grafana

Commit Graph

Author	SHA1	Message	Date
Karl Persson	e4fbae03a1	RBAC: remove dead code (#97234 ) This code is unused and always have been	1 year ago
Ieva	cc0ec349a4	RBAC: Allow passing in user UID when searching for user's permissions (#97125 ) * allow passing in user UID instead of ID when searching for user's permissions * fix tests	1 year ago
Matheus Macabu	f2b96593ea	SQL: close rows to release connection (#97147 ) * SQL: close rows to release connection * dont return err from rows.Close()	1 year ago
Karl Persson	3990637af9	IAM: remove duplicated functions (#96989 ) * Remove duplicated function and use the one provided by claims package	1 year ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551 ) * Revert "chore: add replDB to team service (#91799)" This reverts commit `c6ae2d7999`. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit `54177ca619`. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit `299c142f6a`. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit `ac0b4bb34d`. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit `daedb358dd`. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit `af19f039b6`. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit `27b52b1507`. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit `8a6107cd35`. * Revert "accesscontrol service read replica (#89963)" This reverts commit `77a4869fca`. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit `ab5a079bcc`. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit `d988f5c3b0`. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit `50244ed4a1`.	1 year ago
Gabriel MABILLE	8d84517103	AuthN: Introduce `DefaultOrgID` function for managed service accounts (#93432 ) * Managed Service Accounts: Use AutoAssignOrgID * Fix the IsExternalServiceAccount function * Reassign service account role * Account for AutoAssignOrg * Update pkg/services/serviceaccounts/models.go * Simplify IsExternalServiceAccount function * Add tests * Easier to understand test * Revert small change	1 year ago
Karl Persson	ddee95cb6d	Team: Create permission type for team membership (#92352 ) * Create permission type enum for team and remove usage of dashboard permission type	1 year ago
Jeff Levin	028e8ac59e	Instrument tracing across accesscontrol (#91864 ) Instrument tracing across accesscontrol --------- Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	1 year ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801 ) * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	1 year ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763 )	1 year ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567 )	1 year ago
Kristin Laemmert	77a4869fca	accesscontrol service read replica (#89963 ) * accesscontrol service read replica * now using the ReplDB interface * ReadReplica for GetUser	2 years ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116 )	2 years ago
Ieva	34c40f959f	RBAC: Add and resolve action sets when searching user's permissions (#88694 ) * include and resolve action sets when fetching user's permissions * expand both action and action prefix (returns an empty set for the one that isn't specified) Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * if action is specified, check for exact match; also extend tests	2 years ago
Eric Leijonmarck	910553df20	Actionsets: Add cfg option for only writing actionsets (#88367 ) * test * test * missed test * fix review comments	2 years ago
Ieva	105313f5c2	RBAC: Adding action set resolver for RBAC evaluation (#86801 ) * add action set resolver * rename variables * some fixes and some tests * more tests * more tests, and put action set storing behind a feature toggle * undo change from cfg to feature mgmt - will cover it in a separate PR due to the amount of test changes * fix dependency cycle, update some tests * add one more test * fix for feature toggle check not being set on test configs * linting fixes * check that action set name can be split nicely * clean up tests by turning GetActionSetNames into a function * undo accidental change * test fix * more test fixes	2 years ago
Alexander Zobnin	82dea4b3e5	Access control: Cache basic roles and teams permissions (#87043 ) * RBAC: Cache basic roles permissions * Cache teams permissions * Set cache TTL to 1 minute * Add OSS implementation * Fetch basic role permissions correctly * fix conflict_user_command * Fix teams permissions query * Add traces for GetUserPermissions * Fix folders tests * Fix colflict user command * Update store mock * Fix linter error * Reuse GetUserPermissions for fetching basic roles * tests for GetTeamsPermissions * pre-allocate slice capacity * Fix linter	2 years ago
Dan Cech	41bee274fd	Chore: Fix error handling in postDashboard, remove UserDisplayDTO, fix live redis client initialization (#87206 ) * clean up error handling in postDashboard and remove UserDisplayDTO * replace GetUserUID with GetUID and GetNamespacedUID, enforce namespace constant type * lint fix * lint fix * more lint fixes	2 years ago
Karl Persson	a2cba3d0b5	User: Add tracing (#87028 ) * Inject tracer in tests * Annotate with traces Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Ieva	cee713e34c	Chore: Add tracing to team service (#86999 ) * add tracing to team service * another test fix * pass in context for team creation and membership checking	2 years ago
Ieva	8028d1c3e1	Chore: Update tests to use team membership hooks (#86846 ) * update tests to use team membership hooks * linting	2 years ago
Serge Zaitsev	522a98c126	Chore: Make Cfg field private in SQLStore (#85593 ) * make cfg private in sqlstore * fix db init in tests * fix case * fix folder test init * fix imports * make another Cfg private * remove another Cfg * remove unused variable * use store cfg, it has side-effects * fix mutated cfg in tests	2 years ago
Eric Leijonmarck	ddabef9895	RBAC: Add actionsets struct and write path (#86108 ) * Add actionsets struct and failing test * update from review * review comments * review comments update * refactor: create interface * actionset service * fix tests * move from wireoss to wire * Apply suggestions from code review remove unnecessary comments Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * nil for the actionsetservice * Revert "nil for the actionsetservice" This reverts commit `e3d3cc8171`. --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Gabriel MABILLE	5e48804364	RBAC: Fix slow user permission search query on MySQL (#85058 ) * Bench testing search user perm * Add BenchmarkSearchUsersPermissions_1K_1K * Clarify benchmark searches by action prefix * Make MySQL more efficient * Move all filter options * Expand after assignments union * update comments	2 years ago
Alexander Zobnin	82a88cc83f	Access control: Extend GetUserPermissions() to query permissions in org (#83392 ) * Access control: Extend GetUserPermissions() to query permissions in specific org * Use db query to fetch permissions in org * refactor * refactor * use conditional join * minor refactor * Add test cases * Search permissions correctly in OSS vs Enterprise * Get permissions from memory * Refactor * remove unused func * Add tests for GetUserPermissionsInOrg * fix linter	2 years ago
Gabriel MABILLE	8d9921a5ba	RBAC: Fix delete team permissions on team delete (#83442 ) * RBAC: Remove team permissions on delete * Remove unecessary deletes from store function * Nit on mock * Add test to the database * Nit on comment * Add another test to check that other permissions remain	2 years ago
Jo	cc3b088b6c	Teams: Fix missing context in team service (#83327 ) fix missing context in team service	2 years ago
Gabriel MABILLE	846eadff63	RBAC Search: Replace `userLogin` filter by `namespacedID` filter (#81810 ) * Add namespace ID * Refactor and add tests * Rename maxOneOption -> atMostOneOption * Add ToDo * Remove UserLogin & UserID for NamespaceID Co-authored-by: jguer <joao.guerreiro@grafana.com> * Remove unecessary import of the userSvc * Update pkg/services/accesscontrol/acimpl/service.go * fix 1 -> userID * Update pkg/services/accesscontrol/accesscontrol.go --------- Co-authored-by: jguer <joao.guerreiro@grafana.com>	2 years ago
Karl Persson	1315c67c8b	Team/User: UID migrations (#82298 ) * Add user uid migration to run on every startup to protect against empty values in a upgrade downgrade scenario * Add team uid migration to run on every startup to protect against empty values in a upgrade downgrade scenario * Run team uid migration	2 years ago
Dan Cech	790e1feb93	Chore: Update test database initialization (#81673 ) * streamline initialization of test databases, support on-disk sqlite test db * clean up test databases * introduce testsuite helper * use testsuite everywhere we use a test db * update documentation * improve error handling * disable entity integration test until we can figure out locking error	2 years ago
Gabriel MABILLE	dce9d1e87c	RBAC: Search endpoint support wildcards (#80383 ) * RBAC: Search endpoint support wildcards * Allow wildcard filter with RAM permissions as well	2 years ago
Gabriel MABILLE	72d32eed27	ExtSvcAuth: Assign roles locally (#78669 ) * ExtSvcAuth: Assign roles locally * Fix test * HandlePluginStateChanged in the OrgID * Remove Global from command * Use AssignmentOrgID instead of OrgID * Remove unecessary test case	2 years ago
Jo	0de66a8099	Authz: Remove use of SignedInUser copy for permission evaluation (#78448 ) * remove use of SignedInUserCopies * add extra safety to not cross assign permissions unwind circular dependency dashboardacl->dashboardaccess fix missing import * correctly set teams for permissions * fix missing inits * nit: check err * exit early for api keys	2 years ago
Karl Persson	ae5e03034b	RBAC: generated prefixed uids for external service role (#76601 ) * Replace FixedRoleUID function with a common function to generate these prefixes * Use common function to generate prefixed uid for external service accounts Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com> --------- Co-authored-by: Gabriel MABILLE <gabriel.mabille@grafana.com>	2 years ago
Gabriel MABILLE	729f9a01a0	RBAC: Fix search user permissions (#74729 ) Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066 )	2 years ago
Ieva	cfa1a2c55f	RBAC: Split non-empty scopes into `kind`, `attribute` and `identifier` fields for better search performance (#71933 ) * add a feature toggle * add the fields for attribute, kind and identifier to permission Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * set the new fields when new permissions are stored * add migrations Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * remove comments * Update pkg/services/accesscontrol/migrator/migrator.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * feedback: put column migrations behind the feature toggle, added an index, changed how wildcard scopes are split * PR feedback: add a comment and revert an accidentally changed file * PR feedback: handle the case with : in resource identifier * switch from checking feature toggle through cfg to checking it through featuremgmt * don't put the column migrations behind a feature toggle after all - this breaks permission queries from db --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Misi	607670a9fa	Auth: Use SHA-1 for generating an ID for External Service Role (#71079 ) * Use sha1 (160 bit hash) * Update pkg/services/accesscontrol/database/externalservices.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Satisfy linter, clean up --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
Ryan McKinley	e7da2a179e	Schema: Add schema for role+access policies (#68047 )	3 years ago
Gabriel MABILLE	d7eea0d207	RBAC: Add a function to delete external service roles (#68317 ) * RBAC: Add function to delete external service roles * Adding a test to the service * Update pkg/services/accesscontrol/acimpl/service_test.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Gabriel MABILLE	8c6b5a4319	RBAC: Add a function to save external service roles (#66299 ) * AuthN: Save external services RBAC roles * Add missing test * Placing roles in the same group * Split function to gen role and assignment * add test case and comments * Ensure we check external service roles are assigned once only * Update pkg/services/accesscontrol/models_test.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> --------- Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	3 years ago
Jo	c8db771939	Users: Fix org user always getting org id = 1 on auto assign false (#63708 ) * fix org user always getting org id = 1 on auto assign false * make tests explicit * use correct cfg in service accounts * fix api tests * fix database test of ac * fix InsertOrgUser returning affected rows as orgID	3 years ago
Jo	f9163351fd	Support bundles: Refactor registry into separate service (#62945 ) * add bundle registry service to avoid dependency cycles * move user support bundle collector to user service * move usage stat bundle implementation to usage stats * add info for background service * fix remaining imports * whitespace	3 years ago
Kristin Laemmert	e8b8a9e276	chore: move dashboard_acl models into dashboard service (#62151 )	3 years ago
idafurjes	f2ffce4351	Chore: Move team models to models pkg (#61262 ) * Chore: Move team models to models pkg * Fix ACL tests * More ACL tests * Change Id to ID in conflict user command test * Remove team from models * Fix ac test lint	3 years ago
Ieva	6aa5a79cad	Access control: endpoint for searching single user permissions (#59669 ) * initial commit * clean up * fix a bug and add tests * more tests * undo some unintended changes * undo some unintended changes * linting * PR feedback - add user ID to search options * simplify the query * Apply suggestions from code review Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * remove unneeded formatting changes Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
Karl Persson	6d1bcd9f40	DataSourcePermissions: Handle licensing properly for ds permissions (#59694 ) * RBAC: add viewer grand if dspermissions enforcement is not enabled * RBAC: Change permissions based on role prefix * RBAC: Add option to for permission service to add a license middleware * RBAC: Remove actions from query struct	3 years ago
Gabriel MABILLE	bf49c20050	RBAC: Add an endpoint to list all user permissions (#57644 ) * RBAC: Add an endpoint to see all user permissions Co-authored-by: Joey Orlando <joey.orlando@grafana.com> * Fix mock * Add feature flag * Fix merging * Return normal permissions instead of simplified ones * Fix test * Fix tests * Fix tests * Create benchtests * Split function to get basic roles * Comments * Reorg * Add two more tests to the bench * bench comment * Re-ran the test * Rename GetUsersPermissions to SearchUsersPermissions and prepare search options * Remove from model unused struct * Start adding option to get permissions by Action+Scope * Wrong import * Action and Scope * slightly tweak users permissions actionPrefix query param validation logic * Fix xor check * Lint * Account for suggeston Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add search * Remove comment on global scope * use union all and update test to make it run on all dbs * Fix MySQL needs a space * Account for suggestion. Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Joey Orlando <joey.orlando@grafana.com> Co-authored-by: Joey Orlando <joseph.t.orlando@gmail.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	7386f8652c	RBAC: Improve performance of dashboard filter query (#56813 ) * RBAC: Move UserRolesFilter to domain package * Dashboard Permissions: Rewrite rbac filter to check access in sql * RBAC: Add break when wildcard is found * RBAC: Add tests for dashboard filter * RBAC: Update tests * RBAC: Cover more test cases Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087 ) * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago

1 2

93 Commits (c440bd2bdaec8fed13f47fdfe76dda63e7d0008a)