21 Commits (aa92dc860bd95ef941c6fe2f77143a79996514d3)

Author	SHA1	Message	Date
Alexander Zobnin	aa92dc860b	Zanzana: Improve server side error handling (#106378) ... * Zanzana: Split client and server logs * Zanzana: Improve error handling and logging * log internal error at the server side * refactor * improve errors for list request * update go modules * handle errors for read and write * refactor * reset go.mod changes	3 weeks ago
Alexander Zobnin	c34394f385	Zanzana: Support subresources for typed resources (#102470) ... * Zanzana: Support subresources for folders * refactor * fix subresource requests * implement listing for folders subresources * teams subresources PoC * re-enable tests * use team resource def from iam * fix tests * remove unused code * refactor: rename to subresource * split resource schema * update workspaces * rename folder relation to subresource * refactor: rename folder resources to subresources * update readme * fix listing * rename params in subresource filter	3 months ago
Karl Persson	14886410d6	Zanzana: Use shared auth interceptor for zanzana and pass tracer (#100968) ... * Use shared auth interceptor for zanzana and pass tracer	4 months ago
Alexander Zobnin	fcb88f6ccc	Zanzana: revert cluster store for fixed roles (#100958) ... * Zanzana: revert cluster store for fixed roles * update go workspace	4 months ago
Karl Persson	ce0d986673	Zanzana: Use cache for both streamed and non-stream version of list objects (#98882) ... * Add prefix constants and use string builders / string concatinations * Use cache for both streamed and non-stream versions of list objects * Remove unused constants	5 months ago
Karl Persson	0f9b107201	Zanzana: Consistently add context (#98862) ... * Zanzana: Reworks how contextuals are loaded * Cleanup listObjectWithStream * Run list test with streaming enabled	5 months ago
Alexander Zobnin	5922015fec	Zanzana: Setup GRPC authentication in client/server mode (#98680) ... * Zanzana: Setup GRPC authentication in client/server mode * don't use grpcutils * refactor Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Add a namespace stub for in-proc mode Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Read parameters from config * authorize server requests * add namespace to the tests context * use stack id from config * simplify authorize func * properly format namespace * return Unauthenticated if namespace is empty * use insecure cred only in dev env * check request namespace * Use CallCredentials API for client auth * provide config * fail if stack id is missing * improve error message * use insecure connection by default --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com>	6 months ago
Karl Persson	9ed4bf3cd2	Zanzana: Support sub resources (#98201) ... * Create and use common ResourceInfo struct * Add support for formatting group resource with subresource * Add initial support for handling subresource * Add test for checking subresource for generic resource * Bump authlib	6 months ago
Alexander Zobnin	7e5cb7d8d6	Zanzana: Refactor fixed roles (use global store) (#97884) ... * Zanzana: Pass contextual tuples for authorization * global reconciler for fixed roles * inject tuples from global store * fix adding contextual tuples * cleanup * don't error on auth context fail * add todo * add context for List * add caching * remove unused * use constant for global namespace * Rename global namespace to cluster namespace	6 months ago
Gabriel MABILLE	efb7cc0343	Chore: Authlib upgrade (#98319) ... * Chore: Authlib upgrade * Upgrade authlib * Uncommit file	6 months ago
Karl Persson	87ba9c60b2	Zanzana: change type name from namespace to group_resource (#97741) ... * Change type name from namespace to group_resource * update function names and test descriptions	7 months ago
Karl Persson	718612aabf	Zanzana: Update relation names (#97638) ... * Update relation names to match k8s verbs * Only check namespace if relation is valid * Only list for valid relations	7 months ago
Alexander Zobnin	5a91ab46af	Zanzana: Use StreamedListObjects to fetch full list of resources (#97025) ... * Initial streamed version of list * instantiate openfga client to use StreamedListObjects * Add config option for using streamed version * Use caching * fix cache init * Fix hashing * refactor	7 months ago
Karl Persson	11a4a366c6	Zanzana: Optimize batch check (#96669) ... * Restructure check code so we only check namespace access once for each GroupResource during for batch	7 months ago
Karl Persson	7e38fd733b	Zanzana: Lazy load cached store info (#96452) ... * Lazy load cached store infos	7 months ago
Gabriel MABILLE	cc9cdbe82d	Authz: Move extension proto up a layer (#96254) ... * Authz: Move extension proto up a layer * Lint	8 months ago
Alexander Zobnin	910ec7e7dc	Zanzana: Use separate store for each org (#96015) ... * Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter	8 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019) ... * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	8 months ago
Karl Persson	dfa8f786d2	Zanzana: fix generic schema (#95648) ... * Change schema so that resource checks on a folder walks the tree	8 months ago
Karl Persson	e0163c93c2	Zanzana: reconcile generic schema (#95492) ... * Rename to CheckObject * Implement authz.AccessClient * Move folder tree to reconciler and use new schema * Move shared functionality to common package * Add reconciler for managed permissions and resource translations * Add support for folder resources	8 months ago
Karl Persson	bdbe12e980	Zanzana: Implement initial check and list with schema for generic resources (#95056) ... * Implement initial check with schema for generic resources * Implement List and add tests * Add namespace type and change to folder_resource name * Handle namespace grants for typed resources * Run tests as integration tests * Add support for verb in list requests	8 months ago