532 Commits (9ab0db939264c0f59c0d1e72396a8be7c24565ed)

Author	SHA1	Message	Date
Alexander Zobnin	cbb688e910	Zanzana: Remove usage from legacy access control (#98883) ... * Zanzana: Remove usage from legacy access control * remove unused * remove zanzana client from services where it's not used * remove unused metrics * fix linter	6 months ago
maicon	766d645d82	Filewalkwithme/unistore refactor folder service to hit folder apiserver (#98409) ... Refactor folder service to use Unified Storage Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com> Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>	6 months ago
Karl Persson	c593b20465	Zanana: Add custom verb for get_permissions and set_permissions. (#98616) ... * Add custom verb for get_permissions and update_permissions. Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	6 months ago
Stephanie Hingtgen	9488bf2915	Dashboards: use service for quotas (#98756)	6 months ago
Karl Persson	fb5783691d	Zanzana: Fix reconciliation of fixed roles (#98696) ... Remove "globalReconciler" and reuse the same one but only run them for cluster namespace	6 months ago
Karl Persson	9ed4bf3cd2	Zanzana: Support sub resources (#98201) ... * Create and use common ResourceInfo struct * Add support for formatting group resource with subresource * Add initial support for handling subresource * Add test for checking subresource for generic resource * Bump authlib	6 months ago
Alexander Zobnin	7e5cb7d8d6	Zanzana: Refactor fixed roles (use global store) (#97884) ... * Zanzana: Pass contextual tuples for authorization * global reconciler for fixed roles * inject tuples from global store * fix adding contextual tuples * cleanup * don't error on auth context fail * add todo * add context for List * add caching * remove unused * use constant for global namespace * Rename global namespace to cluster namespace	6 months ago
Arati R.	6957e1f7b7	Folders: Replace sql query with folder service call when collecting folder tree (#98443) ... * Replace sql query with folder service call when collecting folder tree * Update provider for folder service implementation for wire * Refactor provisioning of oss service in folder permissions test util	6 months ago
maicon	d2639f6080	Ensure all internal Services are using FolderService and not FolderStore (#98370) ... * Ensure all internal Services are using FolderService and not FolderStore Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	7 months ago
Jo	40d3b02648	Auth: Separate anonymous settings to its own struct (#97791) ... separate anonymous settings to its own struct	7 months ago
Alexander Zobnin	61d71ec5b1	Zanzana: Handle anonymous users (#97171) ... * add anonymous users to schema * sync anonymous user role * remove unused * fix linter * only add anonymous reconciler if feature is enabled	7 months ago
Karl Persson	718612aabf	Zanzana: Update relation names (#97638) ... * Update relation names to match k8s verbs * Only check namespace if relation is valid * Only list for valid relations	7 months ago
Karl Persson	e4fbae03a1	RBAC: remove dead code (#97234) ... This code is unused and always have been	8 months ago
Ieva	cc0ec349a4	RBAC: Allow passing in user UID when searching for user's permissions (#97125) ... * allow passing in user UID instead of ID when searching for user's permissions * fix tests	8 months ago
Matheus Macabu	f2b96593ea	SQL: close rows to release connection (#97147) ... * SQL: close rows to release connection * dont return err from rows.Close()	8 months ago
Alexander Zobnin	c8caf787d4	Zanzana: handle service accounts (#97123) ... * add service account to the schema * sync managed permissions for service accounts * sync SA basic roles * sync SA roles * Fix endless loop in reconciler while read openfga	8 months ago
Karl Persson	3990637af9	IAM: remove duplicated functions (#96989) ... * Remove duplicated function and use the one provided by claims package	8 months ago
Alexander Zobnin	170e0e1813	Zanzana: List then search implementation (#96705) ... * Zanzana: Search with list * Allow to pass werb into list request * split list search into 2 functions * fix listing resources * remove unused * refactor * remove unused function * Add more logging to reconciler * Fix search for users with access to all resources * fix findFoldersZanzanaList * search for folders as well by default * refactor * use compile for list and search * remove list from client * remove only from client * remove list from interface * run compile once * refactor * refactor * add search tests * fix tests * Fix linter	8 months ago
Karl Persson	e995d4f682	Zanzana: Add setting zanzana reconciliation interval (#96687) ... Add config option under RBAC for zanzana reconciliation interval	8 months ago
Ieva	a60953c8f9	GAS: Show mapped roles in role picker (#96681) ... * add group mapping UID returned mapped roles * request mapped roles from the frontend, but don't attempt to update mapped roles * lock mapped roles and show a pop-up message about why a role is locked * update role selectors to not allow deselecting a mapped role * swagger gen * simplify and set mapped as bool instead of mapping UID array * swagger gen	8 months ago
Karl Persson	7e442efa9c	Zanzana: sync roles and bindings (#96661) ... * Sync fix and custom roles and team bindings. * Add collector for user role bindings	8 months ago
Karl Persson	1f34096fdf	Zanzana: reconcile basic roles and bindings (#96473) ... * Add reconciler for basic roles * Add reconciler for basic role bindings	8 months ago
Karl Persson	db6422c8a3	Zanzana: Use correct namespace when evaluating permission (#96258) ... Use correct namespace	8 months ago
Gabriel MABILLE	cc9cdbe82d	Authz: Move extension proto up a layer (#96254) ... * Authz: Move extension proto up a layer * Lint	8 months ago
Alexander Zobnin	b1fb581ab1	Zanzana: Evaluate access with Check request (server-side) (#96213) ... * Zanzana: Evaluate access with Check request (server-side) * Pass parent folder for checking access * Review suggestions * remove fixme comment	8 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205) ... * Special handling for zanzana reconciliation if stack id is configured * remove sync call	8 months ago
Alexander Zobnin	910ec7e7dc	Zanzana: Use separate store for each org (#96015) ... * Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter	8 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019) ... * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	8 months ago
Jo	9f43724b57	AccessControl: Use UIDs for Resource permissions frontend (#95552) ... * frontend can use uids to set resource permissions * lint * add uids to folder acl * Update public/app/core/components/Select/UserPicker.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * simplify conditions --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	9 months ago
Karl Persson	dfa8f786d2	Zanzana: fix generic schema (#95648) ... * Change schema so that resource checks on a folder walks the tree	9 months ago
Jo	90d2f4659e	Users: Allow specifying user UIDs in params (#95424) ... * add user ID API translation * add uid to user frontend * use users' UIDs in admin pages * fix ldapSync page * use global user search for user by UID * remove active org filtering * remove orgID params	9 months ago
Jo	2b867d9850	AccessControl: Resource permission translator (#95423) ... * Standardize Resource Translator in options * Add resource UID translator for resource permissions * fix comments * fix comments	9 months ago
Karl Persson	e0163c93c2	Zanzana: reconcile generic schema (#95492) ... * Rename to CheckObject * Implement authz.AccessClient * Move folder tree to reconciler and use new schema * Move shared functionality to common package * Add reconciler for managed permissions and resource translations * Add support for folder resources	9 months ago
Jo	ed1ad34f9b	ServiceAccounts: Allow use of UIDs for Service Account routes (#95401)	9 months ago
Yuri Tseretyan	2deced7d40	Alerting: Notifications Routes API (#91550) ... * Introduce new models RoutingTree, RouteDefaults and Route and api-server to serve them that is backed by provisioning notification policy service. * update method UpdatePolicyTree of notification policy service to return route and new version * declare new actions alert.notifications.routes:read and alert.notifications.routes:write and two corresponding fixed roles. --------- Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	9 months ago
Aaron Godin	d89235aa8c	IAM: fix GetSearchPermissionCacheKey uniqueness (#95192) ... * fix: Change users permissions search to use a consistent key without collisions * Move HashString to cacheutils * Change error handling logic for what to do with a cache key * Add a test that confirms search cache key consistency	9 months ago
Eric Leijonmarck	9ab064bfc5	Folders: Add admin permissions upon creation of a folder w. SA (#95072) ... * add admin permissions upon creation of a folder w. SA * Update pkg/services/folder/folderimpl/folder.go Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Grant service account permissions for creation of dashboards * Grant service account admin permissions upon creating a datasource * fetch user using the userservice with the userid * Revert "fetch user using the userservice with the userid" This reverts commit 23cba78752. * revert back to original datasource creation --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com>	9 months ago
Matthew Jacobson	4aad44e848	Alerting: Fix per-receiver RBAC for receivers with long names (#95084) ... * Implement uidToResourceID * add middleware * Move uidToResourceID to alerting package * Only hash uid if it's too long * Use hashed uid in access control * Move ReceiverUidToResourceId to ScopeProvider * resolve uid in middleware only if param exists * Tests * Linting --------- Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>	9 months ago
Karl Persson	a82d01214d	Auth: Update authlib (#94947) ... * Update authlib	9 months ago
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752) ... * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	9 months ago
Alexander Zobnin	e642e1a804	Zanzana: Pass parent folder for the checks in search queries (#94541) ... * Pass parent folder as a contextual tuple in Check request * Search by listing folders and dashboards * skip dashboards listing if limit reached * remove unused * add some comments * only add ContextualTuples if parent provided * Remove parent relation for dashboards from schema and perform separate checks	9 months ago
Ieva	d7aca7d0fe	Role mapping: Add `group_mapping_uid` column to `user_role` table (#93810) ... * add group_mapping_uid column to user_role table * add group mapping UID to user role struct	10 months ago
Jo	acd13e05ef	Teams: Support team UIDs in APIs (#94011) ... * support team UIDs in APIs * unify middleware logic and add team tests * add UID test to resource permissions * remove unused middleware	10 months ago
Yuri Tseretyan	27c7e33217	Alerting: Update permissions to reciever and template test API (#94282) ... * add action "alert.notifications.receivers:test" to receiver creator * update API permissions to accept new granular actions	10 months ago
Alexander Zobnin	5d724c2482	Zanzana: Initial dashboard search (#93093) ... * Zanzana: Search in a background and compare results * refactor * Search with check * instrument zanzana client * add single_read option * refactor * refactor move check into separate function * Fix tests * refactor * refactor getFindDashboardsFn * add resource type to span attributes * run ListObjects concurrently * Use list and search in less cases * adjust metrics buckets * refactor: move Check and ListObjects to AccessControl implementation * Revert "Fix tests" This reverts commit b0c2f072a2. * refactor: use own types for Check and ListObjects inside accesscontrol package * Fix search scenario with low limit and empty query string * more accurate search with checks * revert * fix linter * Revert "revert" This reverts commit ee5f14eea8. * add search errors metric * fix query performance under some conditions * simplify check strategy * fix pagination * refactor findDashboardsZanzanaList * Iterate over multiple pages while making check request * refactor listUserResources * avoid unnecessary db call * remove unused zclient * Add notes for SkipAccessControlFilter * use more accurate check loop * always use check for search with provided UIDs * rename single_read to zanzana_only_evaluation * refactor * update go workspace * fix linter * don't use deprecated fields * refactor * fail if no org specified * refactor * initial integration tests * Fix tests * fix linter errors * fix linter * Fix tests * review suggestions Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix limit * refactor * refactor tests * fix db config in tests * fix migrator (postgres) --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	10 months ago
Arati R.	e399fe6d09	Folders: Set folder creation permission as part of legacy create (#94040) ... * Add folder store to dashboard permissions * Include folder store in annotation scope resolver * Add folder store when initialising library elements * Include folder store in search v2 service initialisation * Include folder store in GetInheritedScopes * Add folder store to folder permissions provider * Include cfg, folder permissions in folder service * Move setting of folder permissions for folder service create method	10 months ago
Tom Ratcliffe	fc51ec70ba	Alerting: Add manage permissions UI logic for Contact Points (#92885) ... * Add showPolicies prop * Add manage permissions component for easier reuse within alerting * Add method for checking whether to show access control within alerting * Remove accidental console.log from main * Tweak styling for contact point width and add manage permissions drawer * Improve typing for access control type response * Add basic test for manage permissions on contact points list * Only show manage permissions if grafana AM and alertingApiServer is enabled * Update i18n * Add test utils for turning features on and back off * Add access control handlers * Update tests with new util * Pass AM in and add tests * Receiver OSS resource permissions There is a complication that is not fully addressed: Viewer defaults to read:* and Editor defaults to read+write+delete:* This is different to other resource permissions where non-admin are not granted any global permissions and instead access is handled solely by resource-specific permissions that are populated on create and removed on delete. This allows them to easily remove permission to view or edit a single resource from basic roles. The reason this is tricky here is that we have multiple APIs that can create/delete receivers: config api, provisioning api, and k8s receivers api. Config api in particular is not well-equipped to determine when creates/deletes are happening and thus ensuring that the proper resource-specific permissions are created/deleted is finicky. We would also have to create a migration to populate resource-specific permissions for all current receivers. This migration would need to be reset so it can run again if the flag is disabled. * Add access control permissions * Pass in contact point ID to receivers form * Temporarily remove access control check for contact points * Include access control metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/accessControl` * Include new permissions for contact points navbar * Fix receiver creator fixed role to not give global read * Include in-use metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/inUse` * Add receiver creator permission to receiver writer * Add receiver creator permission to navbar * Always allow listing receivers, don't return 403 * Remove receiver read precondition from receiver create Otherwise, Creator role will not be able to create their first receiver * Update routes permissions * Add further support for RBAC in contact points * Update routes permissions * Update contact points header logic * Back out test feature toggle refactor Not working atm, not sure why * Tidy up imports * Update mock permissions * Revert more test changes * Update i18n * Sync inuse metadata pr * Add back canAdmin permissions after main merge * Split out check for policies navtree item * Tidy up utils and imports and fix rules in use * Fix contact point tests and act warnings * Add missing ReceiverPermissionAdmin after merge conflict * Move contact points permissions * Only show contact points filter when permissions are correct * Move to constants * Fallback to empty array and remove labelSelectors (not needed) * Allow `toAbility` to take multiple actions * Show builtin alertmanager if contact points permission * Add empty state and hide templates if missing permissions * Translations * Tidy up mock data * Fix tests and templates permission * Update message for unused contact points * Don't return 403 when user lists receivers and has access to none * Fix receiver create not adding empty uid permissions * Move SetDefaultPermissions to ReceiverPermissionService * Have SetDefaultPermissions use uid from string Fixes circular dependency * Add FakeReceiverPermissionsService and fix test wiring * Implement resource permission handling in provisioning API and renames Create: Sets to default permissions Delete: Removes permissions Update: If receiver name is modified and the new name doesn't exist, it copies the permissions from the old receiver to the newly created one. If old receiver is now empty, it removes the old permissions as well. * Split contact point permissions checks for read/modify * Generalise getting annotation values from k8s entities * Proxy RouteDeleteAlertingConfig through MultiOrgAlertmanager * Cleanup permissions on config api reset and restore * Cleanup permissions on config api POST note this is still not available with feature flag enabled * Gate the permission manager behind FF until initial migration is added * Sync changes from config api PR * Switch to named export * Revert unnecessary changes * Revert Filter auth change and implement in k8s api only * Don't allow new scoped permissions to give access without FF Prevents complications around mixed support for the scoped permissions causing oddities in the UI. * Fix integration tests to account for list permission change * Move to `permissions` file * Add additional tests for contact points * Fix redirect for viewer on edit page * Combine alerting test utils and move to new file location * Allow new permissions to access provisioning export paths with FF * Always allow exporting if its grafana flavoured * Fix logic for showing auto generated policies * Fix delete logic for contact point only referenced by a rule * Suppress warning message when renaming a contact point * Clear team and role perm cache on receiver rename Prevents temporarily broken UI permissions after rename when a user's source of elevated permissions comes from a cached team or basic role permission. * Debug log failed cache clear on CopyPermissions --------- Co-authored-by: Matt Jacobson <matthew.jacobson@grafana.com>	10 months ago
Karl Persson	0160f4f72c	RBAC: Add legacy authorization checks to service accounts (#93753) ... * Extract a helper funtion to perform list with authorization checks * Add k8s verb to utils package * Construct default mapping when no custom mapping is passed * Configure authorization checks for service accounts * Fix helper and add filtering to service accounts	10 months ago
Gabriel MABILLE	7928245eb6	ManagedServiceAccounts: Add a config option to disable the feature on-prem (#93571) ... * ManagedServiceAccounts: Add a config option to disabled by default * Update log in pkg/services/extsvcauth/registry/service.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	10 months ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551) ... * Revert "chore: add replDB to team service (#91799)" This reverts commit c6ae2d7999. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit 54177ca619. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit 299c142f6a. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit ac0b4bb34d. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit daedb358dd. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit af19f039b6. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit 27b52b1507. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit 8a6107cd35. * Revert "accesscontrol service read replica (#89963)" This reverts commit 77a4869fca. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit ab5a079bcc. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit d988f5c3b0. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit 50244ed4a1.	10 months ago