grafana

Commit Graph

Author	SHA1	Message	Date
idafurjes	d3d8fdd878	Chore: Move user errors to user service (#52460 ) * Move user not found err to user service * User ErrCaseInsensitive from user pkg * User ErrUserAlreadyExists from user pkg * User ErrLastGrafanaAdmin from user pkg * Remove errors from model	3 years ago
idafurjes	c061b66d5f	Chore: Split delete user method (#52216 ) * Remove user from preferences, stars, orguser, team member * Fix lint * Add Delete user from org and dashboard acl * Delete user from user auth * Add DeleteUser to quota * Add test files and adjust user auth store * Rename package in wire for user auth * Import Quota Service interface in other services * do the same in tests * fix lint tests * Fix tests * Add some tests * Rename InsertUser and DeleteUser to InsertOrgUser and DeleteOrgUser * Rename DeleteUser to DeleteByUser in quota * changing a method name in few additional places * Fix in other places * Fix lint * Fix tests * Chore: Split Delete User method * Add fakes for userauth * Add mock for access control Delete User permossion, use interface * Use interface for ream guardian * Add simple fake for dashboard acl * Add go routines, clean up, use interfaces * fix lint * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Update pkg/services/user/userimpl/user_test.go Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> * Add wrapper for not service account error * fix indentation * Use fmt for error wrapper Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>	3 years ago
Ieva	d85df0a560	Service Accounts: Managed permissions for service accounts (#51818 ) * backend changes * frontend changes * linting * nit * import order * allow SA creator to access the SA page * fix merge * tests * fix frontend tests Co-authored-by: alexanderzobnin alexanderzobnin@gmail.com	3 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536 ) * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit `cbf71fbd7f`. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
idafurjes	578ab71ba9	Copy delete user permission to access control service (#51747 ) * Copy delete user permission to access control service * Update pkg/services/accesscontrol/database/database_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
idafurjes	6c43eb0b4d	Split Create User (#50502 ) * Split Create User * Use new create user and User from package user * Add service to wire * Making create user work * Replace user from user pkg * One more * Move Insert to orguser Service/Store * Remove unnecessary conversion * Cleaunp * Fix Get User and add fakes * Fixing get org id for user logic, adding fakes and other adjustments * Add some tests for ourguser service and store * Fix insert org logic * Add comment about deprecation * Fix after merge with main * Move orguser service/store to org service/store * Remove orguser from wire * Unimplement new Create user and use User from pkg user * Fix wire generation * Fix lint * Fix lint - use only User and CrateUserCommand from user pkg * Remove User and CreateUserCommand from models * Fix lint 2	3 years ago
Kristin Laemmert	945f015770	backend/datasources: move datasources models into the datasources service package (#51267 ) * backend/datasources: move datasources models into the datasources service pkg	3 years ago
Karl Persson	b9bb0513e3	Remove version property from fixed roles (#51298 )	3 years ago
Karl Persson	2698e37291	RBAC: Add access control metadata to folder dtos (#51158 ) * RBAC: Add access control metadata to Folder dto * Add access control metadata to folder dto response * Add test to verify that access control metadata is attached * Attach access control metadata to multiple folders * Add access control metadata to frontend folder dto	3 years ago
Karl Persson	44ffbfd6aa	RBAC: Refactor GetUserPermissions to use []accesscontrol.Permission (#50683 ) * Return slice of permissions instead of slice of pointers for permissions	3 years ago
Yuriy Tseretyan	54fa04263b	Alerting: Add RBAC actions and role for provisioning API routes (#50459 ) * add alert provisioning actions and role * linter	3 years ago
Karl Persson	9fd9a2cded	RBAC: Remove workaround to check permissions on folders for dashboard actions (#50291 ) * remove workaround to check permissions on folders for dashboard actions	3 years ago
Karl Persson	c4a75f9eb3	RBAC: Add scope resolvers for dashboards (#50110 ) * Inject access control into dashboard service * Add function to parse id scopes * Add dashboard as return value * Update mock * Return only err to keep service interface * Add scope resolvers for dashboard id scopes * Add function to parse uid scopes * Add dashboard uid scope resolver * Register scope resolvers for dashboards Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
Yuriy Tseretyan	c85567f490	fix logging of resolving scopes (#50173 )	3 years ago
Kat Yang	bc8578524b	Chore: Remove last build tag (#50120 )	3 years ago
Karl Persson	896a101f48	RBAC: Extract method from access control impl to a function in domain packge (#49947 ) * Remove GetUserBuiltInRoles and create it as a util function in accesscontrol domain package	3 years ago
Ieva	5dbea9996b	RBAC: Make RBAC action names more consistent (#49730 ) * update action names * correctly retrieve teams for signed in user * remove test * undo swagger changes * undo swagger changes pt2 * add migration from old action names to the new ones * rename from list to read * linting * also update alertign actions * fix migration	3 years ago
Karl Persson	bdff63d4a8	RBAC: Include alert.rules action when setting folder permissions (#49946 ) * Generate additional actions when setting folder permissions in acl list * Add migration for managed folder permissions to include alert rule actions	3 years ago
Karl Persson	d82eb5902d	AccessControl: Cleanup access control interface (#49783 ) * removed unused function * Rename interface	3 years ago
Karl Persson	5caf97be40	AccessControl: Replace IsEnterprise checks with license checks (#49572 )	3 years ago
sh0rez	3ca3a59079	pkg/web: remove dependency injection (#49123 ) * pkg/web: store http.Handler internally * pkg/web: remove injection Removes any injection code from pkg/web. It already was no longer functional, as we already only injected into `http.Handler`, meaning we only inject ctx.Req and ctx.Resp. Any other types (Context, ReqContext) were already accessed using the http.Request.Context.Value() method. * : remove type mappings Removes any call to the previously removed TypeMapper, as those were non-functional already. pkg/web: remove Context.Invoke was no longer used outside of pkg/web and also no longer functional	3 years ago
sh0rez	3d5d8c785b	pkg/web: restrict handler types (#48495 ) Makes `pkg/web` only accept handles from the following set: ```go handlerStd = func(http.ResponseWriter, http.Request) handlerStdCtx = func(http.ResponseWriter, http.Request, web.Context) handlerStdReqCtx = func(http.ResponseWriter, http.Request, models.ReqContext) handlerReqCtx = func(models.ReqContext) handlerReqCtxRes = func(models.ReqContext) Response handlerCtx = func(web.Context) ``` This is a first step to reducing above set to only `http.Handler`. --- Due to a cyclic import situation between `pkg/models` and `pkg/web`, parts of this PR were put into `pkg/api/response`, even though they definitely do not belong there. This however is _temporary_ until we untangle `models.ReqContext`.	3 years ago
Yuriy Tseretyan	258b3ab18b	Alerting: Fix RBAC actions for notification policies (#49185 ) * squash actions "alert.notifications:update", "alert.notifications:create", "alert.notifications:delete" to "alert.notifications:write" * add migration * update UI to use the write action * update docs * changelog	3 years ago
Karl Persson	f5ec4bcbd2	remove action to manage plugin that is not used or documented (#49309 )	3 years ago
Karl Persson	4a61f4111f	Remove unused error from evaluator Evaluate (#49305 )	3 years ago
Yuriy Tseretyan	f7f2253072	Alerting: Fix anonymous access to alerting (#49203 ) * introduce a fallback handler that checks that role is Viewer. * update UI nav links to allow alerting tabs for anonymous user * update rule api to check for Viewer role instead of SignedIn when RBAC is disabled	3 years ago
Gabriel MABILLE	5b6d20fbce	Access Control: Remove built-in role assignment by default (#49058 ) * Remove FF-bultins * Add a param to test br-simplifying	3 years ago
Kristin Laemmert	1df340ff28	backend/services: Move GetDashboard from sqlstore to dashboard service (#48971 ) * rename folder to match package name * backend/sqlstore: move GetDashboard into DashboardService This is a stepping-stone commit which copies the GetDashboard function - which lets us remove the sqlstore from the interfaces in dashboards - without changing any other callers. * checkpoint: moving GetDashboard calls into dashboard service * finish refactoring api tests for dashboardService.GetDashboard	3 years ago
Karl Persson	34be8f28b9	AccessControl: Add metadata to search result (#48879 ) * Add access control metadata to search hits if access control query string is passed	3 years ago
Ieva	f256f625d8	AccessControl: Enable RBAC by default (#48813 ) * Add RBAC section to settings * Default to RBAC enabled settings to true * Update tests to respect RBAC Co-authored-by: Karl Persson <kalle.persson@grafana.com>	3 years ago
Karl Persson	1c679e814b	AccessControl: Only return action and scope for user permissions and make them unique (#48939 ) * Only return action and scope for user permissions and make them unique	3 years ago
Karl Persson	58fa119270	sort user permissions by scope (#48928 )	3 years ago
Gabriel MABILLE	d31d300ce1	Accesscontrol: Rename scope permissions:delegate (#48898 )	3 years ago
Karl Persson	61772a66b6	AccessControl: Create own interface and impl for each permission service (#48871 ) * Create own interfaces for team, folder, dashboard and data source permissions services * Remove service container and inject them individually	3 years ago
Ieva	3c78196d0b	fix a bug (#48782 )	3 years ago
Ieva	a5672758d8	Access control: further reduce access control feature toggle checks (#48171 ) * reduce the usage of access control flag further by removing it from SQL store methods * fixing tests * fix another test * linting * remove AC feature toggle use from API keys * remove unneeded function	3 years ago
Karl Persson	2738d1c557	Access Control: Move dashboard actions and create scope provider (#48618 ) * Move dashboard actions and create scope provider	3 years ago
Jguer	6a303bb6b8	AccessControl: Rename builtin role roles to basic roles (#48519 ) * AccessControl: Rename grafana:builtins roles to basic * AccessControl: rename macro references to basic Co-authored-by: gamab <gabi.mabs@gmail.com>	3 years ago
Karl Persson	de50f39c12	Access Control: Refactor scope resolvers with support to resolve into several scopes (#48202 ) * Refactor Scope resolver to support resolving into several scopes * Change permission evaluator to match at least one of passed scopes	3 years ago
Karl Persson	9622e7457e	Fix permission query for postgres (#48543 )	3 years ago
Gabriel MABILLE	2cc276567d	AccessControl: Hide basic roles (#48549 ) Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	6c6137f45a	Access control: Pass access control metadata for api keys (#48445 ) * Move ApiKeyDTO to dtos package * Add access control filter to api keys * pass user in GetApiKeysQuery * Add api key metadata to DTO * Remove scope all requirement from get api keys endpoint * Handle api key access control metadata in frondend	3 years ago
Karl Persson	c207ea30eb	Access Control: Remove unused option (#48317 ) * Remove unused option	3 years ago
Artur Wierzbicki	736be74128	Chore: Add Usage stats providers registry (#48357 ) * add usage stats providers * migrate thumbnails service to `registry.ProvidesUsageStats` * snake -> camel * lint fix * migrate accesscontrol to `registry.ProvidesUsageStats` * add accesscontrol to usage stats providers registry * fix test * added a note about errors	3 years ago
Karl Persson	e9a93ebfc9	Access Control: Move access control middlewares to domain package (#48322 ) * Move access control middleware to domain package	3 years ago
Gabriel MABILLE	9ed7e48454	AccessControl: Modify provisioning to prevent built-in role assignment (#48031 ) * Add basic and managed prefixes to avoid magic strings For now let's stick with grafana_builtins add function isBasic to RoleDTO add function isBasic to Role Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Add team store to wire Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Jguer	3456793e0f	AccessControl: fix value copying in method access and add LogID (#47694 ) * AccessControl: fix value copying in method access and add LogID Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Lint. Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	3 years ago
Gabriel MABILLE	8bd825e16c	AccessControl: Make the built-in role definitions public (#47525 ) * AccessControl: Make the built-in role definitions public * Add context to RegisterFixedRoles Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Making BuiltInRolesWithParents public to the AccessControl package Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Ieva	ef4c2672b3	Access control: SQL filtering for annotation listing (#47467 ) * pass in user to attribute scope resolver * add SQL filter to annotation listing * check annotation FGAC permissions before exposing them for commenting * remove the requirement to be able to list all annotations from annotation listing endpoint * adding tests for annotation listing * remove changes that got moved to a different PR * unused var * Update pkg/services/sqlstore/annotation.go Co-authored-by: Ezequiel Victorero <evictorero@gmail.com> * remove unneeded check * remove unneeded check * undo accidental change * undo accidental change * doc update * move tests * redo the approach for passing the user in for scope resolution * accidental change * cleanup * error handling Co-authored-by: Ezequiel Victorero <evictorero@gmail.com>	3 years ago
Gabriel MABILLE	f7305965a4	AccessControl: Remove package lists for roles and grants (#47141 ) * AccessControl: Remove package variables for roles and grants Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Check for inheritance during role registration Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Moving back role definition to accessscontrol * Make settings reader role public Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Nits Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Forgot to update this * Account for declaration error * Fixing pkg/api init ossac * Account for error in tests * Update test to verify inheritance * Nits. * Place br inheritance behind a feature toggle * Parent -> Parents * Nit. Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago

... 2 3 4 5 6 ...

330 Commits (b8105caa05af19c8887a421e803e9591e14da5fe)