grafana

Commit Graph

Author	SHA1	Message	Date
Karl Persson	718612aabf	Zanzana: Update relation names (#97638 ) * Update relation names to match k8s verbs * Only check namespace if relation is valid * Only list for valid relations	6 months ago
Alexander Zobnin	cd7772204e	Zanzana: Handle renderer service authorization requests (#97201 ) * Zanzana: Handle renderer service authorization requests * only add context if render service is authorizing * use group and resource from API definitions * check prefix instead of full identity * fix AddRenderContext * remove unused type	6 months ago
Alexander Zobnin	c8caf787d4	Zanzana: handle service accounts (#97123 ) * add service account to the schema * sync managed permissions for service accounts * sync SA basic roles * sync SA roles * Fix endless loop in reconciler while read openfga	6 months ago
Alexander Zobnin	5a91ab46af	Zanzana: Use StreamedListObjects to fetch full list of resources (#97025 ) * Initial streamed version of list * instantiate openfga client to use StreamedListObjects * Add config option for using streamed version * Use caching * fix cache init * Fix hashing * refactor	6 months ago
Karl Persson	be54c69fd4	Zanzana: Remove create relation from generic resources (#97042 ) Remove create relation from generic resources. We cant have a create relation to a resource because they don't exist yet. So in oder to check create we either have to have that permissions on a folder or the namespace	6 months ago
Ryan McKinley	f6ccf976e5	UnifiedSearch: Use ResourceIndex from dashboards apiserver (v0alpha1 only) (#96939 )	6 months ago
Alexander Zobnin	170e0e1813	Zanzana: List then search implementation (#96705 ) * Zanzana: Search with list * Allow to pass werb into list request * split list search into 2 functions * fix listing resources * remove unused * refactor * remove unused function * Add more logging to reconciler * Fix search for users with access to all resources * fix findFoldersZanzanaList * search for folders as well by default * refactor * use compile for list and search * remove list from client * remove only from client * remove list from interface * run compile once * refactor * refactor * add search tests * fix tests * Fix linter	6 months ago
Gabriel MABILLE	6d77c0e187	AuthZ client: Add tracing (#96983 ) * AuthZ client: Add tracing * InProc as well	6 months ago
Gabriel MABILLE	3c876f0208	AuthZ: Introduce cloud mode (#96922 ) * AuthZ: Introduce cloud mode * Update readme	6 months ago
Karl Persson	a5e743895b	Zanzana: Capabilities api (#96682 ) * Add capabilities api	6 months ago
Gabriel MABILLE	aa2b4751a0	AuthZ: Launch service within IAM app (#96421 )	6 months ago
Karl Persson	11a4a366c6	Zanzana: Optimize batch check (#96669 ) * Restructure check code so we only check namespace access once for each GroupResource during for batch	6 months ago
Georges Chaudy	e270412dbf	unistore: wire the authz client (#96632 ) * unistore: wire the authz client * rename dashboards.grafana.app into dashboard.grafana.app * wire the authz client * wire the authz client * resuse the Standalone constructor * configure default migration for resource folder * add tests * cleanup * add logging	6 months ago
Alexander Zobnin	1366197522	Zanzana: Search with check server side (#96268 ) * pass zclient into dashboard service * Search then check implementation * Use GetNamespace() for user * remove unused orgID * simple batch check * refactor * add tests * fix batchCheckItem * client implements batch check * use batch check in search * remove unused * remove All field from response * refactor: extract checkNamespace * fix search result uniqueness * comment fix * Apply suggestions from code review Co-authored-by: Karl Persson <kalle.persson@grafana.com> * refactor * cleanup * remove unnecessary check * fix tests * fix protobuf def * Fix query page * fix type --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com>	6 months ago
Karl Persson	1f34096fdf	Zanzana: reconcile basic roles and bindings (#96473 ) * Add reconciler for basic roles * Add reconciler for basic role bindings	7 months ago
Karl Persson	7e38fd733b	Zanzana: Lazy load cached store info (#96452 ) * Lazy load cached store infos	7 months ago
Karl Persson	5115247818	Zanana: Fix list test (#96401 ) Fix: List operation are not guaranteed to respond in a certain order	7 months ago
Karl Persson	ae95a6158f	Zanana: Remove opefga from client and implement compile (#96275 ) Zanana: Remove opefga from client and implement Compile	7 months ago
Gabriel MABILLE	cc9cdbe82d	Authz: Move extension proto up a layer (#96254 ) * Authz: Move extension proto up a layer * Lint	7 months ago
Alexander Zobnin	b1fb581ab1	Zanzana: Evaluate access with Check request (server-side) (#96213 ) * Zanzana: Evaluate access with Check request (server-side) * Pass parent folder for checking access * Review suggestions * remove fixme comment	7 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205 ) * Special handling for zanzana reconciliation if stack id is configured * remove sync call	7 months ago
Karl Persson	acf119a12c	Zanzana: resource sets on folder grants read on all children (#96127 ) * resource sets on folder grants read on all children * remove comment * Add type for consistency	7 months ago
Alexander Zobnin	910ec7e7dc	Zanzana: Use separate store for each org (#96015 ) * Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter	7 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019 ) * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	7 months ago
Zoltán Bedi	85c696c4ad	SQL: Add macro support in select case (#88514 ) * Feat: timeGroup macro handling in VQB * Add tests * Add functions to SQL ds * Fix lint errors * Add feature toggle * Add rendering based on object * Fix lint * Fix CI failures * Fix tests * Address review comments * Add docs * Fix JSX runtime warnings * Remove docs part that mentions suggest more macros * Update docs/sources/shared/datasources/sql-query-builder-macros.md Co-authored-by: Jack Baldry <jack.baldry@grafana.com> * Add smoke test for this feature * lint * Add supported macros to influx * Add setupTests.ts to include in tsconfig.json * Import jest-dom instead of setupTests.ts --------- Co-authored-by: Jack Baldry <jack.baldry@grafana.com>	7 months ago
owensmallwood	0eb7b755e2	Unified Storage Indexer: Add integration tests (#95687 ) * indexer integration tests WIP * make protobuf * Adds a few more integration test cases to cover the basics. Use Limit instead of Size param from SearchRequest. * skip if testing.Short() * adds test comments	7 months ago
Karl Persson	dfa8f786d2	Zanzana: fix generic schema (#95648 ) * Change schema so that resource checks on a folder walks the tree	7 months ago
Karl Persson	e0163c93c2	Zanzana: reconcile generic schema (#95492 ) * Rename to CheckObject * Implement authz.AccessClient * Move folder tree to reconciler and use new schema * Move shared functionality to common package * Add reconciler for managed permissions and resource translations * Add support for folder resources	7 months ago
Gabriel MABILLE	2788817107	AuthZ: Implement Check (#95162 ) * AuthZ: Implement Check --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	7 months ago
Karl Persson	bdbe12e980	Zanzana: Implement initial check and list with schema for generic resources (#95056 ) * Implement initial check with schema for generic resources * Implement List and add tests * Add namespace type and change to folder_resource name * Handle namespace grants for typed resources * Run tests as integration tests * Add support for verb in list requests	7 months ago
Karl Persson	beaac3c885	Zanzana: Remove model and store initiation from client (#95328 ) * Remove model and store initiation from client	7 months ago
Alexander Zobnin	e709de603d	Chore: Init auth model on server side (#95142 ) * Chore: Init auth model on server side * fix linter	7 months ago
Gabriel MABILLE	0704ae734f	AuthZ: Refactor authentication modes for the Authz package (#95120 ) * AuthZ: Fix authentication modes for the Authz package Co-Authored-By: Claudiu Dragalina-Paraipan <drclau@users.noreply.github.com>	7 months ago
Karl Persson	b4366ebed2	Zanzana: bootstrap authz server (#95036 ) Bootstrap authz extended server	7 months ago
Alexander Zobnin	2baf4883cc	Zanzana: add action sets to dashboard and folder schema (#94602 )	7 months ago
Karl Persson	a82d01214d	Auth: Update authlib (#94947 ) * Update authlib	7 months ago
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752 ) * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	8 months ago
Alexander Zobnin	9f1b584c85	Chore: Update authlib version (#94714 ) * Chore: Update authlib version * update workspace * use ParseNamespace()	8 months ago
Alexander Zobnin	fcfa4aa777	Zanzana: Add config options for Check and ListObjects queries (#94619 ) * Zanzana: Add config options for Check and ListObjects queries * remove fixme * pass only zanzana settings	8 months ago
Alexander Zobnin	e642e1a804	Zanzana: Pass parent folder for the checks in search queries (#94541 ) * Pass parent folder as a contextual tuple in Check request * Search by listing folders and dashboards * skip dashboards listing if limit reached * remove unused * add some comments * only add ContextualTuples if parent provided * Remove parent relation for dashboards from schema and perform separate checks	8 months ago
Karl Persson	9ece88d585	Zanzana: bump openfga version (#94485 ) * Bump openfga * Remove internall sqlite implementation for openfga * Use sqlite implementation from openfga	8 months ago
Alexander Zobnin	5d724c2482	Zanzana: Initial dashboard search (#93093 ) * Zanzana: Search in a background and compare results * refactor * Search with check * instrument zanzana client * add single_read option * refactor * refactor move check into separate function * Fix tests * refactor * refactor getFindDashboardsFn * add resource type to span attributes * run ListObjects concurrently * Use list and search in less cases * adjust metrics buckets * refactor: move Check and ListObjects to AccessControl implementation * Revert "Fix tests" This reverts commit `b0c2f072a2`. * refactor: use own types for Check and ListObjects inside accesscontrol package * Fix search scenario with low limit and empty query string * more accurate search with checks * revert * fix linter * Revert "revert" This reverts commit `ee5f14eea8`. * add search errors metric * fix query performance under some conditions * simplify check strategy * fix pagination * refactor findDashboardsZanzanaList * Iterate over multiple pages while making check request * refactor listUserResources * avoid unnecessary db call * remove unused zclient * Add notes for SkipAccessControlFilter * use more accurate check loop * always use check for search with provided UIDs * rename single_read to zanzana_only_evaluation * refactor * update go workspace * fix linter * don't use deprecated fields * refactor * fail if no org specified * refactor * initial integration tests * Fix tests * fix linter errors * fix linter * Fix tests * review suggestions Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix limit * refactor * refactor tests * fix db config in tests * fix migrator (postgres) --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	8 months ago
Charandas	af2e79aa83	K8s: namespace mapper should use authlib's util (#92332 )	9 months ago
Alexander Zobnin	0e0c877609	Zanzana: Model fixed roles as a part of schema (#92364 ) * model fixed roles for dashboards and folders * Correctly translate fixed role assignments * minor refactor * assign fixed roles to teams * fix linter errors * Migrate general folder permissions for fixed roles * fix dashboards:create permission	9 months ago
Dave Henderson	df3d8915ba	Chore: Bump Go to 1.23.0 (#92105 ) * chore: Bump Go to 1.23.0 Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * update swagger files Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * chore: update .bingo/README.md formatting to satisfy prettier Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * chore(lint): Fix new lint errors found by golangci-lint 1.60.1 and Go 1.23 Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * keep golden file * update openapi * add name to expected output * chore(lint): rearrange imports to a sensible order Signed-off-by: Dave Henderson <dave.henderson@grafana.com> --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Ryan McKinley <ryantxu@gmail.com>	9 months ago
Alexander Zobnin	87c4f2448c	Zanzana: Use modular schema (#92001 ) * Zanzana: Use modular schema * Fix tests * Add module transform tests	9 months ago
Alexander Zobnin	aaf33c7923	Zanzana: Migrate basic, fixed and custom roles (#91814 ) * Zanzana: Migrate basic roles permissions * add basic roles assignments * refactor * Sync basic roles permissions in all orgs * migrate fixed roles * map root folders to orgs * fix basic role assignments in orgs * migrate other roles * migrate team roles assignments * add notes about authorization schema * don't migrate fixed roles	10 months ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801 ) * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	10 months ago
Ryan McKinley	243c0935fc	Auth: Use claims.AuthInfo in requester (#91739 )	10 months ago
Alexander Zobnin	1cc438a56c	Zanzana: Evaluate dashboard and folder permissions (#91539 ) * Zanzana: basic folder permissions checks * Fix managed permissions for teams * fix sync batch size * add dashboards actions translations * migrate folder tree * migrate dashboard folders * remove action sets from schema * Adding more dashboard and folder-related permissions * refactor * Correctly translate dashboard permissions in folders * fix dashboard parent permissions	10 months ago

1 2

67 Commits (718612aabf37799a081dc81a77f6d4f91486a1a6)