint * small prealloc * small prealloc * use special namespace for access policies * fix access policy auth * fix tests * fix uncalled settings expander * add feature toggle * small feedback fixes * rename entitlements to permissions * add authlibn * allow viewing the signed in user info for non user namespace * fix invalid namespacedID * use authlib as verifier for tokens * Update pkg/services/authn/clients/ext_jwt.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/authn/clients/ext_jwt_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix parameter names * change asserts to normal package * add rule for assert * fix ownerships * Local diff * test and lint * Fix test * Fix ac test * Fix pluginproxy test * Revert testdata changes * Force revert on test data --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Andreas Christou	7c3f621688	Chore: Update grafana-azure-sdk-go (#84741) ... * Update grafana-azure-sdk-go * Update test	2 years ago
Torkel Ödegaard	64e0a4282e	DataQuery: Track panel plugin id not type (#83091)	2 years ago
Dan Cech	790e1feb93	Chore: Update test database initialization (#81673) ... * streamline initialization of test databases, support on-disk sqlite test db * clean up test databases * introduce testsuite helper * use testsuite everywhere we use a test db * update documentation * improve error handling * disable entity integration test until we can figure out locking error	2 years ago
Eugene Klimov	702e22806c	Plugins Proxy: Allow using {{ .URL }} inside "routes" section in plugin.json (#80858) ... Signed-off-by: Slach <bloodjazman@gmail.com> Co-authored-by: Andres Martinez Gotor <andres.mgotor@gmail.com>	2 years ago
Dominik Prokop	f77c831e3f	Data query: Allow logging panel plugin id when executing queries (#81164) ... * Data query: Allo logging panel plugin id when executing queries * Update tracing header middleware * Test fix * Add panelPluginType to query analytics * Cleanup	2 years ago
Marcus Efraimsson	6768c6c059	Chore: Remove public vars in setting package (#81018) ... Removes the public variable setting.SecretKey plus some other ones. Introduces some new functions for creating setting.Cfg.	2 years ago
Karl Persson	147bf01745	IDForwarding: Always forward id tokens to plugins (#81041) ... * Always forward id tokens to plugins	2 years ago
Gabriel MABILLE	6b954165c5	RBAC: Cover plugin routes (#80578) ... * RBAC: Cover plugin routes * Action instead of ReqAction * Fix test initializations * Fix NewPluginProxy call * Duplicate test to add RBAC checks * Cover legacy access control as well * Fix typo * action -> reqAction * Add example Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com> --------- Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>	2 years ago
Ryan McKinley	f69fd3726b	FeatureToggles: Add context and and an explicit global check (#78081)	2 years ago
Karl Persson	1b6d39f823	IDForwarding: Require that id forwarding is enabled for data source (#77131) ... * Require that id forwarding is enabled for data source * Address feedback	2 years ago
Alexander Zobnin	cad3c43bb1	Team LBAC: Move middleware to enterprise (#76969) ... * Team LBAC: Move middleware to enterprise * Remove ds proxy part * Move utils to enterprise	2 years ago
Eric Leijonmarck	be5ba68132	Team LBAC: Add `teamHeaders` for datasource proxy requests (#76339) ... * Add teamHeaders for datasource proxy requests * adds validation for the teamHeaders * added tests for applying teamHeaders * remove previous implementation * validation for header values being set to authproxy * removed unnecessary checks * newline * Add middleware for injecting headers on the data source backend * renamed feature toggle * Get user teams from context * Fix feature toggle name * added test for validation of the auth headers and fixed evaluation to cover headers * renaming of teamHeaders to teamHTTPHeaders * use of header set for non-existing header and add for existing headers * moves types into datasources * fixed unchecked errors * Refactor * Add tests for data model * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> Co-authored-by: Victor Cinaglia <victor@grafana.com>	2 years ago
Andres Martinez Gotor	1dd97301e5	Chore: Adapt GetDataSourcesByType to plugins with aliases (#76637)	2 years ago
Marcus Efraimsson	e4c1a7a141	Tracing: Standardize on otel tracing (#75528)	2 years ago
Karl Persson	684d68365e	IDforwarding: forward signed id to plugins (#75651) ... * Plugins: Add client middlware that forwards the signed grafana id token if present * DsProxy: Set grafana id header if id token exists * Add util function to apply id token to header * Only add id forwarding middleware if feature toggle is enabled * Add feature toggles to ds proxy and check if id forwarding is enabled * Clean up test setup * Change to use backend.ForwardHTTPHeaders interface * PluginProxy: Forward signed identity when feature toggle is enabled * PluginProxy: forrward signed id header	2 years ago
Marcus Efraimsson	8ee43f3705	Instrumentation: Add status_source label to request metrics/logs (#74114) ... Ref #68480 Co-authored-by: Giuseppe Guerra <giuseppe.guerra@grafana.com>	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066)	2 years ago
Jo	fe1563882a	Chore: Port oauth token service to identity requester (#73988) ... * port oauth token service to identity requester * fix broken test * no need to check for render	2 years ago
Sergey Kostrukov	eafba8fa69	Azure: Configuration for user identity authentication in datasources (Experimental) (#50277) ... * Configuration for user identity authentication * Use token endpoint form Azure AD settings * Documentation update * Update Grafana Azure SDK * Fix secret override * Fix lint * Fix doc wording	3 years ago
Will Browne	94f39e69a3	Plugins: Migrate `plugincontext`, `adapters` and `pluginsettings` to pkg/services/pluginsintegration package (#64154) ... * migrate plugincontext, adapter and pluginsettings * add to CODEOWNERS * fix imports * fix CODEOWNERS * take pluginsettings * migrate wire stuff	3 years ago
zhichli	3c218d742f	Datasources: Add user_agent header customization for outgoing HTTP requests (#63769)	3 years ago
idafurjes	23c27cffb3	Chore: Rename Id to ID in alerting models (#62777) ... * Chore: Rename Id to ID in alerting models * Add xorm tags for datasource * Add xorm tag for uid	3 years ago
Will Browne	317f044e70	Plugins: Ensure proxy route bodies are valid JSON (#61771) ... ensure proxy route bodies are valid JSON	3 years ago
Kristin Laemmert	9256a520a4	chore: move user_auth models to (mostly) login service (#62269) ... * chore: move user_auth models to (mostly) login service	3 years ago
idafurjes	6c5a573772	Chore: Move ReqContext to contexthandler service (#62102) ... * Chore: Move ReqContext to contexthandler service * Rename package to contextmodel * Generate ngalert files * Remove unused imports	3 years ago
Marcus Efraimsson	6478d0a5ef	Plugins: Forward user header (X-Grafana-User) in backend plugin requests (#58646) ... Grafana would forward the X-Grafana-User header to backend plugin request when dataproxy.send_user_header is enabled. In addition, X-Grafana-User will be automatically forwarded in outgoing HTTP requests for core/builtin HTTP datasources. Use grafana-plugin-sdk-go v0.147.0. Fixes #47734 Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Sasha Melentyev	f0adc69ada	Chore: Change fmt.Errorf to errors.New when there is no formatting required (#58600) ... Signed-off-by: Sasha Melentyev <sasha@melentyev.io>	3 years ago
Sofia Papagiannaki	9855e74b92	Chore: Refactor quota service (#58643) ... Chore: Refactor quota service (#57586) * Chore: refactore quota service * Apply suggestions from code review	3 years ago
Sofia Papagiannaki	96cdf77995	Revert "Chore: Refactor quota service (#57586)" (#58394) ... This reverts commit 326ea86a57.	3 years ago
Sofia Papagiannaki	326ea86a57	Chore: Refactor quota service (#57586) ... * Chore: refactore quota service * Apply suggestions from code review	3 years ago
Marcus Efraimsson	6f8fcae01b	[main] Plugin fixes (#57399) ... * Plugins: Remove support for V1 manifests * Plugins: Make proxy endpoints not leak sensitive HTTP headers * Security: Fix do not forward login cookie in outgoing requests (cherry picked from commit 4539c33fce) Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087) ... * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago
Misi	9c954d06ab	Auth: Refresh OAuth access_token automatically using the refresh_token (#56076) ... * Verify OAuth token expiration for oauth users in the ctx handler middleware * Use refresh token to get a new access token * Refactor oauth_token.go * Add tests for the middleware changes * Align other tests * Add tests, wip * Add more tests * Add InvalidateOAuthTokens method * Fix ExpiryDate update to default * Invalidate OAuth tokens during logout * Improve logout * Add more comments * Cleanup * Fix import order * Add error to HasOAuthEntry return values * add dev debug logs * Fix tests Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
Marcus Efraimsson	862a6a2fa6	Logging: Introduce API for contextual logging (#55198) ... Introduces a FromContext method on the log.Logger interface that allows contextual key/value pairs to be attached, e.g. per request, so that any logger using this API will automatically get the per request context attached. The proposal makes the traceID available for contextual logger , if available, and would allow logs originating from a certain HTTP request to be correlated with traceID. In addition, when tracing not enabled, skip adding traceID=00000000000000000000000000000000 to logs.	3 years ago
Guilherme Caulada	f25c7f6ddd	Chore: Refactor secrets kvstore to organize testing and migrations (#54249) ... * Refactor migrations and tests for secrets kvstore * Use fake secrets store as a shortcut on tests * Update wire * Use global migration logger * Fix ds proxy tests * Fix linting issues * Rename data source test setup function	3 years ago
Marcus Efraimsson	e6857bf17d	Plugins: Handle app plugin proxy routes per request (#51835) ... Fixes #47530	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343) ... * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
Jo	062d255124	Handle ioutil deprecations (#53526) ... * replace ioutil.ReadFile -> os.ReadFile * replace ioutil.ReadAll -> io.ReadAll * replace ioutil.TempFile -> os.CreateTemp * replace ioutil.NopCloser -> io.NopCloser * replace ioutil.WriteFile -> os.WriteFile * replace ioutil.TempDir -> os.MkdirTemp * replace ioutil.Discard -> io.Discard	3 years ago