28 Commits (e78a5122ceea32229795f02b3ab7eb5e56a84763)

Author	SHA1	Message	Date
Ieva	4e3294cd8d	RBAC: Fix the check for whether an action set should be added (#89219) ... fox the check for whether an action set should be added	11 months ago
Ieva	1ac395b785	RBAC: Only store action sets for dashboards and folders (#89053) ... * don't store action sets for resources other than dashboards and folders * remove unneeded comment	11 months ago
Ieva	34c40f959f	RBAC: Add and resolve action sets when searching user's permissions (#88694) ... * include and resolve action sets when fetching user's permissions * expand both action and action prefix (returns an empty set for the one that isn't specified) Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * if action is specified, check for exact match; also extend tests	12 months ago
Eric Leijonmarck	910553df20	Actionsets: Add cfg option for only writing actionsets (#88367) ... * test * test * missed test * fix review comments	12 months ago
Ieva	bd2b248f0e	RBAC: Clean up action set code (#88147) ... * remove unused action set code, refactor the existing code * fix import ordering * use a separate interface for permission expansion after all, to avoid circular dependencies * add comments, fix a test	1 year ago
Ieva	3e77768144	RBAC: Expand action sets when fetching permissions (#87967) ... * logic to expand action set to the underlying actions when permissions are fetched from the DB * updates needed for dependency injection * clean up some code, also deduplicate scopes when grouping scopes and actions * expand on a comment * rename a method	1 year ago
Ieva	105313f5c2	RBAC: Adding action set resolver for RBAC evaluation (#86801) ... * add action set resolver * rename variables * some fixes and some tests * more tests * more tests, and put action set storing behind a feature toggle * undo change from cfg to feature mgmt - will cover it in a separate PR due to the amount of test changes * fix dependency cycle, update some tests * add one more test * fix for feature toggle check not being set on test configs * linting fixes * check that action set name can be split nicely * clean up tests by turning GetActionSetNames into a function * undo accidental change * test fix * more test fixes	1 year ago
Ieva	9a824bdf0a	RBAC: Don't set empty action sets (#87398) ... * don't set empty action sets * extend comment	1 year ago
Eric Leijonmarck	6b218b11cf	Actionsets: fix remove printf (#87439) ... fix: remove printf	1 year ago
Eric Leijonmarck	601485c74d	Actionsets: Fix downgrade of permission to add the actionset permission (#87328) ... * check for missingActions empty and add actionset * spelling	1 year ago
Eric Leijonmarck	ddabef9895	RBAC: Add actionsets struct and write path (#86108) ... * Add actionsets struct and failing test * update from review * review comments * review comments update * refactor: create interface * actionset service * fix tests * move from wireoss to wire * Apply suggestions from code review remove unnecessary comments Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * nil for the actionsetservice * Revert "nil for the actionsetservice" This reverts commit e3d3cc8171. --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	1 year ago
Jo	7852ea012d	Access: Remove split scopes feature toggle (#81874) ... * remove split scopes FT * Revert "remove split scopes FT" This reverts commit 349fb081d3. * make toggle deprecated instead * fix gen	1 year ago
Karl Persson	0f0249abea	RBAC: Fix filter so that check for access on service account is correct (#78907) ... Fix filter so that check for access on service account is in correct place	1 year ago
Karl Persson	1c270b1dc2	RBAC: Adjust filter for acl list to check for permissions on service accounts (#78681) ... Adjust filter to check for permissions on service accounts	2 years ago
Ryan McKinley	f69fd3726b	FeatureToggles: Add context and and an explicit global check (#78081)	2 years ago
Jo	4474f19836	Service Accounts: Enable adding folder, dashboard and data source permissions to service accounts (#76133) ... * Add SAs to Datasource permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * add SAs to dashboards/folders managed permissions * Update public/app/core/components/AccessControl/Permissions.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * regenerate i18n * add doc --------- Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066)	2 years ago
Ieva	cfa1a2c55f	RBAC: Split non-empty scopes into `kind`, `attribute` and `identifier` fields for better search performance (#71933) ... * add a feature toggle * add the fields for attribute, kind and identifier to permission Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * set the new fields when new permissions are stored * add migrations Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * remove comments * Update pkg/services/accesscontrol/migrator/migrator.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * feedback: put column migrations behind the feature toggle, added an index, changed how wildcard scopes are split * PR feedback: add a comment and revert an accidentally changed file * PR feedback: handle the case with : in resource identifier * switch from checking feature toggle through cfg to checking it through featuremgmt * don't put the column migrations behind a feature toggle after all - this breaks permission queries from db --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Jo	49e42d1a8d	AccessControl: Add resource permission deletion helper (#71222) ... * add method for deleting managed resource permissions * test method	2 years ago
Ieva	6ae0ea80f6	RBAC: extend `IsInherited` method to work for nested folders (#62498) ... * extend IsInherited function to work for nested folders * add tests * update tests and logic * process inherited permissions seprately to correctly grey them out in the frontend	2 years ago
idafurjes	f2ffce4351	Chore: Move team models to models pkg (#61262) ... * Chore: Move team models to models pkg * Fix ACL tests * More ACL tests * Change Id to ID in conflict user command test * Remove team from models * Fix ac test lint	2 years ago
Denis Limarev	b814c66c1d	Perfomance: add preallocation for some slices (#59263) ... add preallocation for some slices	3 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087) ... * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago
Karl Persson	9adaf1565c	RBAC: Allow to list users for dashboard / folder admins (#57080) ... * RBAC: Use query struct in tests * RBAC: If access control enforcement is disabled don't filter out users when fetching permissions	3 years ago
Kristin Laemmert	c61b5e85b4	chore: replace sqlstore.Store with db.DB (#57010) ... * chore: replace sqlstore.SQLStore with db.DB * more post-sqlstore.SQLStore cleanup	3 years ago
Karl Persson	d896db6d30	RBAC: Batch permission creation (#55075)	3 years ago
Karl Persson	cc78486535	RBAC: Display indicator if a permission is inherited (#54080) ... * RBAC: Add IsInherited property * PermissionList: Display inherited indicator	3 years ago
Karl Persson	1b933ff3ed	RBAC: Move resource permissions store to service package (#53815) ... * Rename file to store * Move resource permission specific database functions to resourcepermissions package * Wire: Remove interface bind * RBAC: Remove injection of resourcepermission Store * RBAC: Export store constructor * Tests: Use resource permission package to initiate store used in tests * RBAC: Remove internal types package and move to resourcepermissions package * RBAC: Run database tests as itegration tests	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445) ... * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Ieva	b3a10202d4	Revert "Service accounts: Add service account to teams" (#52710) ... * Revert "Service accounts: Add service account to teams (#51536)" This reverts commit 0f919671e7. * remove unneeded line * fix test	3 years ago
idafurjes	d3d8fdd878	Chore: Move user errors to user service (#52460) ... * Move user not found err to user service * User ErrCaseInsensitive from user pkg * User ErrUserAlreadyExists from user pkg * User ErrLastGrafanaAdmin from user pkg * Remove errors from model	3 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536) ... * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit cbf71fbd7f. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Karl Persson	9622e7457e	Fix permission query for postgres (#48543)	3 years ago
Gabriel MABILLE	9ed7e48454	AccessControl: Modify provisioning to prevent built-in role assignment (#48031) ... * Add basic and managed prefixes to avoid magic strings For now let's stick with grafana_builtins add function isBasic to RoleDTO add function isBasic to Role Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Add team store to wire Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727) ... * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	3 years ago
Karl Persson	4df7bf5ab2	Access control: Display inherited folder permissions in dashboards (#46421)	3 years ago
Karl Persson	8261e781d5	Access control: Delete user permissions when a user is deleted (#46021) ... * Remove access control related to user on deletion	3 years ago
Karl Persson	8688073564	Access control: Support filter on several actions (#46524) ... * Add support for several actions when creating a acccess control sql filter	3 years ago
Karl Persson	18cbfba596	Access control: Filter users and teams by read permissions (#45968) ... * pass signed in user and filter based on permissions	3 years ago
Karl Persson	922b9465ec	Access Control: Add function to set several permissions on a resource in one transaction (#44768)	3 years ago
Ieva	602d62ebcc	Access control: FGAC for team sync endpoints (#44673) ... * add actions for team group sync * extend the hook to allow specifying whether the user is external * move user struct to type package * interface for permission service to allow mocking it * reuse existing permissions * test fix * refactor * linting	3 years ago
J Guerreiro	153b231521	AccessControl: Refine interface for AC store (#44536) ... * AccessControl: Refine interface for AC store * Update pkg/services/accesscontrol/database/resource_permissions.go	3 years ago
Karl Persson	de2c5783fa	Access Control: Pass db session to hooks (#44428) ... * Move hook calls to database and pass session	3 years ago
Karl Persson	2425828a0b	quote reserved keyword (#43652)	3 years ago
Karl Persson	ee690a7bb0	Add org_id in join (#43648)	3 years ago
Karl Persson	b3d5a607d4	Access Control: Add option to filter only managed permissions (#43371) ... * Add option to filter only managed permissions	3 years ago
Karl Persson	c3ca2d214d	Access control: Refactor managed permission system to create api and frontend components (#42540) ... * Refactor resource permissions * Add frondend components for resource permissions Co-authored-by: kay delaney <45561153+kaydelaney@users.noreply.github.com> Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Gabriel MABILLE	c7cabdfd6f	AccessControl: Add accesscontrol metadata to datasources DTOs (#42675) ... * AccessControl: Provide scope to frontend * Covering datasources with accesscontrol metadata * Write benchmark tests for GetResourcesMetadata * Add accesscontrol util and interface * Add the hasPermissionInMetadata function in the frontend access control code * Use IsDisabled rather that performing a feature toggle check Co-authored-by: Karl Persson <kalle.persson@grafana.com>	3 years ago
Karl Persson	3c659f1ea0	Access Control: Move part of access control database (#40483) ... * Add accesscontrol migrations * Add ResourceStore interface and related structs * Add team/user/builtin-role * Add accesscontrol database with functions to handle managed roles and permissions * Add ResourceManager * Add GetUserPermissions * Update pkg/services/accesscontrol/accesscontrol.go Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	4 years ago