171 Commits (750b094dda2149f844da8fedc62a8a320376abfc)

Author	SHA1	Message	Date
Mariell Hoversholm	750b094dda	[release-10.4.18] Go: Bump to 1.24.2 (#103531) ... * Go: Bump to 1.24.2 * CI: Update golangci-lint * feat: update swagger * fix: more lints * fix: lints	3 months ago
Ryan McKinley	1caaa56de0	FeatureFlags: Use interface rather than manager (#80000)	1 year ago
Alexander Zobnin	043096d652	Team LBAC: Limit access to data source (#78376) ... * Team LBAC: Limit access to data source * Fix tests	2 years ago
Ryan McKinley	f69fd3726b	FeatureToggles: Add context and and an explicit global check (#78081)	2 years ago
Eric Leijonmarck	c13fd62b16	Team LBAC: Add permission check for Update datasource (#77709) ... * add permission check for updating the LBAC Rules * permission scoped for id in the updating datasource * fixed test to cover for permissions * fix proper check for permissions and empty teamHTTPHeader requests * check for jsondata * check nil for jsondata inside the getEncodedString	2 years ago
Alexander Zobnin	225a69ba02	Team LBAC: Fix backend validation (#77612) ... * Team LBAC: Fix backend validation * more tests * use slices.ContainsFunc()	2 years ago
Eric Leijonmarck	57335cb173	Team LBAC: Add validation/regex of teamheaders (#76905) ... * add validation of team header values w. regex * apply valid headers * refactor testcases to account for badly formatted json * refactoring to move validation code close to the validation itself * removed tes * Update pkg/api/datasources_test.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Update pkg/api/datasources.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * review comments * review during pairing --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	2 years ago
Eric Leijonmarck	17fe1d3fc7	Team LBAC: Refactor to use only the teamHeader json part (#76756) ... * refactor: to check for feature toggle and for checking for jsonData field * fix tests * whitelisting of X-Prom-Label-Policy Header	2 years ago
Eric Leijonmarck	be5ba68132	Team LBAC: Add `teamHeaders` for datasource proxy requests (#76339) ... * Add teamHeaders for datasource proxy requests * adds validation for the teamHeaders * added tests for applying teamHeaders * remove previous implementation * validation for header values being set to authproxy * removed unnecessary checks * newline * Add middleware for injecting headers on the data source backend * renamed feature toggle * Get user teams from context * Fix feature toggle name * added test for validation of the auth headers and fixed evaluation to cover headers * renaming of teamHeaders to teamHTTPHeaders * use of header set for non-existing header and add for existing headers * moves types into datasources * fixed unchecked errors * Refactor * Add tests for data model * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> Co-authored-by: Victor Cinaglia <victor@grafana.com>	2 years ago
Jo	8919cafcb4	Identity: Unfurl UserID and Email in pkg/api to user identity.Requester (#76112) ... * Unfurl OrgRole in pkg/api to allow using identity.Requester interface * Unfurl Email in pkg/api to allow using identity.Requester interface * Update UserID in pkg/api to allow using identity.Requester interface * fix authed test * fix datasource tests * guard login * fix preferences anon testing * fix anonymous index rendering * do not error with user id 0	2 years ago
Jo	729dafaff9	Auth: Unfurl OrgID in pkg/api to allow using identity.Requester interface (#76108) ... Unfurl OrgID in pkg/api to allow using identity.Requester interface	2 years ago
Andres Martinez Gotor	ece94b1e01	Chore: Remove plugincontext.ErrPluginNotFound (#74997)	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066)	2 years ago
Ieva	6885b3d577	Chore: remove checks for whether RBAC is disabled (#73812) ... * remove checks for whether access control is disabled, as it is always enabled now * linting	2 years ago
Ieva	ec9c35fae5	Chore: clean up access control for data sources (#73010) ... * move DS guardian interfaces to OSS, move allow guardian to OSS * update codeowner file	2 years ago
Kousik Mitra	60496fbae3	Chore: Return correct error for name taken and validation error on add/update datasource (#70465)	2 years ago
Will Browne	624777258b	Plugins: Refactor creation of plugin context to dedicated service (#66451) ... * first pass * fix tests * return errs * change signature * tidy * delete unnecessary fields from test * tidy * fix tests * simplify * separate error check in API * apply nits	2 years ago
Ryan McKinley	422684d8b0	Plugins: Support changing plugin IDs (hardcoded) (#67867)	2 years ago
Jean-Philippe Quéméner	42cdec369d	Datasources: provide generic function to extract custom headers (#66738)	2 years ago
Michael Mandrus	5626461b3c	Caching: Refactor enterprise query caching middleware to a wire service (#65616) ... * define initial service and add to wire * update caching service interface * add skipQueryCache header handler and update metrics query function to use it * add caching service as a dependency to query service * working caching impl * propagate cache status to frontend in response * beginning of improvements suggested by Lean - separate caching logic from query logic. * more changes to simplify query function * Decided to revert renaming of function * Remove error status from cache request * add extra documentation * Move query caching duration metric to query package * add a little bit of documentation * wip: convert resource caching * Change return type of query service QueryData to a QueryDataResponse with Headers * update codeowners * change X-Cache value to const * use resource caching in endpoint handlers * write resource headers to response even if it's not a cache hit * fix panic caused by lack of nil check * update unit test * remove NONE header - shouldn't show up in OSS * Convert everything to use the plugin middleware * revert a few more things * clean up unused vars * start reverting resource caching, start to implement in plugin middleware * revert more, fix typo * Update caching interfaces - resource caching now has a separate cache method * continue wiring up new resource caching conventions - still in progress * add more safety to implementation * remove some unused objects * remove some code that I left in by accident * add some comments, fix codeowners, fix duplicate registration * fix source of panic in resource middleware * Update client decorator test to provide an empty response object * create tests for caching middleware * fix unit test * Update pkg/services/caching/service.go Co-authored-by: Arati R. <33031346+suntala@users.noreply.github.com> * improve error message in error log * quick docs update * Remove use of mockery. Update return signature to return an explicit hit/miss bool * create unit test for empty request context * rename caching metrics to make it clear they pertain to caching * Update pkg/services/pluginsintegration/clientmiddleware/caching_middleware.go Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> * Add clarifying comments to cache skip middleware func * Add comment pointing to the resource cache update call * fix unit tests (missing dependency) * try to fix mystery syntax error * fix a panic * Caching: Introduce feature toggle to caching service refactor (#66323) * introduce new feature toggle * hide calls to new service behind a feature flag * remove licensing flag from toggle (misunderstood what it was for) * fix unit tests * rerun toggle gen --------- Co-authored-by: Arati R. <33031346+suntala@users.noreply.github.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>	2 years ago
Will Browne	94f39e69a3	Plugins: Migrate `plugincontext`, `adapters` and `pluginsettings` to pkg/services/pluginsintegration package (#64154) ... * migrate plugincontext, adapter and pluginsettings * add to CODEOWNERS * fix imports * fix CODEOWNERS * take pluginsettings * migrate wire stuff	2 years ago
suntala	49b3027049	Chore: Remove Result field from datasources (#63048) ... * Remove Result field from AddDataSourceCommand * Remove DatasourcesPermissionFilterQuery Result * Remove GetDataSourceQuery Result * Remove GetDataSourcesByTypeQuery Result * Remove GetDataSourcesQuery Result * Remove GetDefaultDataSourceQuery Result * Remove UpdateDataSourceCommand Result	2 years ago
idafurjes	23c27cffb3	Chore: Rename Id to ID in alerting models (#62777) ... * Chore: Rename Id to ID in alerting models * Add xorm tags for datasource * Add xorm tag for uid	2 years ago
idafurjes	6c5a573772	Chore: Move ReqContext to contexthandler service (#62102) ... * Chore: Move ReqContext to contexthandler service * Rename package to contextmodel * Generate ngalert files * Remove unused imports	2 years ago
Marcus Efraimsson	6dbe3b555f	Plugins: Refactor forward of cookies, OAuth token and header modifications by introducing client middlewares (#58132) ... Adding support for backend plugin client middlewares. This allows headers in outgoing backend plugin and HTTP requests to be modified using client middlewares. The following client middlewares added: Forward cookies: Will forward incoming HTTP request Cookies to outgoing plugins.Client and HTTP requests if the datasource has enabled forwarding of cookies (keepCookies). Forward OAuth token: Will set OAuth token headers on outgoing plugins.Client and HTTP requests if the datasource has enabled Forward OAuth Identity (oauthPassThru). Clear auth headers: Will clear any outgoing HTTP headers that was part of the incoming HTTP request and used when authenticating to Grafana. The current suggested way to register client middlewares is to have a separate package, pluginsintegration, responsible for bootstrap/instantiate the backend plugin client with middlewares and/or longer term bootstrap/instantiate plugin management. Fixes #54135 Related to #47734 Related to #57870 Related to #41623 Related to #57065	3 years ago
Ieva	a8bae3f0b0	Access Control: Clear user's permission cache after resource creation (#59101) ... * refresh user's permission cache after resource creation * clear the cache instead of reloading the permissions * don't error if can't clear cache * fix tests * fix tests again	3 years ago
Marcus Efraimsson	6f8fcae01b	[main] Plugin fixes (#57399) ... * Plugins: Remove support for V1 manifests * Plugins: Make proxy endpoints not leak sensitive HTTP headers * Security: Fix do not forward login cookie in outgoing requests (cherry picked from commit 4539c33fce) Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Ieva	6d5bdf12e8	resolve merge conflicts (#55503)	3 years ago
Sofia Papagiannaki	950715b255	API: Do not expose user input in datasource error responses (#53483)	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343) ... * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445) ... * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Sofia Papagiannaki	87004cc22d	API: Do not expose user input in datasource error responses (#52992)	3 years ago
Sofia Papagiannaki	7ba076de10	Chore: Move swagger definitions to the handlers (#52643)	3 years ago
Michael Mandrus	9aa6ce2a50	Datasource: Propagate datasource secret decryption errors to the frontend (#52068) ... * update decrypt secrets function signature and add secrets error handling * remove a couple instances of unnecessary logging since errors are properly handled now * add unit test * fix linting issues	3 years ago
Kristin Laemmert	945f015770	backend/datasources: move datasources models into the datasources service package (#51267) ... * backend/datasources: move datasources models into the datasources service pkg	3 years ago
Michael Mandrus	c043a8818a	Secrets: add better error handling for secret plugin failures when updating datasources (#50542) ... * Add protobuf config and generated code, and client wrapper * wire up loading of secretsmanager plugin, using renderer plugin as a model * update kvstore provider to check if we should use the grpc plugin. return false always in OSS * add OSS remote plugin check * refactor wire gen file * log which secrets manager is being used * Fix argument types for remote checker * Turns out if err != nil, then the result is always nil. Return empty values if there is an error. * remove duplicate import * ensure atomicity by adding secret management as a step to sql operations and rolling back if necessary * Update pkg/services/secrets/kvstore/kvstore.go Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> * Update pkg/services/secrets/kvstore/kvstore.go Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> * refactor RemotePluginCheck interface to just return the Plugin client directly * rename struct to something less silly * add special error handling for remote secrets management * switch to errors.as instead of type inference * remove unnecessary rollback call * just declare error once * refactor .proto file according to prior PR suggestions * re-generate protobuf files and fix compilation errors * only wrap (ergo display in the front end) errors that are user friendly from the plugin * rename error type to suggest user friendly only * rename plugin functions to be more descriptive * change delete message name * Revert "change delete message name" This reverts commit 8ca978301e. * Revert "rename plugin functions to be more descriptive" This reverts commit 4355c9b9ff. * fix pointer to pointer problem * change plugin user error to just hold a string * fix sequencing problem with datasource updates * clean up some return statements * need to wrap multiple transactions with the InTransaction() func in order to keep the lock * make linter happy * revert input var name Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>	3 years ago
Karl Persson	7fad8d6171	RBAC: Move datasource access check to middleware (#50430) ... * Add datasource scopes to auth middleware * Remove filter call from handlers, permission check is done by auth middleware	3 years ago
Marcus Efraimsson	36c3398c6d	Datasource: Remove support for unencrypted passwords (#49987) ... * Datasource: Remove support for unencrypted passwords * regenerate swagger * [WIP] Remove references to datasource password and basic auth password fields (#50015) * try delete moar tings * delete provisioning stuff * remove from yaml * update snapshots * remove lingering snapshot fields * fix ds http settings * Re-generate swagger and fix swagger-api-spec make target Co-authored-by: Will Browne <will.browne@grafana.com> Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Marcus Efraimsson	a7813275a5	Plugins: Support headers field for check health (#49930)	3 years ago
Sofia Papagiannaki	be0d043673	API: Add endpoint for updating a data source by its UID (#49396) ... * API: Add endpoint for updating a data source by UID * Update docs markdown * Update swagger * Apply suggestions from code review Co-authored-by: Selene <selenepinillos@gmail.com>	3 years ago
Sofia Papagiannaki	6bb843bd0e	API: Introduce health and resources data source endpoints using the data source UID (#48676) ... * API: introduce health and resources datasource endpoints with UID * Document endpoints * Update swagger	3 years ago
Will Browne	f135a5c8a4	Plugins: Refactor plugin resource call with and without data source (#48754) ... * refactor plugin resource call with/without ds * check err * fix imports * only validate req on ds path * Update warn log Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>	3 years ago
Guilherme Caulada	2533f21015	DataSource: Fix secure json data reset on datasource update (#48557) ... * Fix secure json data reset on datasource update * Update fillWithSecureJSONData to use DecryptedValues * Remove unecessary conversion * Move fillWithSecureJsonData logic to datasource service * Add sanity check for nil secure json data	3 years ago
Guilherme Caulada	53e9bf47db	Secrets: Implement tests and debug log improvements on unified secrets (#48213) ... * Add test for decrypted values on datasource service * Add debug log when fail to parse secure json fields * Fix minor import issue * Refactor encJson to json and simplejson to sjson on tests	3 years ago
Guilherme Caulada	a367ad730c	Secrets: Implement basic unified secret store service (#45804) ... * wip: Implement kvstore for secrets * wip: Refactor kvstore for secrets * wip: Add format key function to secrets kvstore sql * wip: Add migration for secrets kvstore * Remove unused Key field from secrets kvstore * Remove secret values from debug logs * Integrate unified secrets with datasources * Fix minor issues and tests for kvstore * Create test service helper for secret store * Remove encryption tests from datasources * Move secret operations after datasources * Fix datasource proxy tests * Fix legacy data tests * Add Name to all delete data source commands * Implement decryption cache on sql secret store * Fix minor issue with cache and tests * Use secret type on secret store datasource operations * Add comments to make create and update clear * Rename itemFound variable to isFound * Improve secret deletion and cache management * Add base64 encoding to sql secret store * Move secret retrieval to decrypted values function * Refactor decrypt secure json data functions * Fix expr tests * Fix datasource tests * Fix plugin proxy tests * Fix query tests * Fix metrics api tests * Remove unused fake secrets service from query tests * Add rename function to secret store * Add check for error renaming secret * Remove bus from tests to fix merge conflicts * Add background secrets migration to datasources * Get datasource secure json fields from secrets * Move migration to secret store * Revert "Move migration to secret store" This reverts commit 7c3f872072. * Add secret service to datasource service on tests * Fix datasource tests * Remove merge conflict on wire * Add ctx to data source http transport on prometheus stats collector * Add ctx to data source http transport on stats collector test	3 years ago
ying-jeanne	7ddae870e7	fix status code 200 (#47818)	3 years ago
Karl Persson	cac6936015	Access control: Change data source permissions to be based on UID (#46741) ... * Add ResourceAttribute * Add ResourceAttribute option * Set ResourceAttribute option * Change resolvers to return uid based scopes * update swagger to correct scope * use ResourceAttribute for endpoint scope * bump role version * Add support for different attributes for access control metadata * evaluate data source metadata based on uid * Fix test * uncomment benchmarks * Use resourceID * use evaluator for access control metadata * update comment * Set default permissions based on uid * Add attribute to accesscontrol filter * validate that scopes has correct attribute * lint * Update comment * remove attribute parameter and extend prefix * refactor to use scope prefix * Get metadata with prefix * fix test * fix comparision * remove unused type * fix attribute index * fix typo * restructure logic * Get metadata by uid * fix imports Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
Gabriel MABILLE	3440e7c8f7	AccessControl: Fix locked role picker in orgs/edit page (#46539) ... * AccessControl: Fix locked role picker in orgs/edit page * Use correct org when computing metadata	3 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727) ... * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	3 years ago
Emil Tullstedt	0e5ac29763	Data sources: Grant creator edit permissions to data source by default (#46168) ... * Data sources: Sent user ID when creating data source * Data sources: Grant a data source creator edit permissions * Use edit permisison and only append if user id is in command Co-authored-by: Karl Persson <kalle.persson@grafana.com>	3 years ago