31 Commits (f2ffce435193062806a23423748dc8c7c73b5981)

Author	SHA1	Message	Date
idafurjes	f2ffce4351	Chore: Move team models to models pkg (#61262) ... * Chore: Move team models to models pkg * Fix ACL tests * More ACL tests * Change Id to ID in conflict user command test * Remove team from models * Fix ac test lint	3 years ago
Eric Leijonmarck	371d7850a5	Auth: Service account store refactor (#58961) ... * refactor: renaming of files from database to store * refactor: make service account store private - moves store interface to manager package - adds an interface to the ProvideAPI constructor - refactors tests to use the store when necessary - adds mocks for the new interface implementations in the tests package * wip * refactor: make fakestore in service * wip * wip * wip * working tests * trailing whitespaces * Update pkg/services/serviceaccounts/api/api.go * Update pkg/services/serviceaccounts/tests/common.go * Update pkg/services/serviceaccounts/tests/common.go * refactor: doc string for retriever * fix import unused * remove: serviceaccount from featuretoggle * added: back legacy serviceaccounts feature toggle * added: docs * refactor: make query for the SearchQuery * add: validation of service input fields * add validation	3 years ago
Kristin Laemmert	05709ce411	chore: remove sqlstore & mockstore dependencies from (most) packages (#57087) ... * chore: add alias for InitTestDB and Session Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store. * next pass of removing sqlstore imports * last little bit * remove mockstore where possible	3 years ago
Kristin Laemmert	c61b5e85b4	chore: replace sqlstore.Store with db.DB (#57010) ... * chore: replace sqlstore.SQLStore with db.DB * more post-sqlstore.SQLStore cleanup	3 years ago
Kristin Laemmert	701f6d5436	UserService: use the UserService instead of calling sqlstore directly (#55745) ... * UserService: update callers to use the UserService instead of calling sqlstore directly There is one major change hiding in this PR. UserService.Delete originally called a number of services to delete user-related records. I moved everything except the actual call to the user table, and moved those into the API. This was done to avoid dependencies cycles; many of our services depend on the user service, so the user service itself should have as few dependencies as possible.	3 years ago
Serge Zaitsev	4c19e83ff0	Chore: Move team store implementation to a separate package (#55514) ... * Chore: move team store implementation to a separate package * trying to fix more tests * fix tests in service accounts and access control * fix common tests * restore commented out test * add todos	3 years ago
Karl Persson	870929b463	RBAC: Add cache for oss rbac permissions (#55098) ... * RBAC: Add cache for oss permissions * RBAC: include service account actions * RBAC: revert changes to fetch service account permissions * Update comment for setting * RBAC: Disable permission chache for tests	3 years ago
Karl Persson	55c7b8add2	RBAC: Split up service into several components (#54002) ... * RBAC: Rename interface to Store * RBAC: Move ranme scopeInjector * RBAC: Rename files to service * RBAC: Rename to service * RBAC: Split up accesscontrol into two components * RBAC: Add DeclareFixedRoles to AccessControl interface * Wire: Fix wire bindings * RBAC: Move resolvers to root * RBAC: Remove invalid test * RBAC: Inject access control service * RBAC: Implement the RoleRegistry interface in fake	3 years ago
Karl Persson	1b933ff3ed	RBAC: Move resource permissions store to service package (#53815) ... * Rename file to store * Move resource permission specific database functions to resourcepermissions package * Wire: Remove interface bind * RBAC: Remove injection of resourcepermission Store * RBAC: Export store constructor * Tests: Use resource permission package to initiate store used in tests * RBAC: Remove internal types package and move to resourcepermissions package * RBAC: Run database tests as itegration tests	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445) ... * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Ieva	b3a10202d4	Revert "Service accounts: Add service account to teams" (#52710) ... * Revert "Service accounts: Add service account to teams (#51536)" This reverts commit 0f919671e7. * remove unneeded line * fix test	4 years ago
Ieva	fc4fd47deb	change managed permissions for service accounts (#52709)	4 years ago
Ieva	f9ef7cac11	allow setting team managed permissions for service accounts (#52467)	4 years ago
Ieva	d85df0a560	Service Accounts: Managed permissions for service accounts (#51818) ... * backend changes * frontend changes * linting * nit * import order * allow SA creator to access the SA page * fix merge * tests * fix frontend tests Co-authored-by: alexanderzobnin alexanderzobnin@gmail.com	4 years ago
Eric Leijonmarck	0f919671e7	Service accounts: Add service account to teams (#51536) ... * Revert "Serviceaccounts: #48995 Do not display service accounts assigned to team (#48995)" This reverts commit cbf71fbd7f. * fix: test to not include more actions than necessary * adding service accounts to teams - backend and frontend changes * also support SA addition through the old team membership endpoints * fix tests * tests * serviceaccounts permission tests * serviceaccounts permission service tests run * added back test that was removed by accident * lint * refactor: add testoptionsTeams * fix a bug * service account picker change * explicitly set SA managed permissions to false for dash and folders * lint * allow team creator to list service accounts Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	9fd9a2cded	RBAC: Remove workaround to check permissions on folders for dashboard actions (#50291) ... * remove workaround to check permissions on folders for dashboard actions	4 years ago
Karl Persson	c4a75f9eb3	RBAC: Add scope resolvers for dashboards (#50110) ... * Inject access control into dashboard service * Add function to parse id scopes * Add dashboard as return value * Update mock * Return only err to keep service interface * Add scope resolvers for dashboard id scopes * Add function to parse uid scopes * Add dashboard uid scope resolver * Register scope resolvers for dashboards Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	4 years ago
Karl Persson	bdff63d4a8	RBAC: Include alert.rules action when setting folder permissions (#49946) ... * Generate additional actions when setting folder permissions in acl list * Add migration for managed folder permissions to include alert rule actions	4 years ago
Karl Persson	5caf97be40	AccessControl: Replace IsEnterprise checks with license checks (#49572)	4 years ago
Kristin Laemmert	1df340ff28	backend/services: Move GetDashboard from sqlstore to dashboard service (#48971) ... * rename folder to match package name * backend/sqlstore: move GetDashboard into DashboardService This is a stepping-stone commit which copies the GetDashboard function - which lets us remove the sqlstore from the interfaces in dashboards - without changing any other callers. * checkpoint: moving GetDashboard calls into dashboard service * finish refactoring api tests for dashboardService.GetDashboard	4 years ago
Karl Persson	61772a66b6	AccessControl: Create own interface and impl for each permission service (#48871) ... * Create own interfaces for team, folder, dashboard and data source permissions services * Remove service container and inject them individually	4 years ago
Karl Persson	2738d1c557	Access Control: Move dashboard actions and create scope provider (#48618) ... * Move dashboard actions and create scope provider	4 years ago
Jguer	90a94eab74	Dashboard/Folder permission fix session (#47174) ... * Fix inherited scopes for dashboard to use folder uid * Add inherited evaluators * Slight modification of the commments * Add test for inheritance * Nit. * extract shared function from tests * Nit. Extra line * Remove unused comment Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: gamab <gabi.mabs@gmail.com>	4 years ago
Karl Persson	a5e4a533fa	Access control: use uid for dashboard and folder scopes (#46807) ... * use uid:s for folder and dashboard permissions * evaluate folder and dashboard permissions based on uids * add dashboard.uid to accept list * Check for exact suffix * Check parent folder on create * update test * drop dashboard:create actions with dashboard scope * fix typo * AccessControl: test id 0 scope conversion * AccessControl: store only parent folder UID * AccessControl: extract general as a constant * FolderServices: Prevent creation of a folder uid'd general * FolderServices: Test folder creation prevention * Update pkg/services/guardian/accesscontrol_guardian.go * FolderServices: fix mock call expect * FolderServices: remove uneeded mocks Co-authored-by: jguer <joao.guerreiro@grafana.com>	4 years ago
Karl Persson	7ab1ef8d6e	Access Control: Support other attributes than id for resource permissions (#46727) ... * Add option to set ResourceAttribute for a permissions service * Use prefix in access control sql filter to parse scopes * Use prefix in access control metadata to check access	4 years ago
Karl Persson	4df7bf5ab2	Access control: Display inherited folder permissions in dashboards (#46421)	4 years ago
Yuriy Tseretyan	314be36a7c	Move datasource scopes and actions to access control package (#46334) ... * create scope provider * move datasource actions and scopes to datasource package + add provider * change usages to use datasource scopes and update data source name resolver to use provider * move folder permissions to dashboard package and update usages	4 years ago
Karl Persson	0debf33c76	Access control: Always append all permissions to role admin in oss (#46282) ... * Always append all permissions to built in role admin in oss	4 years ago
Karl Persson	4982ca3b1d	Access control: Use access control for dashboard and folder (#44702) ... * Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	4 years ago
Karl Persson	18cbfba596	Access control: Filter users and teams by read permissions (#45968) ... * pass signed in user and filter based on permissions	4 years ago
Karl Persson	cdc08105c2	Access control: Set default permissions for data sources when using access control (#45482) ... * Rename interfaces and use then with wire injection * Set default permissions when creating new data source	4 years ago
Ieva	602d62ebcc	Access control: FGAC for team sync endpoints (#44673) ... * add actions for team group sync * extend the hook to allow specifying whether the user is external * move user struct to type package * interface for permission service to allow mocking it * reuse existing permissions * test fix * refactor * linting	4 years ago
Gabriel MABILLE	d4f682190f	AccessControl: Implement teams resource service (#43951) ... * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * moving resourceservice to the main wire file pt2 * move team related actions so that they can be reused * PR feedback * fix * typo * Access Control: adding hooks for team member endpoints (#43991) * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * add access control to list and add team member endpoint, and hooks for adding team members * member permission type is 0 * add ID scope for team permission checks * add more team actions, use Member for member permission name * protect team member update endpoint with FGAC permissions * update SQL functions for teams and the corresponding tests * also protect team member removal endpoint with FGAC permissions and add a hook to permission service * a few small fixes, provide team permission service to test setup * AccessControl: cover team permissions Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Add background service as a consumer to resource_services Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Define actions in roles.go Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * Remove action from accesscontrol model Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com> * As suggested by kalle * move some changes from branch to the skeleton PR * remove resource services from wireexts * remove unneeded actions * linting fix * remove comments * feedback fixes * feedback * simplifying * remove team member within the same transaction * fix a mistake with the error * call the correct sql fction * linting * Access control: tests for team member endpoints (#44177) * tests for team member endpoints * clean up and fix the tests * fixing tests take 2 * don't import enterprise test license * don't import enterprise test license * remove unused variable Co-authored-by: gamab <gabi.mabs@gmail.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	4 years ago