80 Commits (d763aae5f2bb12c7ddc3412997ed144f6669463f)

Author	SHA1	Message	Date
grafana-delivery-bot[bot]	d763aae5f2	[v11.3.x] Service Accounts: Run service account creation in transaction (#94803) ... Service Accounts: Run service account creation in transaction (#94744) * run service account creation DB queries in transaction * extract the signed in user from the context * undo unneeded change * don't error out if a user is not found * Update pkg/services/serviceaccounts/manager/service.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * Update pkg/services/serviceaccounts/manager/service.go Co-authored-by: Karl Persson <kalle.persson@grafana.com> --------- Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> Co-authored-by: Karl Persson <kalle.persson@grafana.com> (cherry picked from commit ca1fd028a2) Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	8 months ago
Gabriel MABILLE	7928245eb6	ManagedServiceAccounts: Add a config option to disable the feature on-prem (#93571) ... * ManagedServiceAccounts: Add a config option to disabled by default * Update log in pkg/services/extsvcauth/registry/service.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	9 months ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801) ... * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	11 months ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763)	11 months ago
Karl Persson	bcfb66b416	Identity: remove GetTypedID (#91745)	11 months ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567)	11 months ago
Ieva	9bb2cf4968	RBAC: Allow omitting default permissions when a new resource is created (#90720) ... * Cfg: Move rbac settings to own struct * Cfg: Add setting to control if resource should generate managed permissions when created * Dashboards: Check if we should generate default permissions when dashboard is created * Folders: Check if we should generate default permissions when folder is created * Datasource: Check if we should generate default permissions when datasource is created * ServiceAccount: Check if we should generate default permissions when service account is created * Cfg: Add option to specify resources for wich we should default seed * ManagedPermissions: Move providers to their own files * Dashboards: Default seed all possible managed permissions if configured * Folders: Default seed all possible managed permissions if configured * Cfg: Remove service account from list * RBAC: Move utility function * remove managed permission settings from the config file examples, change the setting names * remove ini file changes from the PR * fix setting reading * fix linting errors * fix tests * fix wildcard role seeding --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: jguer <me@jguer.space>	11 months ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	1 year ago
Dave Henderson	5687243d0b	Feature Flags: use FeatureToggles interface where possible (#85131) ... * Feature Flags: use FeatureToggles interface where possible Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * Replace TestFeatureToggles with existing WithFeatures Signed-off-by: Dave Henderson <dave.henderson@grafana.com> --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com>	1 year ago
Gabriel MABILLE	80d6bf6da0	AuthN: Remove embedded oauth server (#83146) ... * AuthN: Remove embedded oauth server * Restore main * go mod tidy * Fix problem * Remove permission intersection * Fix test and lint * Fix TestData test * Revert to origin/main * Update go.mod * Update go.mod * Update go.sum	1 year ago
Marcus Efraimsson	6768c6c059	Chore: Remove public vars in setting package (#81018) ... Removes the public variable setting.SecretKey plus some other ones. Introduces some new functions for creating setting.Cfg.	1 year ago
Ryan McKinley	f69fd3726b	FeatureToggles: Add context and and an explicit global check (#78081)	2 years ago
linoman	5bc4f56c79	IAM: Protect external service accounts frontend list page (#77834) ... * Add `isExternal` property to frontend model * Remove enabled and token buttons for external SA * Replace trash icon for lock icon for external SA * Block the role picker for external SA * Filter SA list using the external filter * Add only external filter at backend --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
linoman	1bc81b7bd1	auth: migrate api interface implementation (#77040) ... * expand serviceaccount service interface * implemet FakeServiceAccountService * Replace SA service interface from api * merge sa proxy tests with new fake service * implement DeleteServiceAccountToken * add test for DeleteServiceAccountToken	2 years ago
Carl Bergquist	764478b9e7	Instrumentation: Set auth as owners for more routes (#75105) ... Signed-off-by: bergquist <carl.bergquist@gmail.com>	2 years ago
Jo	67de18ff06	Auth: Move Service Account service to SignedInUser Interface (#73142) ... * move service account service to identity interface * Update pkg/services/auth/identity/requester.go	2 years ago
Eric Leijonmarck	081f59feba	Service accounts: UI migration results (#68789) ... * ui migration WIP * merge * migration tests for api * revert chagnes to align with main * revert chagnes to align with main * revert chagnes to align with main * remove unused code and comments * revert gen files * retry logic inplace * fix a any * fixed types * migraiton results now show only result if no failures * review comments * wording to make it more actionable * add migraiton summary text onyl for failed apikeys * fixed wording and added a close button to the modal * made the button close the modal * moved state into component * fix based on review, naming and removed unused code * service account migration state optional * making migration result undefined * showing total and migrated numbers for a successful migration * fix payload const to take the payload	2 years ago
Ieva	d8b66d5c4b	RBAC: remove some `IsDisabled` checks (#69272) ... * remove some access contorl IsDisabled() checks * cleaning up tests * update tests * linting	2 years ago
Ieva	4980b64274	RBAC: Remove legacy ac from authorization middleware (#68898) ... remove legacy AC fallback from RBAC middleware, and some unused auth logic	2 years ago
Ieva	1d1f58f0ed	Service accounts: fix usage of `errutil` errors and convert more errors to `errutil` (#64299) ... * fix usage of errutil errors and convert more errors to errutil * fix tests	2 years ago
Eric Leijonmarck	ad4b053231	API keys: Remove state hideAPIkeys and refactor interface to IsDisabled (#64018) ... * remove state and refactor interface to IsDisabled * update docs and span * Update pkg/services/apikey/apikey.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	2 years ago
Eric Leijonmarck	76bc288d67	Service accounts: Remove revertapikeys endpoint (#64020) ... * remove revertapikeys endpoints * remove unused method	2 years ago
Ieva	3fb1894739	Service accounts: Creation logic simplification (#63884) ... * SA creation improvements * PR feedback - put salt and rand back in and remove an unneeded line:	2 years ago
Eric Leijonmarck	9d6ab92e39	Service accounts: Remove Add API keys buttons and remove one state of migrating for API keys tab (#63411) ... * add: hide apikeys tab on start * make use of store method * added hiding of apikeys tab for new org creation * missing err check * removed unused files * implemennted fake to make tests run * move check for globalHideApikeys from org to admin * refactor to remove the fake * removed unused method calls for interface * Update pkg/services/serviceaccounts/manager/service.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Update pkg/services/serviceaccounts/manager/service.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * remove the checkglobal method * removed duplicate global set const * add count of apikeys for performance * remove apikeys adding in UI * added back deleted file * added comment on component * changed wording and copy for hiding and migrating service accounts * refactor: remove migrationstatus in front/backend This removes the migrationstatus state from the UI in favor of only looking at the number of API keys to determine what to show to the user. This simplifies the logic and makes less calls to the backend with each page load. This was called both on the API keys page and the Service accounts page. - removes the state of migrationstatus from the UI - removes the backend call - removes the backend endpoint for migrationstatus * Update pkg/services/apikey/apikeyimpl/xorm_store.go Co-authored-by: Karl Persson <kalle.persson@grafana.com> * changes the contet to also be primary * change id of version for footer component --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> Co-authored-by: Karl Persson <kalle.persson@grafana.com>	2 years ago
suntala	51bef166c2	Chore: Remove Result field from serviceaccounts, ualert (#62476) ... * Chore: Remove Result field from serviceaccounts * Chore: Remove Result field from ualert	2 years ago
idafurjes	6c5a573772	Chore: Move ReqContext to contexthandler service (#62102) ... * Chore: Move ReqContext to contexthandler service * Rename package to contextmodel * Generate ngalert files * Remove unused imports	2 years ago
Eric Leijonmarck	371d7850a5	Auth: Service account store refactor (#58961) ... * refactor: renaming of files from database to store * refactor: make service account store private - moves store interface to manager package - adds an interface to the ProvideAPI constructor - refactors tests to use the store when necessary - adds mocks for the new interface implementations in the tests package * wip * refactor: make fakestore in service * wip * wip * wip * working tests * trailing whitespaces * Update pkg/services/serviceaccounts/api/api.go * Update pkg/services/serviceaccounts/tests/common.go * Update pkg/services/serviceaccounts/tests/common.go * refactor: doc string for retriever * fix import unused * remove: serviceaccount from featuretoggle * added: back legacy serviceaccounts feature toggle * added: docs * refactor: make query for the SearchQuery * add: validation of service input fields * add validation	3 years ago
Ieva	a8bae3f0b0	Access Control: Clear user's permission cache after resource creation (#59101) ... * refresh user's permission cache after resource creation * clear the cache instead of reloading the permissions * don't error if can't clear cache * fix tests * fix tests again	3 years ago
Jo	4a9137ac40	API Keys: Add revocation for SATs (#53896) ... * add apikey is_revoked field * add token store tests * Apply suggestions from code review * remove unused fields	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343) ... * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445) ... * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Sofia Papagiannaki	7ba076de10	Chore: Move swagger definitions to the handlers (#52643)	3 years ago
Vardan Torosyan	18867d6d78	Service account: Ensure that you can revert only service accounts which you can access (#52626) ... * Service account: Ensure that you can revert only service accounts which you can access * Remove prettier messup with docs * Remove prettier messup with docs * Prettier run	3 years ago
Ieva	d85df0a560	Service Accounts: Managed permissions for service accounts (#51818) ... * backend changes * frontend changes * linting * nit * import order * allow SA creator to access the SA page * fix merge * tests * fix frontend tests Co-authored-by: alexanderzobnin alexanderzobnin@gmail.com	3 years ago
Vardan Torosyan	5eaba5b5b2	Service account: Update service accounts creation (#51848)	3 years ago
Vardan Torosyan	f1661166b2	Service accounts: Grafana service accounts are enabled by default (#51402) ... * Remove feature flag for service accounts * Fix failing tests and remove remaining usage * Fix failing tests and remove remaining usage	3 years ago
Alexander Zobnin	859148942e	Service accounts: refactor errors (#50917)	3 years ago
Jguer	f3e3828279	ServiceAccounts: Fix errors returning API key and simplify conditions (#50885) ... * ServiceAccounts: Fix naming API key->Service account token * simplify redundant elses * Apply suggestions from code review Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	3 years ago
Alexander Zobnin	f82264c2b1	ServiceAccounts: API keys migration (#50002) ... * ServiceAccounts: able to get upgrade status * Banner with API keys migration info * Show API keys migration info on Service accounts page * Migrate individual API keys * Use transaction for key migration * Migrate all api keys to service accounts * Hide api keys after migration * Migrate API keys separately for each org * Revert API key * Revert key API method * Rename migration actions and reducers * Fix linter errors * Tests for migrating single API key * Tests for migrating all api keys * More tests * Fix reverting tokens * API: rename convert to migrate * Add api route descriptions to methods * rearrange methods in api.go * Refactor: rename and move some methods * Prevent assigning tokens to non-existing service accounts * Refactor: ID TO Id * Refactor: fix error message * Delete service account if migration failed * Fix linter errors	3 years ago
Alexander Zobnin	50538d5309	ServiceAccounts: refactor UI (#49508) ... * ServiceAccounts: refactor ServiceAccountRoleRow * Refactor ServiceAccountRoleRow * Refactor ServiceAccountProfile * Refactor components * Change service accounts icon * Refine service accounts page header * Improve service accounts filtering * Change delete button style * Tweak account id * Auto focus name field when create service account * Add disable/enable button * Enable/disable service accounts * Optimize updating service account (do not fetch all) * Remove status column (replace by enable/disable button) * Add banner with service accounts description * Add tokens from main page * Update tokens count when add token from main page * Fix action buttons column * Fix tokens count when change role * Refine table row classes * Fix buttons * Simplify working with state * Show message when service account updated * Able to filter disabled accounts * Mark disabled accounts in a table * Refine disabled account view * Move non-critical components to separate folder * Remove confusing focusing * Fix date picker position when creating new token * DatePicker: able to set minimum date that can be selected * Don't allow to select expiration dates prior today * Set tomorrow as a default token expiration date * Fix displaying expiration period * Rename Add token button * Refine page styles * Show modal when disabling SA from main page * Arrange role picker * Refine SA page styles * Generate default token name * More smooth navigation between SA pages * Stop loading indicator in case of error * Remove legacy styles usage * Tweaks after code review Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> * Get rid of useDisapatch in favor of mapDispatchToProps * Tests for ServiceAccountsListPage * Tests for service account page * Show new role picker only with license * Get rid of deprecated css classes * Apply suggestion from code review Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> * Fix service accounts icon * Tests for service account create page * Return service account info when update * Add behaviour tests for ServiceAccountsListPage * Fix disabled cursor on confirm button * More behavior tests for service account page * Temporary disable service account migration banner * Use safe where condition Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Apply review suggestions Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> * Remove autofocus from search Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	e9a93ebfc9	Access Control: Move access control middlewares to domain package (#48322) ... * Move access control middleware to domain package	3 years ago
Eric Leijonmarck	b43e9b50b4	Service accounts: RBAC the service account UI (#47788) ... * WIP * fix: bug for saving name did not remove edit * refactor: better error msg * Display the column Roles even when user can't see the role picker * Remove spaces when building the search query request * Disable Edit button and fix token addition and deletion * Fix the error message text Co-authored-by: Vardan Torosyan <vardants@gmail.com>	3 years ago
Ieva	a245531f0c	Access control: service account role check (#47710) ... * forbid setting role higher than user's role * change response code * can assign API key permissions to non-admin users * add: assign viewer role directly upon creation * refactor: add AddSATcommand infavor of AddAPIkey * refactor: frontend fixes for ServiceAccountToken Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com>	3 years ago
ying-jeanne	0bf889e058	Fix unmaarshal of double pointer (#47586) ... * Fix unmaarshal of double pointer * update sdk version	3 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727) ... * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	3 years ago
Eric Leijonmarck	c592e6606c	Filtering of service accounts by expired tokens (#46251) ... * Refactor to ServiceAccounts Query * filtering expiredtokens on backend * WIP * WIP * WIP * fix: missing that we do not cover for no service accounts * fix: wrong link * feat: filter able to get only service accounts with expired tokens * refactor: naming * Update pkg/services/serviceaccounts/models.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * goimported * Update pkg/services/serviceaccounts/api/api.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	3 years ago
Eric Leijonmarck	f4bed21cee	remove /upgradeall apiendpoint (#46638)	3 years ago
Gabriel MABILLE	75935c75c1	ServiceAccounts: Fix role update (#46568) ... * ServiceAccounts: Fix role update Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Fix patch missing metadata Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Fix patch missing metadata Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Jguer	ef9fe26886	Service accounts: Split user and service account database (#46442) ... * ServiceAccounts: remove unused endpoint * ServiceAccounts: remove usage of getOrgUsers from service accounts * use dialect for boolean str true in delete * return service account results directly * Move Service Account Deletions to sa package Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: gamab <gabi.mabs@gmail.com> * Move service account methods to service accounts Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: gamab <gabi.mabs@gmail.com> * Service accounts should not interfere with users Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * filter service accounts in user services * mispell fix * fix overextended lines Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix variable Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	3 years ago
J Guerreiro	2aeae69a16	Service Accounts: Display name to ID (#46258) ... * ServiceAccounts: modernize SA creation interface * ServiceAccounts: improve service account ID generation * ServiceAccounts: remove unused method * ServiceAccounts: Make SA ID display name dependent * ServiceAccounts: Add tests for Service Account creation * trim trailing whitespace * Update pkg/services/serviceaccounts/api/api.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update pkg/services/serviceaccounts/api/api.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago