438 Commits (c8ce20a807819626979fdf3facce1db53ec511d9)

Author	SHA1	Message	Date
Jeff Levin	ed13959e33	Optimize memory allocations in permissions cache (#89645) ... This PR reduces the number of allocations made while caching permissions from the database, fixes the hierarchy of spans and adds new spans for tracing. --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	11 months ago
Gabriel MABILLE	f0ff7d57b4	RBAC: Allow folders actions in plugins roles (#89523) ... * Allow some additional core actions for plugins * typo * Test nit.	11 months ago
Yuri Tseretyan	b075926202	Alerting: Time Intervals API (#88201) ... * expose ngalert API to public * add delete action to time-intervals * introduce time-interval model generated by app-platform-sdk from CUE model the fields of the model are chosen to be compatible with the current model * implement api server * add feature flag alertingApiServer ---- Test Infra * update helper to support creating custom users with enterprise permissions * add generator for Interval model	11 months ago
Dave Henderson	6262c56132	chore(perf): Pre-allocate where possible (enable prealloc linter) (#88952) ... * chore(perf): Pre-allocate where possible (enable prealloc linter) Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * fix TestAlertManagers_buildRedactedAMs Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * prealloc a slice that appeared after rebase Signed-off-by: Dave Henderson <dave.henderson@grafana.com> --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com>	12 months ago
Ieva	4e3294cd8d	RBAC: Fix the check for whether an action set should be added (#89219) ... fox the check for whether an action set should be added	12 months ago
Ieva	bd35fa10f1	RBAC: Resolve action sets when `GetPermissions` is called (#89046) ... * resolve action sets when GetPermissions is called * a fix to ensure that dashboard permissions that override parent folder permissions are displayed on top of the inherited permission * linting * linting pt2	12 months ago
Ieva	1ac395b785	RBAC: Only store action sets for dashboards and folders (#89053) ... * don't store action sets for resources other than dashboards and folders * remove unneeded comment	12 months ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	12 months ago
Ieva	34c40f959f	RBAC: Add and resolve action sets when searching user's permissions (#88694) ... * include and resolve action sets when fetching user's permissions * expand both action and action prefix (returns an empty set for the one that isn't specified) Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * if action is specified, check for exact match; also extend tests	12 months ago
Aaron Godin	59a6a6513f	Prevent moving a k6 folder (#88884) ... * iam-716 - prevent a folder move operation when the folder's uid or any of its parents uids begin with k6-app * fox folder move check and only list non-k6 folders to users * adding tests for moving * add a test for listing folders * fix the other tests * use method that adds folder parent --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	12 months ago
Ieva	c16f502ec5	Access Control: Clean up permissions for deprovisioned data sources (#88483) ... * make sure that DS permissions get correctly cleaned up when a DS is deleted through provisioning * don't attempt to delete a DS if it's not found * fixes for tests * fix ds tests * rename DS service used by DS provisioner to BaseDataSourceService to avoid confusions with the full DS service	12 months ago
Ieva	1c2ae2c72d	Dashboards: Correctly display Admin access to dashboards in the UI (#88439) ... * include folder wildcard scope in dash permission inheritance * Update pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go Co-authored-by: Karl Persson <kalle.persson@grafana.com> --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com>	1 year ago
Eric Leijonmarck	910553df20	Actionsets: Add cfg option for only writing actionsets (#88367) ... * test * test * missed test * fix review comments	1 year ago
Ieva	bd2b248f0e	RBAC: Clean up action set code (#88147) ... * remove unused action set code, refactor the existing code * fix import ordering * use a separate interface for permission expansion after all, to avoid circular dependencies * add comments, fix a test	1 year ago
Ieva	3e77768144	RBAC: Expand action sets when fetching permissions (#87967) ... * logic to expand action set to the underlying actions when permissions are fetched from the DB * updates needed for dependency injection * clean up some code, also deduplicate scopes when grouping scopes and actions * expand on a comment * rename a method	1 year ago
Ieva	da1a99d729	Team: Add an endpoint for bulk team membership updates (#87441) ... * add an endpoint for bulk team membership updates * update comment * schema gen * test fix * add swagger parameter definition	1 year ago
Gabriel MABILLE	e7d5622969	RBAC: No need to filter permissions on cache hit (#87941)	1 year ago
Ieva	167151b211	Chore: Remove use of deprecated method in AC code (#87541) ... * switch from using cfg to using featuremgmt for checking a feature toggle in AC code * merge test fixes	1 year ago
Alexander Zobnin	0302b75721	Access control: Use search options for computing permissions cache key (#87589)	1 year ago
Yuri Tseretyan	356a29592b	Alerting: Add two sets of provisioning actions for rules and notifications (#87149)	1 year ago
Ieva	105313f5c2	RBAC: Adding action set resolver for RBAC evaluation (#86801) ... * add action set resolver * rename variables * some fixes and some tests * more tests * more tests, and put action set storing behind a feature toggle * undo change from cfg to feature mgmt - will cover it in a separate PR due to the amount of test changes * fix dependency cycle, update some tests * add one more test * fix for feature toggle check not being set on test configs * linting fixes * check that action set name can be split nicely * clean up tests by turning GetActionSetNames into a function * undo accidental change * test fix * more test fixes	1 year ago
Alexander Zobnin	d1c582815a	Access control: Fix searching permissions from cache (#87489) ... * Fix searching permissions from cache * Write permissions to cache	1 year ago
Ieva	9a824bdf0a	RBAC: Don't set empty action sets (#87398) ... * don't set empty action sets * extend comment	1 year ago
Karl Persson	be5ced4287	Identity: Use typed version of namespace id (#87257) ... * Remove different constructors and only use NewNamespaceID * AdminUser: check typed namespace id * Identity: Add convinient function to parse valid user id when type is either user or service account * Annotations: Use typed namespace id instead	1 year ago
Eric Leijonmarck	6b218b11cf	Actionsets: fix remove printf (#87439) ... fix: remove printf	1 year ago
Alexander Zobnin	82dea4b3e5	Access control: Cache basic roles and teams permissions (#87043) ... * RBAC: Cache basic roles permissions * Cache teams permissions * Set cache TTL to 1 minute * Add OSS implementation * Fetch basic role permissions correctly * fix conflict_user_command * Fix teams permissions query * Add traces for GetUserPermissions * Fix folders tests * Fix colflict user command * Update store mock * Fix linter error * Reuse GetUserPermissions for fetching basic roles * tests for GetTeamsPermissions * pre-allocate slice capacity * Fix linter	1 year ago
Dan Cech	41bee274fd	Chore: Fix error handling in postDashboard, remove UserDisplayDTO, fix live redis client initialization (#87206) ... * clean up error handling in postDashboard and remove UserDisplayDTO * replace GetUserUID with GetUID and GetNamespacedUID, enforce namespace constant type * lint fix * lint fix * more lint fixes	1 year ago
Eric Leijonmarck	601485c74d	Actionsets: Fix downgrade of permission to add the actionset permission (#87328) ... * check for missingActions empty and add actionset * spelling	1 year ago
Karl Persson	d8fbbdefea	Identity: Use typed namespace id (#87121) ... * Use typed namespace id	1 year ago
Ieva	28dd1ddd8e	RBAC: Do not set permissions on data sources with wildcard UID in OSS (#87220) ... do not set permissions on DS with wildcard UID	1 year ago
Ieva	5e060d2d99	Data source: Maintain the default data source permissions when switching from unlicensed to licensed Grafana (#87119) ... set managed data source permissions upon resource creation for unlicensed Grafana, remove them on deletion	1 year ago
Karl Persson	a2cba3d0b5	User: Add tracing (#87028) ... * Inject tracer in tests * Annotate with traces Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
Ieva	cee713e34c	Chore: Add tracing to team service (#86999) ... * add tracing to team service * another test fix * pass in context for team creation and membership checking	1 year ago
Ieva	8028d1c3e1	Chore: Update tests to use team membership hooks (#86846) ... * update tests to use team membership hooks * linting	1 year ago
Serge Zaitsev	522a98c126	Chore: Make Cfg field private in SQLStore (#85593) ... * make cfg private in sqlstore * fix db init in tests * fix case * fix folder test init * fix imports * make another Cfg private * remove another Cfg * remove unused variable * use store cfg, it has side-effects * fix mutated cfg in tests	1 year ago
Karl Persson	0fa983ad8e	AuthN: Use typed namespace id inside authn package (#86048) ... * authn: Use typed namespace id inside package	1 year ago
Eric Leijonmarck	ddabef9895	RBAC: Add actionsets struct and write path (#86108) ... * Add actionsets struct and failing test * update from review * review comments * review comments update * refactor: create interface * actionset service * fix tests * move from wireoss to wire * Apply suggestions from code review remove unnecessary comments Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * nil for the actionsetservice * Revert "nil for the actionsetservice" This reverts commit e3d3cc8171. --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 year ago
Aaron Godin	d409d8e860	IAM - Fix error messages for resource permissions endpoints (#85773) ... * IAM: fix many error messages in access-related code to provide more information * Remove debug statement * Refactor resourcepermissions package to use errutil * Replace a few more errors with errutil and wrap errors found in users and teams services * Apply diff of openAPI spec	1 year ago
Yuri Tseretyan	12605bfed2	Alerting: Update fixed roles to include silences permissions (#85826) ... * update fixed roles to include silences * add silence actions to managed permissions * update documentation	1 year ago
Karl Persson	73fecc8d80	Authn: Identity resolvers (#85930) ... * AuthN: Add NamespaceID struct. We should replace the usage of encoded namespaceID with this one * AuthN: Add optional interface that clients can implement to be able to resolve identity for a namespace * Authn: Implement IdentityResolverClient for api keys * AuthN: use idenity resolvers Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	1 year ago
Ieva	58059da10b	RBAC: Fix global role deletion in hosted Grafana (#85980) ... take into account the value of RBACSingleOrganization setting when determining org	1 year ago
Alexander Zobnin	3127566a20	Access control: Use ResolveIdentity() for authorizing in org (#85549) ... * Access control: Use ResolveIdentity() for authorizing in org * Fix tests * Fix middleware tests * Use ResolveIdentity in HasGlobalAccess() function * remove makeTmpUser * Cleanup * Fix linter errors * Fix test build * Remove GetUserPermissionsInOrg()	1 year ago
Yuri Tseretyan	509691b416	Alerting: Introduce authorization logic for operations on silences (#85418) ... * extract genericService from RuleService just to reuse it later * implement silence service --------- Co-authored-by: William Wernert <william.wernert@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	1 year ago
Serge Zaitsev	faa1244518	Chore: Replace sqlstore with db interface (#85366) ... * replace sqlstore with db interface in a few packages * remove from stats * remove sqlstore in admin test * remove sqlstore from api plugin tests * fix another createUser * remove sqlstore in publicdashboards * remove sqlstore from orgs * clean up orguser test * more clean up in sso * clean up service accounts * further cleanup * more cleanup in accesscontrol * last cleanup in accesscontrol * clean up teams * more removals * split cfg from db in testenv * few remaining fixes * fix test with bus * pass cfg for testing inside db as an option * set query retries when no opts provided * revert golden test data * rebase and rollback	1 year ago
Karl Persson	504870f10a	Auth: Decouple client and hook registration (#85084)	1 year ago
Ieva	beb15d938b	RBAC: Fix access checks for interactions with RBAC roles in hosted Grafana (#85485) ... * don't check global permissions for cloud instances * linting	1 year ago
Jo	5340a6e548	Auth: Extended JWT client for OBO and Service Authentication (#83814) ... * reenable ext-jwt-client * fixup settings struct * add user and service auth * lint up * add user auth to grafana ext * fixes * Populate token permissions Co-authored-by: jguer <joao.guerreiro@grafana.com> * fix tests * fix lint * small prealloc * small prealloc * use special namespace for access policies * fix access policy auth * fix tests * fix uncalled settings expander * add feature toggle * small feedback fixes * rename entitlements to permissions * add authlibn * allow viewing the signed in user info for non user namespace * fix invalid namespacedID * use authlib as verifier for tokens * Update pkg/services/authn/clients/ext_jwt.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/authn/clients/ext_jwt_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix parameter names * change asserts to normal package * add rule for assert * fix ownerships * Local diff * test and lint * Fix test * Fix ac test * Fix pluginproxy test * Revert testdata changes * Force revert on test data --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
linoman	147154d2ea	Remove AuthConfigUIAdminAccess (#85452) ... * Remove AuthConfigUIAdminAccess	1 year ago
Karl Persson	5dd98a0fd5	RBAC: handle partially resolved scopes (#85323) ... * RBAC: handle partially resolved scopes Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
Gabriel MABILLE	5e48804364	RBAC: Fix slow user permission search query on MySQL (#85058) ... * Bench testing search user perm * Add BenchmarkSearchUsersPermissions_1K_1K * Clarify benchmark searches by action prefix * Make MySQL more efficient * Move all filter options * Expand after assignments union * update comments	1 year ago