grafana

Commit Graph

Author	SHA1	Message	Date
Domas	b5c67fe0dd	Frontend logging: handle logging endpoints without expensive middleware (#54960 )	3 years ago
Nicholas Wiersma	faf8eb3afb	JWT: Allow conventional bearer token in Authorization header (#54821 ) * fix: allow JWT to accept standard bearer token * fix: linter issues * fix: linter gosec false positive * fix: refactor logic into JWT handler * fix: move bearer trimming earlier	3 years ago
Nicholas Wiersma	9e704fec3c	JWT: Add support for assigning org roles (#54277 ) * feat: allow jwt role to be set * chore: update documentation * fix: cr suggestions * fix: lint issues * respect org auto assign and default org ID * add server admin to devenv Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
Carl Bergquist	78978048c3	Instrumentation: log the total number of db queries per request (#54647 ) Signed-off-by: bergquist <carl.bergquist@gmail.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	3 years ago
Serge Zaitsev	927ddf9376	Chore: Move login attempt methods to separate service (#54479 ) * Chore: Move login attempt methods to separate service * attempt to fix tests * fix syntax * better time mocking * initialise now func	3 years ago
Carl Bergquist	ab59f3cb1a	metrics: add operation name used in metrics/tracing for middlewares (#53949 ) Signed-off-by: bergquist <carl.bergquist@gmail.com>	3 years ago
idafurjes	fa2e74cd6e	Chore: Remove GetSignedInUserWithCacheCtx from store interface (#53734 ) * Remove delete suer from store interface * Remove get signed in user with cache ctx from store interface * Support options when setting up access control tests * Fix broken tests * Fix lint * Add user fake to middleware * Fix middleware tests, remove usertest being initialised twice Co-authored-by: Karl Persson <kalle.persson@grafana.com>	3 years ago
zhichli	806fb8ab7a	Tracing: Fix OpenTelemetry Jaeger context propagation (#53269 ) * fix otel jaeger context propagation * add back launch.json * add back launch.json	3 years ago
idafurjes	a14621fff6	Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343 ) * Chore: Add user service method SetUsingOrg * Chore: Add user service method GetSignedInUserWithCacheCtx * Use method GetSignedInUserWithCacheCtx from user service * Fix lint after rebase * Fix lint * Fix lint error * roll back some changes * Roll back changes in api and middleware * Add xorm tags to SignedInUser ID fields	3 years ago
Jo	062d255124	Handle ioutil deprecations (#53526 ) * replace ioutil.ReadFile -> os.ReadFile * replace ioutil.ReadAll -> io.ReadAll * replace ioutil.TempFile -> os.CreateTemp * replace ioutil.NopCloser -> io.NopCloser * replace ioutil.WriteFile -> os.WriteFile * replace ioutil.TempDir -> os.MkdirTemp * replace ioutil.Discard -> io.Discard	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
sh0rez	534ece064b	pkg/web: closure-style middlewares (#51238 ) * pkg/web: closure-style middlewares Switches the middleware execution model from web.Handlers in a slice to web.Middleware. Middlewares are temporarily kept in a slice to preserve ordering, but prior to execution they are applied, forming a giant call-stack, giving granular control over the execution flow. * pkg/middleware: adapt to web.Middleware * pkg/middleware/recovery: use c.Req over req c.Req gets updated by future handlers, while req stays static. The current recovery implementation needs this newer information * pkg/web: correct middleware ordering * pkg/webtest: adapt middleware * pkg/web/hack: set w and r onto web.Context By adopting std middlewares, it may happen they invoke next(w,r) without putting their modified w,r into the web.Context, leading old-style handlers to operate on outdated fields. pkg/web now takes care of this * pkg/middleware: selectively use future context * pkg/web: accept closure-style on Use() * webtest: Middleware testing adds a utility function to web/webtest to obtain a http.ResponseWriter, http.Request and http.Handler the same as a middleware that runs would receive * : cleanup pkg/web: don't wrap Middleware from Router * pkg/web: require chain to write response * : remove temp files webtest: don't require chain write * *: cleanup	3 years ago
idafurjes	0c5b71694f	Chore: Add user service method UpdateLastSeenAt (#53309 ) * Chore: Add user service method UpdateLastSeenAt * Fix lint	3 years ago
Serge Zaitsev	191ab3bb01	Chore: Move api key models into apikey service package (#53241 ) * Chore: move api key models into apikey service package * force table name for api key	3 years ago
idafurjes	1ecbe22751	Chore: Add user service method GetByLogin (#53204 ) * Add wrapper around sqlstore method GetUserByLogin * Use new method from user service * Fix lint * Fix lint 2 * fix middleware basic auth test * Fix grafana login returning a user by login * Remove GetUserByLogin from store interface * Merge commit	3 years ago
Serge Zaitsev	64488f6b90	Chore: split APIKey store (#52781 ) * move apikey store into a separate service * add apikey service to wire graph * fix linter * switch api to use apikey service * fix provideservice in tests * add apikey service test double * try different sql syntax * rolling back the dialect * trigger drone * trigger drone	3 years ago
Jo	c2d3c90bc8	Auth: Implement Token URL JWT Auth (#52662 ) * Auth: check of auth_token in url and resolve user if present * check if auth_token is passed in url * Auth: Pass auth_token for request if present in path * no need to decode token in index * temp * use loadURLToken and set authorization header * cache token in memory and strip it from url * Use loadURLToken * Keep token in url * strip sensitive query strings from url used by context logger * adapt login by url to jwt token * add jwt iframe devenv * add jwt iframe devenv instructions * add access note * add test for cleaning request * ensure jwt token is not carried into handlers * do not reshuffle queries, might be important * add correct db dump location * prefer set token instead of cached token Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	3 years ago
Carl Bergquist	732cc99480	instrumentation: add buckets to catch very slow requests (#51492 ) Signed-off-by: bergquist <carl.bergquist@gmail.com>	3 years ago
idafurjes	d3d8fdd878	Chore: Move user errors to user service (#52460 ) * Move user not found err to user service * User ErrCaseInsensitive from user pkg * User ErrUserAlreadyExists from user pkg * User ErrLastGrafanaAdmin from user pkg * Remove errors from model	3 years ago
idafurjes	17ec9cac83	Add delete user from other services/stores (#51912 ) * Remove user from preferences, stars, orguser, team member * Fix lint * Add Delete user from org and dashboard acl * Delete user from user auth * Add DeleteUser to quota * Add test files and adjust user auth store * Rename package in wire for user auth * Import Quota Service interface in other services * do the same in tests * fix lint tests * Fix tests * Add some tests * Rename InsertUser and DeleteUser to InsertOrgUser and DeleteOrgUser * Rename DeleteUser to DeleteByUser in quota * changing a method name in few additional places * Fix in other places * Fix lint * Fix tests * Rename DeleteOrgUser to DeleteUserFromAll * Update pkg/services/org/orgimpl/org_test.go Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * Update pkg/services/preference/prefimpl/inmemory_test.go Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * Rename Acl to ACL * Fix wire after merge with main * Move test to uni test Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	3 years ago
Emil Tullstedt	06bd8b8e7a	CSRF: Fix additional headers option (#50629 ) * CSRF: Fix additional headers option * fix: type assertion on error fail on wrapped error * Update pkg/middleware/csrf/csrf_test.go Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * update test Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com>	3 years ago
Jeff Levin	eacee08135	public dashboards: move into into its own service (#51358 ) This PR moves public dashboards into its own self contained service including API, Service, Database, and Models. Routes are mounted on the Grafana HTTPServer by the API service at injection time with wire.go. The main route that loads the frontend for public dashboards is still handled by the API package. Co-authored-by: Jesse Weaver <jesse.weaver@grafana.com> Co-authored-by: Owen Smallwood <owen.smallwood@grafana.com>	3 years ago
Ieva	75873d05d7	Access Control: Allow dashboard admins to query org users (#51652 ) * allow dashboard admins to query org users * rename one more variable	3 years ago
idafurjes	6c43eb0b4d	Split Create User (#50502 ) * Split Create User * Use new create user and User from package user * Add service to wire * Making create user work * Replace user from user pkg * One more * Move Insert to orguser Service/Store * Remove unnecessary conversion * Cleaunp * Fix Get User and add fakes * Fixing get org id for user logic, adding fakes and other adjustments * Add some tests for ourguser service and store * Fix insert org logic * Add comment about deprecation * Fix after merge with main * Move orguser service/store to org service/store * Remove orguser from wire * Unimplement new Create user and use User from pkg user * Fix wire generation * Fix lint * Fix lint - use only User and CrateUserCommand from user pkg * Remove User and CreateUserCommand from models * Fix lint 2	3 years ago
Serge Zaitsev	ae9491c3a7	Chore: Make test tracer noop and return no errors (#50797 )	3 years ago
Carl Bergquist	b8b6d0e1a1	Instrumentation: Define handlers for requests that are not handled with named handlers (#50613 ) Signed-off-by: bergquist <carl.bergquist@gmail.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>	3 years ago
Carl Bergquist	2d6e69226b	Instrumentation: Add feature toggle for logging requests instrumented as unknown (#50566 ) Signed-off-by: bergquist <carl.bergquist@gmail.com>	3 years ago
owensmallwood	cfdea1ee30	PublicDashboards: Frontend routing for public dashboards (#48834 ) * add isPublic to dashboard * refactor routes to use route group and add placeholder method for sharing apii * add sharing pane and utils for public dashboard config to sharing modal * Sharing modal now persists data through the api * moves ShareDashboard endpoint to new file and starts adding tests * generates mocks. Adds tests for public dashboard feature flag * Adds ability to pass in array of features to enable for the test * test to update public flag on dashboard WIP * Adds mock for SaveDashboardSharingConfig * Fixes tests. Had to use FakeDashboardService * Adds React tests for public dashboards toggle * removes semicolons * refactors SharePublic component to use hooks * rename from `share publicly` to `public dashboard config` * checkpoint. debugging tests. need to verify name changes * checkpoint. test bugs fixed. need to finish returning proper response codes * finish renaming. fix test * Update pkg/api/api.go Co-authored-by: Torkel Ödegaard <torkel@grafana.com> * update backend url * rename internal objects and commands. fix configuration modal labels * add endpoint for retrieving public dashboard configuration and populate the frontend state from it * add test for dashboardCanBePublic * adds backend routes * copy DashboardPage component into component for public dashboards. WIP * adds react routes, and doesnt render main nav bar when viewing a public route * removes extra react route from testing * updates component name * Wrap the original dashboard component so we can pass props relevant to public dashboards, turn kiosk mode on/off, etc * Wraps DashboardPage in PublicDashboardPage component. DashboardPage gets rendered in kiosk mode when public prop is passed. * removes commented out code from exploratory work * Makes public dashboard routes require no auth * extracts helper to own util file to check if were viewing a public page * Hides panel dropdown when its being viewed publicly * formatting * use function from utils file for determining if publicly viewed. If public, hides app notifications, searchwrapper, and commandpalette. * adds unit tests for util function used to see if page is being viewed publicly * cant added annotations to panel when being publicly viewed * removes useless comment * hides backend and frontend pubdash routes behind feature flag * consider feature flag when checking url path to see if on public dashboard * renames function * still render app notifications when in public view * Extract pubdash route logic into own file * fixes failing tests * Determines path using location locationUtils. This covers the case when grafana is being hosted on a subpath. Updates tests. * renames pubdash web route to be more understandable * rename route * fixes failing test * fixes failing test. Needed to update pubdash urls * sets flag on grafana boot config for if viewing public dashboard. Removes hacky check that looks at the url * fixes failing tests. Uses config to determine if viewing public dashboard * renders the blue panel timeInfo on public dashboard panel * Extracts conditional logic for rendering components out into their own functions * removes publicDashboardView check, and uses dashboard meta instead * the timeInfo is always displayed on the panel * After fetch of public dashboard dto, the meta isPublic flag gets set and used to determine if viewing public dashboard for child components. Fixes tests for PanelHeader. * Fixes failing test. Needed to add isPublic flag to dashboard meta. Co-authored-by: Jeff Levin <jeff@levinology.com> Co-authored-by: Torkel Ödegaard <torkel@grafana.com>	3 years ago
Emil Tullstedt	3e81fa0716	API: Migrate CSRF to service and support additional options (#48120 ) * API: Migrate CSRF to service and support additional options * minor * public Csrf service to use in tests * WIP * remove fmt * comment * WIP * remove fmt prints * todo add prefix slash * remove fmt prints * linting fix * remove trimPrefix Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	3 years ago
Kristin Laemmert	2edfbb7767	sqlstore split: dashboard permissions (#49962 ) * backend/sqlstore split: remove unused GetDashboardPermissionsForUser from sqlstore * remove debugging line * backend/sqlstore: move dashboard permission related functions to dashboard service	3 years ago
Carl Bergquist	9562fb389f	Metrics: Remove support for using summaries instead of histogram for HTTP instrumentation (#49985 ) Signed-off-by: bergquist <carl.bergquist@gmail.com>	3 years ago
sh0rez	3ca3a59079	pkg/web: remove dependency injection (#49123 ) * pkg/web: store http.Handler internally * pkg/web: remove injection Removes any injection code from pkg/web. It already was no longer functional, as we already only injected into `http.Handler`, meaning we only inject ctx.Req and ctx.Resp. Any other types (Context, ReqContext) were already accessed using the http.Request.Context.Value() method. * : remove type mappings Removes any call to the previously removed TypeMapper, as those were non-functional already. pkg/web: remove Context.Invoke was no longer used outside of pkg/web and also no longer functional	3 years ago
Ezequiel Victorero	dfab100dc7	Chore: sanitize values before being logged from request headers (#49245 ) * Chore: sanitize values being logged directly from request headers	3 years ago
Kat Yang	68478e908a	Chore: Remove x from team (#47905 ) * Chore: Remove x from team * Update pkg/services/sqlstore/team.go Co-authored-by: ying-jeanne <74549700+ying-jeanne@users.noreply.github.com> * Update pkg/services/sqlstore/team.go Co-authored-by: ying-jeanne <74549700+ying-jeanne@users.noreply.github.com> * Refactor dialects and add ISAdminOfTeams to Store * Add IsAdminOfTeams to mockstore Co-authored-by: ying-jeanne <74549700+ying-jeanne@users.noreply.github.com>	3 years ago
ying-jeanne	7ddae870e7	fix status code 200 (#47818 )	3 years ago
Serge Zaitsev	41012af997	Tracing: Use common traceID context value for opentracing and opentelemetry (#46411 ) * use common traceID context value for opentracing and opentelemetry * support sampled trace IDs as well * inject traceID into NormalResponse on errors * Finally the test passed * fix the test * fix linter * change the function parameter Co-authored-by: Ying WANG <ying.wang@grafana.com>	3 years ago
Serge Zaitsev	18e93c7077	Chore: Remove bus (#47511 ) * Chore: Remove bus * remove unused const	3 years ago
Serge Zaitsev	2cf88cfec8	Chore: Remove bus from contexthandler (#47458 ) * Chore: remove bus from contexthandler * remove bus from orgredirect	3 years ago
Serge Zaitsev	d153d896c5	Chore: Remove bus from contexthandler (#47374 ) * Chore: Remove bus from contexthandler * fix tests * try different wire binding * maybe remove a few more dispatches * fix tests	3 years ago
ying-jeanne	8ef5212b0e	add unit into request duration (#47356 ) * add unit into request duration * Update pkg/middleware/logger.go Co-authored-by: Carl Bergquist <carl.bergquist@gmail.com> Co-authored-by: Carl Bergquist <carl.bergquist@gmail.com>	3 years ago
Serge Zaitsev	3a7fc80948	Chore: Remove last bus parts from login package (#47313 ) * Chore: Remove last bus parts from login package * fix middleware tests	3 years ago
Serge Zaitsev	33006436cc	Chore: Remove bus.Dispatch from some login packages (#47248 ) * Chore: Remove bus.Dispatch from some login packages * remove debug log Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * remove login.Init() * remove unused reset function * remove AuthenticateUserFunc global * swap conditional branches Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com> * fix formatting Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	3 years ago
Selene	8e52dbb87b	Chore: Remove bus from authproxy (#46936 ) * Make authproxy injectable * Fix import * Provide function was in wrong place * Fixing tests * More imports and rollback a change * Fix lint	3 years ago
ying-jeanne	06ed5efdf0	Middleware: Fix IPv6 host parsing in CSRF check (#45911 ) - Also create tests for this middleware Co-authored-by: Kyle Brandt <kyle@grafana.com>	3 years ago
Kat Yang	d3ae8939af	Chore: Remove x from health, alert notification, dashboard, stats, user (#45265 ) * Chore: Remove x from health * Chore: Remove x from dashboard and user * Chore: Remove x from alert notification * Chore: Remove x from stats * Fix: Update func signature in stats test * Refactor: Remove x from GetDashboardTags * Chore: Remove x from dashboard * Chore: Remove x from Stats * Fix: Update refs of HasAdminPermissionInFolders * Fix: Adjust funcs in tests to be sqlStore methods * Fix: Fix database folder test sqlstore methods	3 years ago
Yuriy Tseretyan	d4ac1f0ce1	Update quota service to accept context (#45186 )	3 years ago
idafurjes	923b62ecab	Chore: Remove bus from quota (#45143 ) * Remove bus from quota * workaround * Change ExpectedOrg ot *models.Org	3 years ago
Dimitris Sotirakis	605d056136	Security: Sync security changes on main (#45083 ) * * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search * Teams: Ensure that users searching for teams are only able see teams they have access to * Teams: Require teamGuardian admin privileges to list team members * Teams: Prevent org viewers from administering teams * Teams: Add org_id condition to team count query * Teams: clarify permission requirements in teams api docs * Teams: expand scenarios for team search tests * Teams: mock teamGuardian in tests Co-authored-by: Dan Cech <dcech@grafana.com> * remove duplicate WHERE statement * Fix for CVE-2022-21702 (cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e) * Lint and test fixes (cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981) * check content type properly (cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98) * basic csrf origin check (cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1) * compare origin to host (cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42) * simplify url parsing (cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d) * check csrf for GET requests, only compare origin (cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709) * parse content type properly (cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0) * mentioned get in the comment (cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345) * add content-type: application/json to test HTTP requests * fix pluginproxy test * Fix linter when comparing errors Co-authored-by: Kevin Minehart <kmineh0151@gmail.com> Co-authored-by: Dan Cech <dcech@grafana.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com>	3 years ago
Marcus Efraimsson	bc7e55d99b	Chore: Fix log filters (#44681 )	3 years ago
Marcus Efraimsson	0092d10764	Instrumentation: Fix HTTP request instrumentation of authentication failures (#44234 ) Moves the request tracing middleware earlier in the chain, just after the tracing middleware and before the log middleware. With these changes we'll be able to track authentication/authorization status failures that currently exits early and don't execute the request tracing middleware. In addition, there might be some other routes now being tracked with this that we didn't do before. Fixes #39590	3 years ago

1 2 3 4 5 ...

424 Commits (ebcbb66548ae866648738a31cfb9afd40144c640)