grafana

Commit Graph

Author	SHA1	Message	Date
Peter Štibraný	1856d47e47	Remove GetResourceClient hack from unified package. (#100636 ) * Remove GetResourceClient hack from unified package.	3 months ago
Alexander Zobnin	5118e82e8c	Zanzana: Run reconciliation in its own service (#100361 ) * Zanzana: Start reconciliation in its own service * cleanup * update go workspaces * refactor * remove unused code * move func definition	4 months ago
Karl Persson	39d94eabcd	Auth: Fix function name (#100122 ) Fix spelling	4 months ago
Stephanie Hingtgen	8ac9c47222	Folders: Validator: add temporary fix (#100019 )	4 months ago
Karl Persson	c85a175212	RBAC: only query folder service when fetching parent folders (#99893 ) * only query folder service when fetching parent folders * Perform validation and inehrited scopes solvers as service instead of caller	4 months ago
Arati R.	a2097fbc2f	Folders: Add user service to folder service implementation (#99518 ) Add user service to folder service implementation	4 months ago
Misi	437b7a565d	Auth: Add access token to in-proc communication and ServiceIdentity (#98926 ) Use fake access token for in-proc grpc and add ServiceIdentity --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Karl Persson <23356117+kalleep@users.noreply.github.com>	4 months ago
Ezequiel Victorero	3a94057ec8	PublicDashboards: Delete on folder deletion (#99040 )	4 months ago
Todd Treece	2622449718	Dashboards: Use dashboard service in access control (#99053 )	4 months ago
Ryan McKinley	680e6bc1f8	Authlib: Use types package rather than claims (#99243 )	4 months ago
Karl Persson	7329d2c34b	Authz: Account for fixed roles when running oss and using authz service (#99244 ) * Extract "PermissionStore" from general store interface * Add static and union permission stores * Add GetStaticRoles * Use accesscontrol.Service for inproc to provide static permissions	4 months ago
Alexander Zobnin	cbb688e910	Zanzana: Remove usage from legacy access control (#98883 ) * Zanzana: Remove usage from legacy access control * remove unused * remove zanzana client from services where it's not used * remove unused metrics * fix linter	4 months ago
maicon	766d645d82	Filewalkwithme/unistore refactor folder service to hit folder apiserver (#98409 ) Refactor folder service to use Unified Storage Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com> Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>	4 months ago
Karl Persson	c593b20465	Zanana: Add custom verb for get_permissions and set_permissions. (#98616 ) * Add custom verb for get_permissions and update_permissions. Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>	5 months ago
Stephanie Hingtgen	9488bf2915	Dashboards: use service for quotas (#98756 )	5 months ago
Karl Persson	fb5783691d	Zanzana: Fix reconciliation of fixed roles (#98696 ) Remove "globalReconciler" and reuse the same one but only run them for cluster namespace	5 months ago
Karl Persson	9ed4bf3cd2	Zanzana: Support sub resources (#98201 ) * Create and use common ResourceInfo struct * Add support for formatting group resource with subresource * Add initial support for handling subresource * Add test for checking subresource for generic resource * Bump authlib	5 months ago
Alexander Zobnin	7e5cb7d8d6	Zanzana: Refactor fixed roles (use global store) (#97884 ) * Zanzana: Pass contextual tuples for authorization * global reconciler for fixed roles * inject tuples from global store * fix adding contextual tuples * cleanup * don't error on auth context fail * add todo * add context for List * add caching * remove unused * use constant for global namespace * Rename global namespace to cluster namespace	5 months ago
Arati R.	6957e1f7b7	Folders: Replace sql query with folder service call when collecting folder tree (#98443 ) * Replace sql query with folder service call when collecting folder tree * Update provider for folder service implementation for wire * Refactor provisioning of oss service in folder permissions test util	5 months ago
maicon	d2639f6080	Ensure all internal Services are using FolderService and not FolderStore (#98370 ) * Ensure all internal Services are using FolderService and not FolderStore Signed-off-by: Maicon Costa <maiconscosta@gmail.com> --------- Signed-off-by: Maicon Costa <maiconscosta@gmail.com>	5 months ago
Jo	40d3b02648	Auth: Separate anonymous settings to its own struct (#97791 ) separate anonymous settings to its own struct	6 months ago
Alexander Zobnin	61d71ec5b1	Zanzana: Handle anonymous users (#97171 ) * add anonymous users to schema * sync anonymous user role * remove unused * fix linter * only add anonymous reconciler if feature is enabled	6 months ago
Karl Persson	718612aabf	Zanzana: Update relation names (#97638 ) * Update relation names to match k8s verbs * Only check namespace if relation is valid * Only list for valid relations	6 months ago
Karl Persson	e4fbae03a1	RBAC: remove dead code (#97234 ) This code is unused and always have been	6 months ago
Ieva	cc0ec349a4	RBAC: Allow passing in user UID when searching for user's permissions (#97125 ) * allow passing in user UID instead of ID when searching for user's permissions * fix tests	6 months ago
Matheus Macabu	f2b96593ea	SQL: close rows to release connection (#97147 ) * SQL: close rows to release connection * dont return err from rows.Close()	6 months ago
Alexander Zobnin	c8caf787d4	Zanzana: handle service accounts (#97123 ) * add service account to the schema * sync managed permissions for service accounts * sync SA basic roles * sync SA roles * Fix endless loop in reconciler while read openfga	6 months ago
Karl Persson	3990637af9	IAM: remove duplicated functions (#96989 ) * Remove duplicated function and use the one provided by claims package	6 months ago
Alexander Zobnin	170e0e1813	Zanzana: List then search implementation (#96705 ) * Zanzana: Search with list * Allow to pass werb into list request * split list search into 2 functions * fix listing resources * remove unused * refactor * remove unused function * Add more logging to reconciler * Fix search for users with access to all resources * fix findFoldersZanzanaList * search for folders as well by default * refactor * use compile for list and search * remove list from client * remove only from client * remove list from interface * run compile once * refactor * refactor * add search tests * fix tests * Fix linter	6 months ago
Karl Persson	e995d4f682	Zanzana: Add setting zanzana reconciliation interval (#96687 ) Add config option under RBAC for zanzana reconciliation interval	6 months ago
Ieva	a60953c8f9	GAS: Show mapped roles in role picker (#96681 ) * add group mapping UID returned mapped roles * request mapped roles from the frontend, but don't attempt to update mapped roles * lock mapped roles and show a pop-up message about why a role is locked * update role selectors to not allow deselecting a mapped role * swagger gen * simplify and set mapped as bool instead of mapping UID array * swagger gen	6 months ago
Karl Persson	7e442efa9c	Zanzana: sync roles and bindings (#96661 ) * Sync fix and custom roles and team bindings. * Add collector for user role bindings	6 months ago
Karl Persson	1f34096fdf	Zanzana: reconcile basic roles and bindings (#96473 ) * Add reconciler for basic roles * Add reconciler for basic role bindings	6 months ago
Karl Persson	db6422c8a3	Zanzana: Use correct namespace when evaluating permission (#96258 ) Use correct namespace	7 months ago
Gabriel MABILLE	cc9cdbe82d	Authz: Move extension proto up a layer (#96254 ) * Authz: Move extension proto up a layer * Lint	7 months ago
Alexander Zobnin	b1fb581ab1	Zanzana: Evaluate access with Check request (server-side) (#96213 ) * Zanzana: Evaluate access with Check request (server-side) * Pass parent folder for checking access * Review suggestions * remove fixme comment	7 months ago
Karl Persson	9f66843915	Zanzana: use namespace when performing reconciliation (#96205 ) * Special handling for zanzana reconciliation if stack id is configured * remove sync call	7 months ago
Alexander Zobnin	910ec7e7dc	Zanzana: Use separate store for each org (#96015 ) * Move server init into server package * map store name to id * refactor model loading * pass namespace into reconcilers and collectors * refactor * Extend authz server with Read and Write methods * use new read/write in reconciler * implement server side read and write * Sync permissions for every org * handle namespace in check and list * split read and write * provide conditions * Fix client implementation * fix nil conditions * remove unused client code * use lock for store access * move type translators to common package * fix folder collector * fix store creation * remove unused AuthorizationModelId * fix server tests * fix linter	7 months ago
Karl Persson	f0a5b444e3	Zanzana: generic resource only (#96019 ) * Remove collectors * Remove zanzana search check, we need to rewrite that part to the new schema * Only use generic resource schema and cleanup code we don't want to keep / need to re-write	7 months ago
Jo	9f43724b57	AccessControl: Use UIDs for Resource permissions frontend (#95552 ) * frontend can use uids to set resource permissions * lint * add uids to folder acl * Update public/app/core/components/Select/UserPicker.tsx Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * simplify conditions --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	7 months ago
Karl Persson	dfa8f786d2	Zanzana: fix generic schema (#95648 ) * Change schema so that resource checks on a folder walks the tree	7 months ago
Jo	90d2f4659e	Users: Allow specifying user UIDs in params (#95424 ) * add user ID API translation * add uid to user frontend * use users' UIDs in admin pages * fix ldapSync page * use global user search for user by UID * remove active org filtering * remove orgID params	7 months ago
Jo	2b867d9850	AccessControl: Resource permission translator (#95423 ) * Standardize Resource Translator in options * Add resource UID translator for resource permissions * fix comments * fix comments	7 months ago
Karl Persson	e0163c93c2	Zanzana: reconcile generic schema (#95492 ) * Rename to CheckObject * Implement authz.AccessClient * Move folder tree to reconciler and use new schema * Move shared functionality to common package * Add reconciler for managed permissions and resource translations * Add support for folder resources	7 months ago
Jo	ed1ad34f9b	ServiceAccounts: Allow use of UIDs for Service Account routes (#95401 )	7 months ago
Yuri Tseretyan	2deced7d40	Alerting: Notifications Routes API (#91550 ) * Introduce new models RoutingTree, RouteDefaults and Route and api-server to serve them that is backed by provisioning notification policy service. * update method UpdatePolicyTree of notification policy service to return route and new version * declare new actions alert.notifications.routes:read and alert.notifications.routes:write and two corresponding fixed roles. --------- Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com> Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>	7 months ago
Aaron Godin	d89235aa8c	IAM: fix GetSearchPermissionCacheKey uniqueness (#95192 ) * fix: Change users permissions search to use a consistent key without collisions * Move HashString to cacheutils * Change error handling logic for what to do with a cache key * Add a test that confirms search cache key consistency	7 months ago
Eric Leijonmarck	9ab064bfc5	Folders: Add admin permissions upon creation of a folder w. SA (#95072 ) * add admin permissions upon creation of a folder w. SA * Update pkg/services/folder/folderimpl/folder.go Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Grant service account permissions for creation of dashboards * Grant service account admin permissions upon creating a datasource * fetch user using the userservice with the userid * Revert "fetch user using the userservice with the userid" This reverts commit `23cba78752`. * revert back to original datasource creation --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com>	7 months ago
Matthew Jacobson	4aad44e848	Alerting: Fix per-receiver RBAC for receivers with long names (#95084 ) * Implement uidToResourceID * add middleware * Move uidToResourceID to alerting package * Only hash uid if it's too long * Use hashed uid in access control * Move ReceiverUidToResourceId to ScopeProvider * resolve uid in middleware only if param exists * Tests * Linting --------- Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>	7 months ago
Karl Persson	a82d01214d	Auth: Update authlib (#94947 ) * Update authlib	7 months ago

1 2 3 4 5 ...

543 Commits (ff7ba54cbcd18161b2735a9672b8129168f5037c)