grafana

Commit Graph

Author	SHA1	Message	Date
Gabriel MABILLE	8217d6d206	AccessControl: Change teams permissions page when accesscontrol is enabled (#43971 ) * AccessControl: Change teams permissions page when frontend is hit * Implement frontend changes for group sync * Changing the org/teams/edit permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Fixing routes Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Use props straight away no need to go through the state Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> * Update public/app/features/teams/TeamPages.tsx Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>	4 years ago
Ieva	9247848a7b	increment fixed role version (#44779 )	4 years ago
Karl Persson	e93e1bdd2b	Access control: Enable data source view for partial permissions (#44695 ) * Return correct value * Remove scope all requirement * Only add dashboard sub nav if user is admin	4 years ago
Karl Persson	5ca9d2895b	Add viewer grant to `fixed:datasources:reader` if viewers_can_edit is set to true (#44657 )	4 years ago
J Guerreiro	cb6e5ae8ce	AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add tests for AC guards in update/delete * AccessControl: add fixed role for team writer * AccessControl: ensure team related AC is deleted with team * Update pkg/api/team_test.go	4 years ago
Gabriel MABILLE	d4f682190f	AccessControl: Implement teams resource service (#43951 ) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * moving resourceservice to the main wire file pt2 * move team related actions so that they can be reused * PR feedback * fix * typo * Access Control: adding hooks for team member endpoints (#43991) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * add access control to list and add team member endpoint, and hooks for adding team members * member permission type is 0 * add ID scope for team permission checks * add more team actions, use Member for member permission name * protect team member update endpoint with FGAC permissions * update SQL functions for teams and the corresponding tests * also protect team member removal endpoint with FGAC permissions and add a hook to permission service * a few small fixes, provide team permission service to test setup * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * remove resource services from wireexts * remove unneeded actions * linting fix * remove comments * feedback fixes * feedback * simplifying * remove team member within the same transaction * fix a mistake with the error * call the correct sql fction * linting * Access control: tests for team member endpoints (#44177) * tests for team member endpoints * clean up and fix the tests * fixing tests take 2 * don't import enterprise test license * don't import enterprise test license * remove unused variable Co-authored-by: gamab <gabi.mabs@gmail.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	f75e4d1a4f	Access Control: Allow signed in users access to GET data sources endpoints (#43338 ) * remove scopes from endpoints and add datasources:read without scope to the compatibility role	4 years ago
Ieva	a06564fb0d	Access control: allow granting a fixed role dynamically based on the startup settings (#43867 ) * allow granting a fixed role dynamically depending on startup config * move role definition for team writing * undo test changes * nicer naming	4 years ago
Gabriel MABILLE	eea0e6a6c0	AccessControl: Renamed `orgs` roles, removed `fixed:orgs:reader` introduced in beta1 (#42049 ) * AccessControl: Rework Orgs roles * Increase version for name migration * Update pkg/api/roles.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Use maintainer instead of manager Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	4 years ago
Gabriel MABILLE	0ee0a0b7a0	AccessControl: FGAC permissions for orgs endpoint on frontend (#41050 ) * AccessControl: FGAC permissions for orgs endpoint on frontend Protect org update endpoints add or refactor missing right messages cover org page * removing scopes from orgs * Perform permission control with global org * Perform the error handling in case of 403 * Simplify frontend code by requiring read access for sure * Remove roles I added to decrease the number of changes * Remove the check for server admin to reduce the number of changes * change error message * Cleaning todos * Remove unecessary changes * Fix tests * Update test snapshot * Update pkg/api/roles.go Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Format AdminEditOrgPage for linting * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Vardan Torosyan <vardants@gmail.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Update public/app/features/admin/AdminListOrgsPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Commit suggestions * Commit suggestion canRead canWrite * fix typo Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	4 years ago
Ieva	b7f47561b6	Access control: add roles to fixed groups (#41673 ) * add roles to fixed groups * add global to group name	4 years ago
Karl Persson	d623285fcc	Access Control: Rename fixed roles (#41288 ) * Rename fixed roles * Update descriptions * Update docs for fixed roles and permissions Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>	4 years ago
Gabriel MABILLE	818b8739c0	AccessControl: Remove scopes from orgs endpoints (#41709 ) * AccessControl: Check permissions in target org * Remove org scopes and add an authorizeInOrg middleware * Use query result org id and perform users permission check globally for GetOrgByName * Remove scope translation for orgs current * Suggestion from Ieva	4 years ago
Gabriel MABILLE	a127e106db	AccessControl: Create FGAC roles for orgs (#40526 ) * AccessControl: Create FGAC roles for orgs Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>	4 years ago
Karl Persson	740444680c	Access Control: Add fgac to datasource query endpoints (#40294 ) * Protect datasource tsdb and proxy endpoints with access control * Add datasource query permissions to fixed admin role Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Mitch Seaman <mjseaman@users.noreply.github.com>	4 years ago
Gabriel MABILLE	458371c8eb	AccessControl: Extend scope parameters with extra params from context (#39722 ) * AccessControl: Extend scope parameters with extra params from context Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Gabriel MABILLE	4160429b71	AccessControl: rename data source id read action (#39966 )	4 years ago
Gabriel MABILLE	1d56c32ab0	AccessControl: Protect /datasources endpoints consistently with NavLinks permissions (#39319 )	4 years ago
Gabriel MABILLE	9f29241a0c	AccessControl: add one-dimensional permissions to datasources (#38070 ) * AccessControl: add one-dimensional permissions to datasources in the backend * AccessControl: add one-dimensional permissions to datasources in the frontend (#38080) Co-authored-by: Hugo Häggmark <hugo.haggmark@grafana.com>	4 years ago
Jeremy Price	e8e1a0b50b	Revert "Revert "AccessControl: Implement a way to register fixed roles (#35641 )" (#37397 )" (#37535 ) This reverts commit `55efeb0c02`.	4 years ago
Emil Tullstedt	55efeb0c02	Revert "AccessControl: Implement a way to register fixed roles (#35641 )" (#37397 ) This reverts commit `88c11f1cc0`.	4 years ago
Gabriel MABILLE	88c11f1cc0	AccessControl: Implement a way to register fixed roles (#35641 ) * AccessControl: Implement a way to register fixed roles * Add context to register func * Use FixedRoleGrantsMap instead of FixedRoleGrants * Removed FixedRoles map to sync.map * Wrote test for accesscontrol and provisioning * Use mutexes+map instead of sync maps * Create a sync map struct out of a Map and a Mutex * Create a sync map struct for grants as well * Validate builtin roles * Make validation public to access control * Handle errors consistently with what seeder does * Keep errors consistant amongst accesscontrol impl * Handle registration error * Reverse the registration direction thanks to a RoleRegistrant interface * Removed sync map in favor for simple maps since registration now happens during init * Work on the Registrant interface * Remove the Register Role from the interface to have services returning their registrations instead * Adding context to RegisterRegistrantsRoles and update descriptions * little bit of cosmetics * Making sure provisioning is ran after role registration * test for role registration * Change the accesscontrol interface to use a variadic * check if accesscontrol is enabled * Add a new test for RegisterFixedRoles and fix assign which was buggy * Moved RegistrationList def to roles.go * Change provisioning role's description * Better comment on RegisterFixedRoles * Correct comment on ValidateFixedRole * Simplify helper func to removeRoleHelper * Add log to saveFixedRole and assignFixedRole Co-authored-by: Vardan Torosyan <vardants@gmail.com> Co-authored-by: Jeremy Price <Jeremy.price@grafana.com>	4 years ago

22 Commits (788f77b7dad1d760a4f55fa148191b0c20a9d43a)