7 Commits (788fde7ead34aa04da09a84684c5bc63045aa95f)

Author	SHA1	Message	Date
Ieva	f2450575b3	Access control: FGAC for annotation updates (#46462) ... * proposal * PR feedback * fix canSave bug * update scope naming * linting * linting Co-authored-by: Ezequiel Victorero <ezequiel.victorero@grafana.com>	3 years ago
Karl Persson	d27ff42376	Access control: Move data source actions and scopes to datasource package (#46594) ... * Add permission actions and id scope * Remove scope and actions variable prefix * Move page evaluators and rename them	3 years ago
Yuriy Tseretyan	314be36a7c	Move datasource scopes and actions to access control package (#46334) ... * create scope provider * move datasource actions and scopes to datasource package + add provider * change usages to use datasource scopes and update data source name resolver to use provider * move folder permissions to dashboard package and update usages	3 years ago
J Guerreiro	c6cae8411a	APIKeys: add API key migration to ensure fk is null (#46285)	3 years ago
J Guerreiro	7f1e8cee2b	APIKeys: Add AC controls for legacy API keys (#46255) ... * APIKeys: Add AC controls for legacy API keys * pluralize actions	3 years ago
Karl Persson	4982ca3b1d	Access control: Use access control for dashboard and folder (#44702) ... * Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Gabriel MABILLE	14bee49f9a	AccessControl: Compute metadata from context permissions (#45578) ... * AccessControl: Compute metadata from context permissions * Remove nil Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Check user permissions are set Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Ezequiel Victorero	4f815e3d8e	Access control: adding FGAC to annotation GET endpoints and fixed roles (#45102) ... * Access control: adding FGAC to annotation GET endpoints and fixed roles Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Ieva	6fb3aac2e1	Access control: team UI improvements with FGAC (#45255) ... * show teams page for user who can't list teams but can create teams * Fixing buttons and routes * Small refactor Co-authored-by: gamab <gabi.mabs@gmail.com>	3 years ago
Ieva	9fafbfc87e	add the permission to read org users to team creator (#45224)	3 years ago
Gabriel MABILLE	8217d6d206	AccessControl: Change teams permissions page when accesscontrol is enabled (#43971) ... * AccessControl: Change teams permissions page when frontend is hit * Implement frontend changes for group sync * Changing the org/teams/edit permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Fixing routes Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Use props straight away no need to go through the state Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> * Update public/app/features/teams/TeamPages.tsx Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>	3 years ago
Ieva	9247848a7b	increment fixed role version (#44779)	3 years ago
Karl Persson	e93e1bdd2b	Access control: Enable data source view for partial permissions (#44695) ... * Return correct value * Remove scope all requirement * Only add dashboard sub nav if user is admin	3 years ago
Karl Persson	5ca9d2895b	Add viewer grant to `fixed:datasources:reader` if viewers_can_edit is set to true (#44657)	3 years ago
J Guerreiro	cb6e5ae8ce	AccessControl: Add access control actions and scopes to team update and delete ... * AccessControl: Add access control actions and scopes to team update and delete * AccessControl: Add tests for AC guards in update/delete * AccessControl: add fixed role for team writer * AccessControl: ensure team related AC is deleted with team * Update pkg/api/team_test.go	3 years ago
Gabriel MABILLE	d4f682190f	AccessControl: Implement teams resource service (#43951) ... * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * moving resourceservice to the main wire file pt2 * move team related actions so that they can be reused * PR feedback * fix * typo * Access Control: adding hooks for team member endpoints (#43991) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * add access control to list and add team member endpoint, and hooks for adding team members * member permission type is 0 * add ID scope for team permission checks * add more team actions, use Member for member permission name * protect team member update endpoint with FGAC permissions * update SQL functions for teams and the corresponding tests * also protect team member removal endpoint with FGAC permissions and add a hook to permission service * a few small fixes, provide team permission service to test setup * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * remove resource services from wireexts * remove unneeded actions * linting fix * remove comments * feedback fixes * feedback * simplifying * remove team member within the same transaction * fix a mistake with the error * call the correct sql fction * linting * Access control: tests for team member endpoints (#44177) * tests for team member endpoints * clean up and fix the tests * fixing tests take 2 * don't import enterprise test license * don't import enterprise test license * remove unused variable Co-authored-by: gamab <gabi.mabs@gmail.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	f75e4d1a4f	Access Control: Allow signed in users access to GET data sources endpoints (#43338) ... * remove scopes from endpoints and add datasources:read without scope to the compatibility role	3 years ago
Ieva	a06564fb0d	Access control: allow granting a fixed role dynamically based on the startup settings (#43867) ... * allow granting a fixed role dynamically depending on startup config * move role definition for team writing * undo test changes * nicer naming	4 years ago
Gabriel MABILLE	eea0e6a6c0	AccessControl: Renamed `orgs` roles, removed `fixed:orgs:reader` introduced in beta1 (#42049) ... * AccessControl: Rework Orgs roles * Increase version for name migration * Update pkg/api/roles.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Use maintainer instead of manager Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	4 years ago
Gabriel MABILLE	0ee0a0b7a0	AccessControl: FGAC permissions for orgs endpoint on frontend (#41050) ... * AccessControl: FGAC permissions for orgs endpoint on frontend Protect org update endpoints add or refactor missing right messages cover org page * removing scopes from orgs * Perform permission control with global org * Perform the error handling in case of 403 * Simplify frontend code by requiring read access for sure * Remove roles I added to decrease the number of changes * Remove the check for server admin to reduce the number of changes * change error message * Cleaning todos * Remove unecessary changes * Fix tests * Update test snapshot * Update pkg/api/roles.go Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> * Format AdminEditOrgPage for linting * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Vardan Torosyan <vardants@gmail.com> * Update public/app/features/admin/AdminEditOrgPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Update public/app/features/admin/AdminListOrgsPage.tsx Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Commit suggestions * Commit suggestion canRead canWrite * fix typo Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	4 years ago
Ieva	b7f47561b6	Access control: add roles to fixed groups (#41673) ... * add roles to fixed groups * add global to group name	4 years ago
Karl Persson	d623285fcc	Access Control: Rename fixed roles (#41288) ... * Rename fixed roles * Update descriptions * Update docs for fixed roles and permissions Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>	4 years ago
Gabriel MABILLE	818b8739c0	AccessControl: Remove scopes from orgs endpoints (#41709) ... * AccessControl: Check permissions in target org * Remove org scopes and add an authorizeInOrg middleware * Use query result org id and perform users permission check globally for GetOrgByName * Remove scope translation for orgs current * Suggestion from Ieva	4 years ago
Gabriel MABILLE	a127e106db	AccessControl: Create FGAC roles for orgs (#40526) ... * AccessControl: Create FGAC roles for orgs Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>	4 years ago
Karl Persson	740444680c	Access Control: Add fgac to datasource query endpoints (#40294) ... * Protect datasource tsdb and proxy endpoints with access control * Add datasource query permissions to fixed admin role Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Mitch Seaman <mjseaman@users.noreply.github.com>	4 years ago
Gabriel MABILLE	458371c8eb	AccessControl: Extend scope parameters with extra params from context (#39722) ... * AccessControl: Extend scope parameters with extra params from context Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Gabriel MABILLE	4160429b71	AccessControl: rename data source id read action (#39966)	4 years ago
Gabriel MABILLE	1d56c32ab0	AccessControl: Protect /datasources endpoints consistently with NavLinks permissions (#39319)	4 years ago
Gabriel MABILLE	9f29241a0c	AccessControl: add one-dimensional permissions to datasources (#38070) ... * AccessControl: add one-dimensional permissions to datasources in the backend * AccessControl: add one-dimensional permissions to datasources in the frontend (#38080) Co-authored-by: Hugo Häggmark <hugo.haggmark@grafana.com>	4 years ago
Jeremy Price	e8e1a0b50b	Revert "Revert "AccessControl: Implement a way to register fixed roles (#35641)" (#37397)" (#37535) ... This reverts commit 55efeb0c02.	4 years ago
Emil Tullstedt	55efeb0c02	Revert "AccessControl: Implement a way to register fixed roles (#35641)" (#37397) ... This reverts commit 88c11f1cc0.	4 years ago
Gabriel MABILLE	88c11f1cc0	AccessControl: Implement a way to register fixed roles (#35641) ... * AccessControl: Implement a way to register fixed roles * Add context to register func * Use FixedRoleGrantsMap instead of FixedRoleGrants * Removed FixedRoles map to sync.map * Wrote test for accesscontrol and provisioning * Use mutexes+map instead of sync maps * Create a sync map struct out of a Map and a Mutex * Create a sync map struct for grants as well * Validate builtin roles * Make validation public to access control * Handle errors consistently with what seeder does * Keep errors consistant amongst accesscontrol impl * Handle registration error * Reverse the registration direction thanks to a RoleRegistrant interface * Removed sync map in favor for simple maps since registration now happens during init * Work on the Registrant interface * Remove the Register Role from the interface to have services returning their registrations instead * Adding context to RegisterRegistrantsRoles and update descriptions * little bit of cosmetics * Making sure provisioning is ran after role registration * test for role registration * Change the accesscontrol interface to use a variadic * check if accesscontrol is enabled * Add a new test for RegisterFixedRoles and fix assign which was buggy * Moved RegistrationList def to roles.go * Change provisioning role's description * Better comment on RegisterFixedRoles * Correct comment on ValidateFixedRole * Simplify helper func to removeRoleHelper * Add log to saveFixedRole and assignFixedRole Co-authored-by: Vardan Torosyan <vardants@gmail.com> Co-authored-by: Jeremy Price <Jeremy.price@grafana.com>	4 years ago