114 Commits (9ab0db939264c0f59c0d1e72396a8be7c24565ed)

Author	SHA1	Message	Date
Alexander Zobnin	cbb688e910	Zanzana: Remove usage from legacy access control (#98883) ... * Zanzana: Remove usage from legacy access control * remove unused * remove zanzana client from services where it's not used * remove unused metrics * fix linter	6 months ago
Arati R.	6957e1f7b7	Folders: Replace sql query with folder service call when collecting folder tree (#98443) ... * Replace sql query with folder service call when collecting folder tree * Update provider for folder service implementation for wire * Refactor provisioning of oss service in folder permissions test util	6 months ago
Ieva	cc0ec349a4	RBAC: Allow passing in user UID when searching for user's permissions (#97125) ... * allow passing in user UID instead of ID when searching for user's permissions * fix tests	8 months ago
Karl Persson	3990637af9	IAM: remove duplicated functions (#96989) ... * Remove duplicated function and use the one provided by claims package	8 months ago
Karl Persson	db6422c8a3	Zanzana: Use correct namespace when evaluating permission (#96258) ... Use correct namespace	8 months ago
Alexander Zobnin	b1fb581ab1	Zanzana: Evaluate access with Check request (server-side) (#96213) ... * Zanzana: Evaluate access with Check request (server-side) * Pass parent folder for checking access * Review suggestions * remove fixme comment	8 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205) ... * Special handling for zanzana reconciliation if stack id is configured * remove sync call	8 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019) ... * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	8 months ago
Karl Persson	e0163c93c2	Zanzana: reconcile generic schema (#95492) ... * Rename to CheckObject * Implement authz.AccessClient * Move folder tree to reconciler and use new schema * Move shared functionality to common package * Add reconciler for managed permissions and resource translations * Add support for folder resources	9 months ago
Aaron Godin	d89235aa8c	IAM: fix GetSearchPermissionCacheKey uniqueness (#95192) ... * fix: Change users permissions search to use a consistent key without collisions * Move HashString to cacheutils * Change error handling logic for what to do with a cache key * Add a test that confirms search cache key consistency	9 months ago
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752) ... * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	9 months ago
Alexander Zobnin	e642e1a804	Zanzana: Pass parent folder for the checks in search queries (#94541) ... * Pass parent folder as a contextual tuple in Check request * Search by listing folders and dashboards * skip dashboards listing if limit reached * remove unused * add some comments * only add ContextualTuples if parent provided * Remove parent relation for dashboards from schema and perform separate checks	9 months ago
Alexander Zobnin	5d724c2482	Zanzana: Initial dashboard search (#93093) ... * Zanzana: Search in a background and compare results * refactor * Search with check * instrument zanzana client * add single_read option * refactor * refactor move check into separate function * Fix tests * refactor * refactor getFindDashboardsFn * add resource type to span attributes * run ListObjects concurrently * Use list and search in less cases * adjust metrics buckets * refactor: move Check and ListObjects to AccessControl implementation * Revert "Fix tests" This reverts commit b0c2f072a2. * refactor: use own types for Check and ListObjects inside accesscontrol package * Fix search scenario with low limit and empty query string * more accurate search with checks * revert * fix linter * Revert "revert" This reverts commit ee5f14eea8. * add search errors metric * fix query performance under some conditions * simplify check strategy * fix pagination * refactor findDashboardsZanzanaList * Iterate over multiple pages while making check request * refactor listUserResources * avoid unnecessary db call * remove unused zclient * Add notes for SkipAccessControlFilter * use more accurate check loop * always use check for search with provided UIDs * rename single_read to zanzana_only_evaluation * refactor * update go workspace * fix linter * don't use deprecated fields * refactor * fail if no org specified * refactor * initial integration tests * Fix tests * fix linter errors * fix linter * Fix tests * review suggestions Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix limit * refactor * refactor tests * fix db config in tests * fix migrator (postgres) --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	10 months ago
Gabriel MABILLE	7928245eb6	ManagedServiceAccounts: Add a config option to disable the feature on-prem (#93571) ... * ManagedServiceAccounts: Add a config option to disabled by default * Update log in pkg/services/extsvcauth/registry/service.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	10 months ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551) ... * Revert "chore: add replDB to team service (#91799)" This reverts commit c6ae2d7999. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit 54177ca619. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit 299c142f6a. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit ac0b4bb34d. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit daedb358dd. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit af19f039b6. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit 27b52b1507. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit 8a6107cd35. * Revert "accesscontrol service read replica (#89963)" This reverts commit 77a4869fca. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit ab5a079bcc. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit d988f5c3b0. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit 50244ed4a1.	10 months ago
Karl Persson	2e38329026	RBAC: Add required component to perform access control checks for user api when running single tenant (#93104) ... * Unexport store and create new constructor function * Add ResourceAuthorizer and LegacyAccessClient * Configure checks for user store * List with checks if AccessClient is configured * Allow system user service account to read all users --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	10 months ago
Alexander Zobnin	88259da745	RBAC: Optimize permissions caching (#92673) ... * Access control: Use composite cache key for team permissions * use composite key for teams * use cache for hotpath (getCachedUserPermissions) * don't cache empty teams set * don't pass permissions as argument * early return if no teams found * reload cache correctly * optimize allocations * Clear user's teams cache * remove composite cache for teams * fix linter * don't clear teams permissions * pre-allocate memory for basic roles permissions	11 months ago
Gabriel MABILLE	2a1a43fc9b	PermissionRegistry: Error on unknown kind (#91469) ... * PermissionRegistry: Error on unknown kind * Account for PR feedback Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> * Add missing alerting scope --------- Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>	11 months ago
Aaron Godin	86e8e3b75d	Revert "RBAC: Optimize permissions caching" (#92548) ... Revert "RBAC: Optimize permissions caching (#92412)" This reverts commit 488e994d37. Co-authored-by: gamab <gabriel.mabille@grafana.com>	11 months ago
Alexander Zobnin	488e994d37	RBAC: Optimize permissions caching (#92412) ... * Access control: Use composite cache key for team permissions * use composite key for teams * use cache for hotpath (getCachedUserPermissions) * fix linter * fix sorting --------- Co-authored-by: Jeff Levin <jeff@levinology.com>	11 months ago
Jeff Levin	028e8ac59e	Instrument tracing across accesscontrol (#91864) ... Instrument tracing across accesscontrol --------- Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	11 months ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801) ... * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	11 months ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763)	11 months ago
Karl Persson	bcfb66b416	Identity: remove GetTypedID (#91745)	12 months ago
Alexander Zobnin	1cc438a56c	Zanzana: Evaluate dashboard and folder permissions (#91539) ... * Zanzana: basic folder permissions checks * Fix managed permissions for teams * fix sync batch size * add dashboards actions translations * migrate folder tree * migrate dashboard folders * remove action sets from schema * Adding more dashboard and folder-related permissions * refactor * Correctly translate dashboard permissions in folders * fix dashboard parent permissions	12 months ago
Gabriel MABILLE	8988e04044	RBAC: Add permission registry (#91247) ... * RBAC: Permission registry * Populate permission registry * Wire * conflic_user_cmd * Update pkg/services/accesscontrol/permreg/permreg_test.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * PR feedback Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Remove ToDo, tackle in subsequent PR --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	12 months ago
Ryan McKinley	728150bdbd	Identity: extend k8s user.Info (#90937)	12 months ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567)	1 year ago
Ieva	9bb2cf4968	RBAC: Allow omitting default permissions when a new resource is created (#90720) ... * Cfg: Move rbac settings to own struct * Cfg: Add setting to control if resource should generate managed permissions when created * Dashboards: Check if we should generate default permissions when dashboard is created * Folders: Check if we should generate default permissions when folder is created * Datasource: Check if we should generate default permissions when datasource is created * ServiceAccount: Check if we should generate default permissions when service account is created * Cfg: Add option to specify resources for wich we should default seed * ManagedPermissions: Move providers to their own files * Dashboards: Default seed all possible managed permissions if configured * Folders: Default seed all possible managed permissions if configured * Cfg: Remove service account from list * RBAC: Move utility function * remove managed permission settings from the config file examples, change the setting names * remove ini file changes from the PR * fix setting reading * fix linting errors * fix tests * fix wildcard role seeding --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: jguer <me@jguer.space>	1 year ago
Ieva	4c7d8c8cdd	RBAC: Refactor RBAC plugin interface code (#90679) ... move plugin RBAC registration ifaces to pluginsintegrations	1 year ago
Eric Leijonmarck	248af65f9c	Actionsets: Add ability for plugins to add actions for core actionsets (i.e. `folders:edit`) (#88776) ... * initial commit * Action sets stored remove the dependancy for actionsets got the actionsets registered storing the permissions * fix golanglinting * remove unused struct field * wip * actionset registry for a plugin from the actionsetservice * update to make declareactionset the primary way of plugin registration and modification * declare actually extends actionsets * tests fixed * tests skipped * skip tests * skip tests * skip tests * skip tests * change to warning instead * remove step from pipeline to see if it fails due to plugin not registering * reintroduce step but remove features dependancy * add back the tests that were failing * remove comments and another skip test * fix a comment and remove unneeded changes * fix and clean up, put the behaviour behind a feature toggle * clean up * fixing tests * hard-code allowed action sets for plugins * Apply suggestions from code review Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * small cleanup --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
Kristin Laemmert	77a4869fca	accesscontrol service read replica (#89963) ... * accesscontrol service read replica * now using the ReplDB interface * ReadReplica for GetUser	1 year ago
Alexander Zobnin	7bf8375b02	Zanzana: Add basic metrics for evaluation time and status (#90125) ... * Zanzana: Add basic metrics for evaluation time and status * only init when feature enabled * add todo	1 year ago
Alexander Zobnin	87d86e81ce	Zanzana: Evaluate permissions alongside with RBAC engine (#90064) ... * Zanzana: Evaluate permissions if feature flag enabled * Fix tests * adjust logs * fix spelling * remove unused * only evaluate implemented resources * refactor	1 year ago
Jeff Levin	cfe8317d45	Add auth spans and remove deduplication code for scopes (#89804) ... Adds more spans for timing in accesscontrol and remove permission deduplicating code after benchmarking --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 year ago
Karl Persson	e568b86ac0	Zanzana: Initial work to allow partial data migrations (#89919) ... * Zanana: Add Write method to interface * Zanzana: Add utilities for translating RBAC to openFGA tuple keys * RBAC: Add zanzana synchronizer * Run zanzana sync in access controll provider	1 year ago
Jeff Levin	ed13959e33	Optimize memory allocations in permissions cache (#89645) ... This PR reduces the number of allocations made while caching permissions from the database, fixes the hierarchy of spans and adds new spans for tracing. --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	1 year ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	1 year ago
Ieva	34c40f959f	RBAC: Add and resolve action sets when searching user's permissions (#88694) ... * include and resolve action sets when fetching user's permissions * expand both action and action prefix (returns an empty set for the one that isn't specified) Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * if action is specified, check for exact match; also extend tests	1 year ago
Ieva	bd2b248f0e	RBAC: Clean up action set code (#88147) ... * remove unused action set code, refactor the existing code * fix import ordering * use a separate interface for permission expansion after all, to avoid circular dependencies * add comments, fix a test	1 year ago
Ieva	3e77768144	RBAC: Expand action sets when fetching permissions (#87967) ... * logic to expand action set to the underlying actions when permissions are fetched from the DB * updates needed for dependency injection * clean up some code, also deduplicate scopes when grouping scopes and actions * expand on a comment * rename a method	1 year ago
Gabriel MABILLE	e7d5622969	RBAC: No need to filter permissions on cache hit (#87941)	1 year ago
Ieva	167151b211	Chore: Remove use of deprecated method in AC code (#87541) ... * switch from using cfg to using featuremgmt for checking a feature toggle in AC code * merge test fixes	1 year ago
Alexander Zobnin	0302b75721	Access control: Use search options for computing permissions cache key (#87589)	1 year ago
Ieva	105313f5c2	RBAC: Adding action set resolver for RBAC evaluation (#86801) ... * add action set resolver * rename variables * some fixes and some tests * more tests * more tests, and put action set storing behind a feature toggle * undo change from cfg to feature mgmt - will cover it in a separate PR due to the amount of test changes * fix dependency cycle, update some tests * add one more test * fix for feature toggle check not being set on test configs * linting fixes * check that action set name can be split nicely * clean up tests by turning GetActionSetNames into a function * undo accidental change * test fix * more test fixes	1 year ago
Alexander Zobnin	d1c582815a	Access control: Fix searching permissions from cache (#87489) ... * Fix searching permissions from cache * Write permissions to cache	1 year ago
Alexander Zobnin	82dea4b3e5	Access control: Cache basic roles and teams permissions (#87043) ... * RBAC: Cache basic roles permissions * Cache teams permissions * Set cache TTL to 1 minute * Add OSS implementation * Fetch basic role permissions correctly * fix conflict_user_command * Fix teams permissions query * Add traces for GetUserPermissions * Fix folders tests * Fix colflict user command * Update store mock * Fix linter error * Reuse GetUserPermissions for fetching basic roles * tests for GetTeamsPermissions * pre-allocate slice capacity * Fix linter	1 year ago
Dan Cech	41bee274fd	Chore: Fix error handling in postDashboard, remove UserDisplayDTO, fix live redis client initialization (#87206) ... * clean up error handling in postDashboard and remove UserDisplayDTO * replace GetUserUID with GetUID and GetNamespacedUID, enforce namespace constant type * lint fix * lint fix * more lint fixes	1 year ago
Karl Persson	d8fbbdefea	Identity: Use typed namespace id (#87121) ... * Use typed namespace id	1 year ago
Aaron Godin	d409d8e860	IAM - Fix error messages for resource permissions endpoints (#85773) ... * IAM: fix many error messages in access-related code to provide more information * Remove debug statement * Refactor resourcepermissions package to use errutil * Replace a few more errors with errutil and wrap errors found in users and teams services * Apply diff of openAPI spec	1 year ago