66 Commits (ab6cf9e94de7e1a0811bf2eb48cdbde6136448d9)

Author	SHA1	Message	Date
Ieva	d85df0a560	Service Accounts: Managed permissions for service accounts (#51818) ... * backend changes * frontend changes * linting * nit * import order * allow SA creator to access the SA page * fix merge * tests * fix frontend tests Co-authored-by: alexanderzobnin alexanderzobnin@gmail.com	4 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536) ... * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit cbf71fbd7f. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	b9bb0513e3	Remove version property from fixed roles (#51298)	4 years ago
Karl Persson	44ffbfd6aa	RBAC: Refactor GetUserPermissions to use []accesscontrol.Permission (#50683) ... * Return slice of permissions instead of slice of pointers for permissions	4 years ago
Karl Persson	9fd9a2cded	RBAC: Remove workaround to check permissions on folders for dashboard actions (#50291) ... * remove workaround to check permissions on folders for dashboard actions	4 years ago
Karl Persson	c4a75f9eb3	RBAC: Add scope resolvers for dashboards (#50110) ... * Inject access control into dashboard service * Add function to parse id scopes * Add dashboard as return value * Update mock * Return only err to keep service interface * Add scope resolvers for dashboard id scopes * Add function to parse uid scopes * Add dashboard uid scope resolver * Register scope resolvers for dashboards Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
Karl Persson	896a101f48	RBAC: Extract method from access control impl to a function in domain packge (#49947) ... * Remove GetUserBuiltInRoles and create it as a util function in accesscontrol domain package	4 years ago
Karl Persson	bdff63d4a8	RBAC: Include alert.rules action when setting folder permissions (#49946) ... * Generate additional actions when setting folder permissions in acl list * Add migration for managed folder permissions to include alert rule actions	4 years ago
Karl Persson	d82eb5902d	AccessControl: Cleanup access control interface (#49783) ... * removed unused function * Rename interface	4 years ago
Karl Persson	5caf97be40	AccessControl: Replace IsEnterprise checks with license checks (#49572)	4 years ago
Karl Persson	4a61f4111f	Remove unused error from evaluator Evaluate (#49305)	4 years ago
Gabriel MABILLE	5b6d20fbce	Access Control: Remove built-in role assignment by default (#49058) ... * Remove FF-bultins * Add a param to test br-simplifying	4 years ago
Kristin Laemmert	1df340ff28	backend/services: Move GetDashboard from sqlstore to dashboard service (#48971) ... * rename folder to match package name * backend/sqlstore: move GetDashboard into DashboardService This is a stepping-stone commit which copies the GetDashboard function - which lets us remove the sqlstore from the interfaces in dashboards - without changing any other callers. * checkpoint: moving GetDashboard calls into dashboard service * finish refactoring api tests for dashboardService.GetDashboard	4 years ago
Ieva	f256f625d8	AccessControl: Enable RBAC by default (#48813) ... * Add RBAC section to settings * Default to RBAC enabled settings to true * Update tests to respect RBAC Co-authored-by: Karl Persson <kalle.persson@grafana.com>	4 years ago
Karl Persson	61772a66b6	AccessControl: Create own interface and impl for each permission service (#48871) ... * Create own interfaces for team, folder, dashboard and data source permissions services * Remove service container and inject them individually	4 years ago
Ieva	3c78196d0b	fix a bug (#48782)	4 years ago
Ieva	a5672758d8	Access control: further reduce access control feature toggle checks (#48171) ... * reduce the usage of access control flag further by removing it from SQL store methods * fixing tests * fix another test * linting * remove AC feature toggle use from API keys * remove unneeded function	4 years ago
Karl Persson	2738d1c557	Access Control: Move dashboard actions and create scope provider (#48618) ... * Move dashboard actions and create scope provider	4 years ago
Jguer	6a303bb6b8	AccessControl: Rename builtin role roles to basic roles (#48519) ... * AccessControl: Rename grafana:builtins roles to basic * AccessControl: rename macro references to basic Co-authored-by: gamab <gabi.mabs@gmail.com>	4 years ago
Karl Persson	de50f39c12	Access Control: Refactor scope resolvers with support to resolve into several scopes (#48202) ... * Refactor Scope resolver to support resolving into several scopes * Change permission evaluator to match at least one of passed scopes	4 years ago
Artur Wierzbicki	736be74128	Chore: Add Usage stats providers registry (#48357) ... * add usage stats providers * migrate thumbnails service to `registry.ProvidesUsageStats` * snake -> camel * lint fix * migrate accesscontrol to `registry.ProvidesUsageStats` * add accesscontrol to usage stats providers registry * fix test * added a note about errors	4 years ago
Gabriel MABILLE	8bd825e16c	AccessControl: Make the built-in role definitions public (#47525) ... * AccessControl: Make the built-in role definitions public * Add context to RegisterFixedRoles Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Making BuiltInRolesWithParents public to the AccessControl package Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	4 years ago
Gabriel MABILLE	f7305965a4	AccessControl: Remove package lists for roles and grants (#47141) ... * AccessControl: Remove package variables for roles and grants Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Check for inheritance during role registration Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Moving back role definition to accessscontrol * Make settings reader role public Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Nits Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Forgot to update this * Account for declaration error * Fixing pkg/api init ossac * Account for error in tests * Update test to verify inheritance * Nits. * Place br inheritance behind a feature toggle * Parent -> Parents * Nit. Co-authored-by: Jguer <joao.guerreiro@grafana.com>	4 years ago
Jguer	90a94eab74	Dashboard/Folder permission fix session (#47174) ... * Fix inherited scopes for dashboard to use folder uid * Add inherited evaluators * Slight modification of the commments * Add test for inheritance * Nit. * extract shared function from tests * Nit. Extra line * Remove unused comment Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	4 years ago
Karl Persson	a5e4a533fa	Access control: use uid for dashboard and folder scopes (#46807) ... * use uid:s for folder and dashboard permissions * evaluate folder and dashboard permissions based on uids * add dashboard.uid to accept list * Check for exact suffix * Check parent folder on create * update test * drop dashboard:create actions with dashboard scope * fix typo * AccessControl: test id 0 scope conversion * AccessControl: store only parent folder UID * AccessControl: extract general as a constant * FolderServices: Prevent creation of a folder uid'd general * FolderServices: Test folder creation prevention * Update pkg/services/guardian/accesscontrol_guardian.go * FolderServices: fix mock call expect * FolderServices: remove uneeded mocks Co-authored-by: jguer <joao.guerreiro@grafana.com>	4 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727) ... * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	4 years ago
Karl Persson	4df7bf5ab2	Access control: Display inherited folder permissions in dashboards (#46421)	4 years ago
Yuriy Tseretyan	314be36a7c	Move datasource scopes and actions to access control package (#46334) ... * create scope provider * move datasource actions and scopes to datasource package + add provider * change usages to use datasource scopes and update data source name resolver to use provider * move folder permissions to dashboard package and update usages	4 years ago
Karl Persson	0debf33c76	Access control: Always append all permissions to role admin in oss (#46282) ... * Always append all permissions to built in role admin in oss	4 years ago
Karl Persson	4982ca3b1d	Access control: Use access control for dashboard and folder (#44702) ... * Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	18cbfba596	Access control: Filter users and teams by read permissions (#45968) ... * pass signed in user and filter based on permissions	4 years ago
Karl Persson	cdc08105c2	Access control: Set default permissions for data sources when using access control (#45482) ... * Rename interfaces and use then with wire injection * Set default permissions when creating new data source	4 years ago
Gabriel MABILLE	6fbf346747	AccessControl: Add endpoint to get user permissions (#45309) ... * AccessControl: Add endpoint to get user permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Fix SA tests * Linter is wrong :p * Wait I was wrong * Adding the route for teams:creator too Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	4 years ago
Gabriel MABILLE	f81b9c8150	AccessControl: Read team permissions from db (#44727)	4 years ago
Karl Persson	e844b263c7	Access control: Load permissions from memory and database (#42080) ... * Load permission from both in memory and from database Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
Ryan McKinley	5d66194ec5	FeatureFlags: define features outside settings.Cfg (take 3) (#44443)	4 years ago
Agnès Toulet	65bdb3a899	FeatureFlags: Revert managing feature flags outside of settings.Cfg (#44382) ... * Revert "FeatureToggles: register all enterprise feature toggles (#44336)" This reverts commit f53b3fb007. * Revert "FeatureFlags: manage feature flags outside of settings.Cfg (#43692)" This reverts commit f94c0decbd.	4 years ago
Ryan McKinley	f94c0decbd	FeatureFlags: manage feature flags outside of settings.Cfg (#43692)	4 years ago
Gabriel MABILLE	54280fc9d7	AccessControl: Resolve `attribute` based scopes to `id` based scopes (#40742) ... * AccessControl: POC scope attribute resolution Refactor based on ScopeMutators test errors and calls to cache Add comments to tests Rename logger Create keywordMutator only once * AccessControl: Add AttributeScopeResolver registration Co-authored-by: gamab <gabriel.mabille@grafana.com> * AccessControl: Add AttributeScopeResolver to datasources Co-authored-by: gamab <gabriel.mabille@grafana.com> * Test evaluation with translation * fix imports * AccessControl: Test attribute resolver * Fix trailing white space * Make ScopeResolver public for enterprise redefine * Handle wildcard Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: jguer <joao.guerreiro@grafana.com>	4 years ago
Karl Persson	2409d8dc1f	check the value of the feature toggle (#43433)	4 years ago
idafurjes	ff3cf94b56	Chore: Remove context.TODO() from services (#42555) ... * Remove context.TODO() from services * Fix live test	4 years ago
Karl Persson	9558c09a7c	Access Control: Store permissions on SignedInUser (#43040) ... * add permission structure to signedinuser * add middleware to load user permissions into signedinuser struct * apply LoadPermissionsMiddleware to http server * check for permissions in signedinuser struct Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago
Gabriel MABILLE	818b8739c0	AccessControl: Remove scopes from orgs endpoints (#41709) ... * AccessControl: Check permissions in target org * Remove org scopes and add an authorizeInOrg middleware * Use query result org id and perform users permission check globally for GetOrgByName * Remove scope translation for orgs current * Suggestion from Ieva	4 years ago
Jeremy Price	69c5370e94	Accesscontrol: Add additional API keys to service account, move cloneserviceaccount to sqlstore (#41189) ... * Add additional api key, move cloneserviceaccount * Remove TODOs, for now * Error messages * Linter * Security check * Add comments * Take service account id from correct variable * Update user.go	4 years ago
ying-jeanne	54de1078c8	remove the global log error/warn etc functions (#41404) ... * remove the global log error/warn etc functions and use request context logger whenever possible	4 years ago
idafurjes	9340430723	Chore: Add alert ctx (#41161) ... * Add context for alert * Remove context.TODO * Remove xorm * Remove context.TODO * Fix UsageStatsQuerier interface	4 years ago
ying-jeanne	681218275e	remove crit and trace (#40320)	4 years ago
Jeremy Price	6dbb6408d4	Access Control: Add service accounts (#38994) ... * Add extra fields to OSS types to support enterprise * Create a service account at the same time as the API key * Use service account credentials when accessing API with APIkey * Add GetRole to service, merge RoleDTO and Role structs This patch merges the identical OSS and Enterprise data structures, which improves the code for two reasons: 1. Makes switching between OSS and Enterprise easier 2. Reduces the chance of incompatibilities developing between the same functions in OSS and Enterprise * If API key is not linked to a service account, continue login as usual * Fallback to old auth if no service account linked to key * Add CloneUserToServiceAccount * Adding LinkAPIKeyToServiceAccount * Handle api key link error * Better error messages for OSS accesscontrol * Set an invalid user id as default * Re-arrange field names * ServiceAccountId is integer * Better error messages Co-authored-by: Hugo Häggmark <hugo.haggmark@grafana.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
Gabriel MABILLE	fbc6febb0e	AccessControl: keyword scope resolution (#40229)	4 years ago
Tania B	990911a3b9	Chore: Cleanup usageStatsMock duplication (#39710) ... * Chore: Cleanup usageStatsMock duplication * Remove making a new slice for UsageStatsMock	4 years ago