grafana

Commit Graph

Author	SHA1	Message	Date
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066 )	2 years ago
Ieva	cfa1a2c55f	RBAC: Split non-empty scopes into `kind`, `attribute` and `identifier` fields for better search performance (#71933 ) * add a feature toggle * add the fields for attribute, kind and identifier to permission Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * set the new fields when new permissions are stored * add migrations Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * remove comments * Update pkg/services/accesscontrol/migrator/migrator.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * feedback: put column migrations behind the feature toggle, added an index, changed how wildcard scopes are split * PR feedback: add a comment and revert an accidentally changed file * PR feedback: handle the case with : in resource identifier * switch from checking feature toggle through cfg to checking it through featuremgmt * don't put the column migrations behind a feature toggle after all - this breaks permission queries from db --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Misi	607670a9fa	Auth: Use SHA-1 for generating an ID for External Service Role (#71079 ) * Use sha1 (160 bit hash) * Update pkg/services/accesscontrol/database/externalservices.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Satisfy linter, clean up --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Ryan McKinley	e7da2a179e	Schema: Add schema for role+access policies (#68047 )	2 years ago
Gabriel MABILLE	d7eea0d207	RBAC: Add a function to delete external service roles (#68317 ) * RBAC: Add function to delete external service roles * Adding a test to the service * Update pkg/services/accesscontrol/acimpl/service_test.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Gabriel MABILLE	8c6b5a4319	RBAC: Add a function to save external service roles (#66299 ) * AuthN: Save external services RBAC roles * Add missing test * Placing roles in the same group * Split function to gen role and assignment * add test case and comments * Ensure we check external service roles are assigned once only * Update pkg/services/accesscontrol/models_test.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> --------- Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	2 years ago
Jo	c8db771939	Users: Fix org user always getting org id = 1 on auto assign false (#63708 ) * fix org user always getting org id = 1 on auto assign false * make tests explicit * use correct cfg in service accounts * fix api tests * fix database test of ac * fix InsertOrgUser returning affected rows as orgID	2 years ago
Jo	f9163351fd	Support bundles: Refactor registry into separate service (#62945 ) * add bundle registry service to avoid dependency cycles * move user support bundle collector to user service * move usage stat bundle implementation to usage stats * add info for background service * fix remaining imports * whitespace	2 years ago
Kristin Laemmert	e8b8a9e276	chore: move dashboard_acl models into dashboard service (#62151 )	2 years ago
idafurjes	f2ffce4351	Chore: Move team models to models pkg (#61262 ) * Chore: Move team models to models pkg * Fix ACL tests * More ACL tests * Change Id to ID in conflict user command test * Remove team from models * Fix ac test lint	2 years ago
Ieva	6aa5a79cad	Access control: endpoint for searching single user permissions (#59669 ) * initial commit * clean up * fix a bug and add tests * more tests * undo some unintended changes * undo some unintended changes * linting * PR feedback - add user ID to search options * simplify the query * Apply suggestions from code review Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * remove unneeded formatting changes Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Karl Persson	6d1bcd9f40	DataSourcePermissions: Handle licensing properly for ds permissions (#59694 ) * RBAC: add viewer grand if dspermissions enforcement is not enabled * RBAC: Change permissions based on role prefix * RBAC: Add option to for permission service to add a license middleware * RBAC: Remove actions from query struct	3 years ago
Gabriel MABILLE	bf49c20050	RBAC: Add an endpoint to list all user permissions (#57644 ) * RBAC: Add an endpoint to see all user permissions Co-authored-by: Joey Orlando <joey.orlando@grafana.com> * Fix mock * Add feature flag * Fix merging * Return normal permissions instead of simplified ones * Fix test * Fix tests * Fix tests * Create benchtests * Split function to get basic roles * Comments * Reorg * Add two more tests to the bench * bench comment * Re-ran the test * Rename GetUsersPermissions to SearchUsersPermissions and prepare search options * Remove from model unused struct * Start adding option to get permissions by Action+Scope * Wrong import * Action and Scope * slightly tweak users permissions actionPrefix query param validation logic * Fix xor check * Lint * Account for suggeston Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add search * Remove comment on global scope * use union all and update test to make it run on all dbs * Fix MySQL needs a space * Account for suggestion. Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Joey Orlando <joey.orlando@grafana.com> Co-authored-by: Joey Orlando <joseph.t.orlando@gmail.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	7386f8652c	RBAC: Improve performance of dashboard filter query (#56813 ) * RBAC: Move UserRolesFilter to domain package * Dashboard Permissions: Rewrite rbac filter to check access in sql * RBAC: Add break when wildcard is found * RBAC: Add tests for dashboard filter * RBAC: Update tests * RBAC: Cover more test cases Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087 ) * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago
Kristin Laemmert	c61b5e85b4	chore: replace sqlstore.Store with db.DB (#57010 ) * chore: replace sqlstore.SQLStore with db.DB * more post-sqlstore.SQLStore cleanup	3 years ago
Eric Leijonmarck	f7de253cdd	fix: remove permission grouping (#56157 )	3 years ago
Eric Leijonmarck	1e8f8dff4b	Auth: Adds validation and ingestion of conflict file (#53014 ) * add users-manager command * add users-manager command * rename files * refactor: imports and renaming * Command: add conflict merge user command - MergeUser will - replace all user_ids from conflicting users to the chosen userId - delete users whose user_ids are not the chosen user - SameIdentification will - update chosen user with chosen email,login details - delete users whose user_ids are not the chosen user * refactor: clean up * refactor: create structure for read, validate, ingest * feat: ls and generate-file for conflicting users * remove usagestats * added back pkg/services/login/authinfoservice/database/stats.go * Revert "added back pkg/services/login/authinfoservice/database/stats.go" This reverts commit `2ba6e3c4d6`. * Revert "remove usagestats" This reverts commit `1e3fa97810`. * cherry pick * Revert "cherry pick" This reverts commit `461626c306`. * validation of picked merge user * fix test * make lint * make test run * tests for ingest working * clean up and refactored to align with downstream refactoring * formatting * refactor: name list instead of ls * fix: static lint error use trimprefix * WIP: permissions for validation * fix: remove unused functions in sqlstore * fix: remove unused function * handling of multiple users and resolve discarded users * fix tests * fix: bug that did not exclude the blocks * ioutil is blacklisted * WIP: validation * tests for merging a user working * add latest changes to output print * refactor: removed conflictEmail and conflictLogin that was not used * refactor: code clean up, showChanges working * test and linting fixes * test and linting fixes * refactor: removed logging of config and added more info for vlidation command * refactor: fix order of code * fix time now * refactor: no longer need for check casesensitive login/email * removed unnessecary loop * refactor: move functions around * test: working * docs: add docuemntationf for file * Add failing test for generating the conflict login block * Fix regex * Fix some stuff/tests Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com> * add: docs for conflict file * add: conflict_email, conflict_login fields * add: conflict_email, conflict_login fields * WIP * fix: tests working as intended * Update pkg/cmd/grafana-cli/commands/conflict_user_command.go Co-authored-by: linoman <2051016+linoman@users.noreply.github.com> * review comments * Update pkg/cmd/grafana-cli/commands/conflict_user_command.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * Update pkg/cmd/grafana-cli/commands/conflict_user_command.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * missspelling * trailing new line * update to use userimpl store * remove newline * remove newline * refactor: initializing of resolver for conflicts * fix: test sqlStore * refactor: removed lines * refactor: remove TODOs Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com> Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>	3 years ago
Serge Zaitsev	4c19e83ff0	Chore: Move team store implementation to a separate package (#55514 ) * Chore: move team store implementation to a separate package * trying to fix more tests * fix tests in service accounts and access control * fix common tests * restore commented out test * add todos	3 years ago
Karl Persson	b827df626d	RBAC: Initiate store in service (#55081 ) * RBAC: Dont inject store with wire * RBAC: Use Store interface * RBAC: Move store interface and initiate it from service	3 years ago
Karl Persson	1b933ff3ed	RBAC: Move resource permissions store to service package (#53815 ) * Rename file to store * Move resource permission specific database functions to resourcepermissions package * Wire: Remove interface bind * RBAC: Remove injection of resourcepermission Store * RBAC: Export store constructor * Tests: Use resource permission package to initiate store used in tests * RBAC: Remove internal types package and move to resourcepermissions package * RBAC: Run database tests as itegration tests	3 years ago
Karl Persson	57d87389e0	RBAC: Remove user permissions in org when user is removed (#53782 ) * RBAC: Add orgID to DeleteUserPermissions * RBAC: Refactor query to delete all permissions in specified org, 0 deletes all permissions * Delete user permission in org when user is removed * Remove call to delete permissions in frontend * Remove user permissions if removed orgs is detected during oauth sync Co-authored-by: Jo <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	4069fe1c39	RBAC: Update permission query to not join on team table (#53677 ) * RBAC: Add teamIDs to get permission query * RBAC: Remove join on team table and use team ids * RBAC: Pass team ids	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343 ) * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Karl Persson	e4c45c4f98	RBAC: Remove sort and unique values when fetching permissions (#53461 ) * RBAC: remove sort and unique values for fetching permissions	3 years ago
lai	8f9a372ce2	Access Control: optimize GetUserPermissions sql (#53279 ) * Access Control: optimize GetUserPermissions sql	3 years ago
Gabriel MABILLE	00ff61cb9e	RBAC: Add an additional check on UserID before fetching the permissions (#53002 ) * RBAC: add an additional check before fetching permissions * Nit. * Readd removed test * change message	3 years ago
Ieva	b3a10202d4	Revert "Service accounts: Add service account to teams" (#52710 ) * Revert "Service accounts: Add service account to teams (#51536)" This reverts commit `0f919671e7`. * remove unneeded line * fix test	3 years ago
idafurjes	d3d8fdd878	Chore: Move user errors to user service (#52460 ) * Move user not found err to user service * User ErrCaseInsensitive from user pkg * User ErrUserAlreadyExists from user pkg * User ErrLastGrafanaAdmin from user pkg * Remove errors from model	3 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536 ) * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit `cbf71fbd7f`. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
idafurjes	578ab71ba9	Copy delete user permission to access control service (#51747 ) * Copy delete user permission to access control service * Update pkg/services/accesscontrol/database/database_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
idafurjes	6c43eb0b4d	Split Create User (#50502 ) * Split Create User * Use new create user and User from package user * Add service to wire * Making create user work * Replace user from user pkg * One more * Move Insert to orguser Service/Store * Remove unnecessary conversion * Cleaunp * Fix Get User and add fakes * Fixing get org id for user logic, adding fakes and other adjustments * Add some tests for ourguser service and store * Fix insert org logic * Add comment about deprecation * Fix after merge with main * Move orguser service/store to org service/store * Remove orguser from wire * Unimplement new Create user and use User from pkg user * Fix wire generation * Fix lint * Fix lint - use only User and CrateUserCommand from user pkg * Remove User and CreateUserCommand from models * Fix lint 2	3 years ago
Kristin Laemmert	945f015770	backend/datasources: move datasources models into the datasources service package (#51267 ) * backend/datasources: move datasources models into the datasources service pkg	3 years ago
Karl Persson	44ffbfd6aa	RBAC: Refactor GetUserPermissions to use []accesscontrol.Permission (#50683 ) * Return slice of permissions instead of slice of pointers for permissions	3 years ago
Karl Persson	1c679e814b	AccessControl: Only return action and scope for user permissions and make them unique (#48939 ) * Only return action and scope for user permissions and make them unique	3 years ago
Karl Persson	58fa119270	sort user permissions by scope (#48928 )	3 years ago
Karl Persson	9622e7457e	Fix permission query for postgres (#48543 )	3 years ago
Gabriel MABILLE	9ed7e48454	AccessControl: Modify provisioning to prevent built-in role assignment (#48031 ) * Add basic and managed prefixes to avoid magic strings For now let's stick with grafana_builtins add function isBasic to RoleDTO add function isBasic to Role Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Add team store to wire Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727 ) * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	3 years ago
Karl Persson	4df7bf5ab2	Access control: Display inherited folder permissions in dashboards (#46421 )	3 years ago
Karl Persson	8261e781d5	Access control: Delete user permissions when a user is deleted (#46021 ) * Remove access control related to user on deletion	3 years ago
Karl Persson	8688073564	Access control: Support filter on several actions (#46524 ) * Add support for several actions when creating a acccess control sql filter	3 years ago
Karl Persson	18cbfba596	Access control: Filter users and teams by read permissions (#45968 ) * pass signed in user and filter based on permissions	3 years ago
Karl Persson	922b9465ec	Access Control: Add function to set several permissions on a resource in one transaction (#44768 )	3 years ago
Ieva	602d62ebcc	Access control: FGAC for team sync endpoints (#44673 ) * add actions for team group sync * extend the hook to allow specifying whether the user is external * move user struct to type package * interface for permission service to allow mocking it * reuse existing permissions * test fix * refactor * linting	3 years ago
Karl Persson	e844b263c7	Access control: Load permissions from memory and database (#42080 ) * Load permission from both in memory and from database Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
J Guerreiro	153b231521	AccessControl: Refine interface for AC store (#44536 ) * AccessControl: Refine interface for AC store * Update pkg/services/accesscontrol/database/resource_permissions.go	3 years ago
Karl Persson	de2c5783fa	Access Control: Pass db session to hooks (#44428 ) * Move hook calls to database and pass session	3 years ago
Karl Persson	2425828a0b	quote reserved keyword (#43652 )	3 years ago

1 2

58 Commits (96facbdfa25cdbcac51add910c7ba0d94d6b15a7)