grafana

Commit Graph

Author	SHA1	Message	Date
Karl Persson	4083b2208e	Zanzana: periodic sync of team members (#94752 ) * Rewrite zanzana collector to fetch all available pages * Register access control as a background service * If zanzana is enabled we run Syncs and start Reconciliation job * Update pkg/services/authz/zanzana/client/client.go Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> * Use server lock when doing performing reconciliation	8 months ago
Alexander Zobnin	e642e1a804	Zanzana: Pass parent folder for the checks in search queries (#94541 ) * Pass parent folder as a contextual tuple in Check request * Search by listing folders and dashboards * skip dashboards listing if limit reached * remove unused * add some comments * only add ContextualTuples if parent provided * Remove parent relation for dashboards from schema and perform separate checks	8 months ago
Ieva	d7aca7d0fe	Role mapping: Add `group_mapping_uid` column to `user_role` table (#93810 ) * add group_mapping_uid column to user_role table * add group mapping UID to user role struct	8 months ago
Jo	acd13e05ef	Teams: Support team UIDs in APIs (#94011 ) * support team UIDs in APIs * unify middleware logic and add team tests * add UID test to resource permissions * remove unused middleware	8 months ago
Yuri Tseretyan	27c7e33217	Alerting: Update permissions to reciever and template test API (#94282 ) * add action "alert.notifications.receivers:test" to receiver creator * update API permissions to accept new granular actions	8 months ago
Alexander Zobnin	5d724c2482	Zanzana: Initial dashboard search (#93093 ) * Zanzana: Search in a background and compare results * refactor * Search with check * instrument zanzana client * add single_read option * refactor * refactor move check into separate function * Fix tests * refactor * refactor getFindDashboardsFn * add resource type to span attributes * run ListObjects concurrently * Use list and search in less cases * adjust metrics buckets * refactor: move Check and ListObjects to AccessControl implementation * Revert "Fix tests" This reverts commit `b0c2f072a2`. * refactor: use own types for Check and ListObjects inside accesscontrol package * Fix search scenario with low limit and empty query string * more accurate search with checks * revert * fix linter * Revert "revert" This reverts commit `ee5f14eea8`. * add search errors metric * fix query performance under some conditions * simplify check strategy * fix pagination * refactor findDashboardsZanzanaList * Iterate over multiple pages while making check request * refactor listUserResources * avoid unnecessary db call * remove unused zclient * Add notes for SkipAccessControlFilter * use more accurate check loop * always use check for search with provided UIDs * rename single_read to zanzana_only_evaluation * refactor * update go workspace * fix linter * don't use deprecated fields * refactor * fail if no org specified * refactor * initial integration tests * Fix tests * fix linter errors * fix linter * Fix tests * review suggestions Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix limit * refactor * refactor tests * fix db config in tests * fix migrator (postgres) --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	8 months ago
Arati R.	e399fe6d09	Folders: Set folder creation permission as part of legacy create (#94040 ) * Add folder store to dashboard permissions * Include folder store in annotation scope resolver * Add folder store when initialising library elements * Include folder store in search v2 service initialisation * Include folder store in GetInheritedScopes * Add folder store to folder permissions provider * Include cfg, folder permissions in folder service * Move setting of folder permissions for folder service create method	8 months ago
Tom Ratcliffe	fc51ec70ba	Alerting: Add manage permissions UI logic for Contact Points (#92885 ) * Add showPolicies prop * Add manage permissions component for easier reuse within alerting * Add method for checking whether to show access control within alerting * Remove accidental console.log from main * Tweak styling for contact point width and add manage permissions drawer * Improve typing for access control type response * Add basic test for manage permissions on contact points list * Only show manage permissions if grafana AM and alertingApiServer is enabled * Update i18n * Add test utils for turning features on and back off * Add access control handlers * Update tests with new util * Pass AM in and add tests * Receiver OSS resource permissions There is a complication that is not fully addressed: Viewer defaults to read:* and Editor defaults to read+write+delete:* This is different to other resource permissions where non-admin are not granted any global permissions and instead access is handled solely by resource-specific permissions that are populated on create and removed on delete. This allows them to easily remove permission to view or edit a single resource from basic roles. The reason this is tricky here is that we have multiple APIs that can create/delete receivers: config api, provisioning api, and k8s receivers api. Config api in particular is not well-equipped to determine when creates/deletes are happening and thus ensuring that the proper resource-specific permissions are created/deleted is finicky. We would also have to create a migration to populate resource-specific permissions for all current receivers. This migration would need to be reset so it can run again if the flag is disabled. * Add access control permissions * Pass in contact point ID to receivers form * Temporarily remove access control check for contact points * Include access control metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/accessControl` * Include new permissions for contact points navbar * Fix receiver creator fixed role to not give global read * Include in-use metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/inUse` * Add receiver creator permission to receiver writer * Add receiver creator permission to navbar * Always allow listing receivers, don't return 403 * Remove receiver read precondition from receiver create Otherwise, Creator role will not be able to create their first receiver * Update routes permissions * Add further support for RBAC in contact points * Update routes permissions * Update contact points header logic * Back out test feature toggle refactor Not working atm, not sure why * Tidy up imports * Update mock permissions * Revert more test changes * Update i18n * Sync inuse metadata pr * Add back canAdmin permissions after main merge * Split out check for policies navtree item * Tidy up utils and imports and fix rules in use * Fix contact point tests and act warnings * Add missing ReceiverPermissionAdmin after merge conflict * Move contact points permissions * Only show contact points filter when permissions are correct * Move to constants * Fallback to empty array and remove labelSelectors (not needed) * Allow `toAbility` to take multiple actions * Show builtin alertmanager if contact points permission * Add empty state and hide templates if missing permissions * Translations * Tidy up mock data * Fix tests and templates permission * Update message for unused contact points * Don't return 403 when user lists receivers and has access to none * Fix receiver create not adding empty uid permissions * Move SetDefaultPermissions to ReceiverPermissionService * Have SetDefaultPermissions use uid from string Fixes circular dependency * Add FakeReceiverPermissionsService and fix test wiring * Implement resource permission handling in provisioning API and renames Create: Sets to default permissions Delete: Removes permissions Update: If receiver name is modified and the new name doesn't exist, it copies the permissions from the old receiver to the newly created one. If old receiver is now empty, it removes the old permissions as well. * Split contact point permissions checks for read/modify * Generalise getting annotation values from k8s entities * Proxy RouteDeleteAlertingConfig through MultiOrgAlertmanager * Cleanup permissions on config api reset and restore * Cleanup permissions on config api POST note this is still not available with feature flag enabled * Gate the permission manager behind FF until initial migration is added * Sync changes from config api PR * Switch to named export * Revert unnecessary changes * Revert Filter auth change and implement in k8s api only * Don't allow new scoped permissions to give access without FF Prevents complications around mixed support for the scoped permissions causing oddities in the UI. * Fix integration tests to account for list permission change * Move to `permissions` file * Add additional tests for contact points * Fix redirect for viewer on edit page * Combine alerting test utils and move to new file location * Allow new permissions to access provisioning export paths with FF * Always allow exporting if its grafana flavoured * Fix logic for showing auto generated policies * Fix delete logic for contact point only referenced by a rule * Suppress warning message when renaming a contact point * Clear team and role perm cache on receiver rename Prevents temporarily broken UI permissions after rename when a user's source of elevated permissions comes from a cached team or basic role permission. * Debug log failed cache clear on CopyPermissions --------- Co-authored-by: Matt Jacobson <matthew.jacobson@grafana.com>	8 months ago
Karl Persson	0160f4f72c	RBAC: Add legacy authorization checks to service accounts (#93753 ) * Extract a helper funtion to perform list with authorization checks * Add k8s verb to utils package * Construct default mapping when no custom mapping is passed * Configure authorization checks for service accounts * Fix helper and add filtering to service accounts	8 months ago
Gabriel MABILLE	7928245eb6	ManagedServiceAccounts: Add a config option to disable the feature on-prem (#93571 ) * ManagedServiceAccounts: Add a config option to disabled by default * Update log in pkg/services/extsvcauth/registry/service.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	8 months ago
Jeff Levin	a21a232a8e	Revert read replica POC (#93551 ) * Revert "chore: add replDB to team service (#91799)" This reverts commit `c6ae2d7999`. * Revert "experiment: use read replica for Get and Find Dashboards (#91706)" This reverts commit `54177ca619`. * Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)" This reverts commit `299c142f6a`. * Revert "refactor replCfg to look more like plugins/plugin config (#91142)" This reverts commit `ac0b4bb34d`. * Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)" This reverts commit `daedb358dd`. * Revert "Chore (sqlstore): add validation and testing for repl config (#90683)" This reverts commit `af19f039b6`. * Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)" This reverts commit `27b52b1507`. * Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)" This reverts commit `8a6107cd35`. * Revert "accesscontrol service read replica (#89963)" This reverts commit `77a4869fca`. * Revert "Fix: add mapping for the new mysqlRepl driver (#89551)" This reverts commit `ab5a079bcc`. * Revert "fix: sql instrumentation dual registration error (#89508)" This reverts commit `d988f5c3b0`. * Revert "Experimental Feature Toggle: databaseReadReplica (#89232)" This reverts commit `50244ed4a1`.	8 months ago
Yuri Tseretyan	10582e48f7	Alerting: Notifications Templates API (#91349 )	8 months ago
Misi	d411ce2664	Auth: Use sessionStorage instead of cookie for automatic redirection (#92759 ) * WIP: working as expected, has to be tested * Rename query param, small changes * Remove unused code * Address feedback * Cleanup * Use the feature toggle to control the behaviour * Use the toggle on the FE too * Prevent the extra redirect/reload Co-authored-by: Josh Hunt <joshhunt@users.noreply.github.com> * Return to login if user is not authenticated * Add tracking issue * Align BE redirect constructor to locationSvc	8 months ago
Karl Persson	c28b37a67b	RBAC: Add option to skip rbac check for specified verbs (#93654 ) * Add option to skip rbac check for specified verbs	8 months ago
Matthew Jacobson	e699348d39	Alerting: Managed receiver resource permission in provisioning (#93631 ) * Alerting: Managed receiver resource permission in provisioning	8 months ago
Matthew Jacobson	6652233493	Alerting: Managed receiver resource permission in receiver_svc (#93556 ) * Alerting: Managed receiver resource permission in receiver_svc	8 months ago
Karl Persson	2e38329026	RBAC: Add required component to perform access control checks for user api when running single tenant (#93104 ) * Unexport store and create new constructor function * Add ResourceAuthorizer and LegacyAccessClient * Configure checks for user store * List with checks if AccessClient is configured * Allow system user service account to read all users --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	8 months ago
Matthew Jacobson	1ede1e32b8	Alerting: Receiver resource permissions service (#93552 )	8 months ago
Gabriel MABILLE	8d84517103	AuthN: Introduce `DefaultOrgID` function for managed service accounts (#93432 ) * Managed Service Accounts: Use AutoAssignOrgID * Fix the IsExternalServiceAccount function * Reassign service account role * Account for AutoAssignOrg * Update pkg/services/serviceaccounts/models.go * Simplify IsExternalServiceAccount function * Add tests * Easier to understand test * Revert small change	8 months ago
Gabriel MABILLE	697afc71b4	RBAC: FIX Allow specifying several valid scopes for a kind (#93176 ) * PermRegistry: Fix regression with actions applying to multiple scopes * Add tests Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	9 months ago
linoman	a0c886922e	Auth: Add LDAP scope to Grafana Admin (#92990 ) Add LDAP scope to Grafana Admin	9 months ago
Alexander Zobnin	88259da745	RBAC: Optimize permissions caching (#92673 ) * Access control: Use composite cache key for team permissions * use composite key for teams * use cache for hotpath (getCachedUserPermissions) * don't cache empty teams set * don't pass permissions as argument * early return if no teams found * reload cache correctly * optimize allocations * Clear user's teams cache * remove composite cache for teams * fix linter * don't clear teams permissions * pre-allocate memory for basic roles permissions	9 months ago
Ieva	46e81e98cf	RBAC: Always store action sets (#92833 ) always store action sets, even if FT is disabled	9 months ago
Jeff Levin	372d0acec8	Instrument tracing across dashboards (#91937 ) Add tracing across dashboards and accesscontrol	9 months ago
Gabriel MABILLE	2a1a43fc9b	PermissionRegistry: Error on unknown kind (#91469 ) * PermissionRegistry: Error on unknown kind * Account for PR feedback Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> * Add missing alerting scope --------- Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>	9 months ago
Aaron Godin	86e8e3b75d	Revert "RBAC: Optimize permissions caching" (#92548 ) Revert "RBAC: Optimize permissions caching (#92412)" This reverts commit `488e994d37`. Co-authored-by: gamab <gabriel.mabille@grafana.com>	9 months ago
Alexander Zobnin	0e0c877609	Zanzana: Model fixed roles as a part of schema (#92364 ) * model fixed roles for dashboards and folders * Correctly translate fixed role assignments * minor refactor * assign fixed roles to teams * fix linter errors * Migrate general folder permissions for fixed roles * fix dashboards:create permission	9 months ago
Alexander Zobnin	488e994d37	RBAC: Optimize permissions caching (#92412 ) * Access control: Use composite cache key for team permissions * use composite key for teams * use cache for hotpath (getCachedUserPermissions) * fix linter * fix sorting --------- Co-authored-by: Jeff Levin <jeff@levinology.com>	9 months ago
Matthew Jacobson	32f06c6d9c	Alerting: Receiver API complete core implementation (#91738 ) * Replace global authz abstraction with one compatible with uid scope * Replace GettableApiReceiver with models.Receiver in receiver_svc * GrafanaIntegrationConfig -> models.Integration * Implement Create/Update methods * Add optimistic concurrency to receiver API * Add scope to ReceiversRead & ReceiversReadSecrets migrates existing permissions to include implicit global scope * Add receiver create, update, delete actions * Check if receiver is used by rules before delete * On receiver name change update in routes and notification settings * Improve errors * Linting * Include read permissions are requirements for create/update/delete * Alias ngalert/models to ngmodels to differentiate from v0alpha1 model * Ensure integration UIDs are valid, unique, and generated if empty * Validate integration settings on create/update * Leverage UidToName to GetReceiver instead of GetReceivers * Remove some unnecessary uses of simplejson * alerting.notifications.receiver -> alerting.notifications.receivers * validator -> provenanceValidator * Only validate the modified receiver stops existing invalid receivers from preventing modification of a valid receiver. * Improve error in Integration.Encrypt * Remove scope from alert.notifications.receivers:create * Add todos for receiver renaming * Use receiverAC precondition checks in k8s api * Linting * Optional optimistic concurrency for delete * make update-workspace * More specific auth checks in k8s authorize.go * Add debug log when delete optimistic concurrency is skipped * Improve error message on authorizer.DecisionDeny * Keep error for non-forbidden errutil errors	9 months ago
Karl Persson	ddee95cb6d	Team: Create permission type for team membership (#92352 ) * Create permission type enum for team and remove usage of dashboard permission type	9 months ago
Ieva	41ac5b5ae7	RBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to (#92024 ) * look at global perms if user is not a part of the target org * use constant * update tests	9 months ago
Dave Henderson	df3d8915ba	Chore: Bump Go to 1.23.0 (#92105 ) * chore: Bump Go to 1.23.0 Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * update swagger files Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * chore: update .bingo/README.md formatting to satisfy prettier Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * chore(lint): Fix new lint errors found by golangci-lint 1.60.1 and Go 1.23 Signed-off-by: Dave Henderson <dave.henderson@grafana.com> * keep golden file * update openapi * add name to expected output * chore(lint): rearrange imports to a sensible order Signed-off-by: Dave Henderson <dave.henderson@grafana.com> --------- Signed-off-by: Dave Henderson <dave.henderson@grafana.com> Co-authored-by: Ryan McKinley <ryantxu@gmail.com>	9 months ago
Jeff Levin	028e8ac59e	Instrument tracing across accesscontrol (#91864 ) Instrument tracing across accesscontrol --------- Co-authored-by: Dave Henderson <dave.henderson@grafana.com>	10 months ago
Kristin Laemmert	c6ae2d7999	chore: add replDB to team service (#91799 )	10 months ago
Alexander Zobnin	aaf33c7923	Zanzana: Migrate basic, fixed and custom roles (#91814 ) * Zanzana: Migrate basic roles permissions * add basic roles assignments * refactor * Sync basic roles permissions in all orgs * migrate fixed roles * map root folders to orgs * fix basic role assignments in orgs * migrate other roles * migrate team roles assignments * add notes about authorization schema * don't migrate fixed roles	10 months ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801 ) * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	10 months ago
Ieva	6e7bc028d0	RBCA: Better separation between action set svc and store (#91491 ) better separation between action set svc and store	10 months ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763 )	10 months ago
Karl Persson	bcfb66b416	Identity: remove GetTypedID (#91745 )	10 months ago
Alexander Zobnin	1cc438a56c	Zanzana: Evaluate dashboard and folder permissions (#91539 ) * Zanzana: basic folder permissions checks * Fix managed permissions for teams * fix sync batch size * add dashboards actions translations * migrate folder tree * migrate dashboard folders * remove action sets from schema * Adding more dashboard and folder-related permissions * refactor * Correctly translate dashboard permissions in folders * fix dashboard parent permissions	10 months ago
Alexander Zobnin	0e5d7633f7	Access Control: Make it possible to exclude role grants (#91647 )	10 months ago
Gabriel MABILLE	8988e04044	RBAC: Add permission registry (#91247 ) * RBAC: Permission registry * Populate permission registry * Wire * conflic_user_cmd * Update pkg/services/accesscontrol/permreg/permreg_test.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * PR feedback Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Remove ToDo, tackle in subsequent PR --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	10 months ago
Ieva	2e2ddc5c42	Folders: Allow folder editors and admins to create subfolders without any additional permissions (#91215 ) * separate permissions for root level folder creation and subfolder creation * fix tests * fix tests * fix tests * frontend fix * Update pkg/api/accesscontrol.go Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com> * fix frontend when action sets are disabled --------- Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>	10 months ago
Ryan McKinley	728150bdbd	Identity: extend k8s user.Info (#90937 )	10 months ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567 )	10 months ago
Ieva	9bb2cf4968	RBAC: Allow omitting default permissions when a new resource is created (#90720 ) * Cfg: Move rbac settings to own struct * Cfg: Add setting to control if resource should generate managed permissions when created * Dashboards: Check if we should generate default permissions when dashboard is created * Folders: Check if we should generate default permissions when folder is created * Datasource: Check if we should generate default permissions when datasource is created * ServiceAccount: Check if we should generate default permissions when service account is created * Cfg: Add option to specify resources for wich we should default seed * ManagedPermissions: Move providers to their own files * Dashboards: Default seed all possible managed permissions if configured * Folders: Default seed all possible managed permissions if configured * Cfg: Remove service account from list * RBAC: Move utility function * remove managed permission settings from the config file examples, change the setting names * remove ini file changes from the PR * fix setting reading * fix linting errors * fix tests * fix wildcard role seeding --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: jguer <me@jguer.space>	10 months ago
Vardan Torosyan	82236976ae	Add support ticket fixed roles to cloud role sync (#90864 ) * Add support ticket fixed roles to cloud role sync * Adding tests * Fix the linter	10 months ago
Ieva	4c7d8c8cdd	RBAC: Refactor RBAC plugin interface code (#90679 ) move plugin RBAC registration ifaces to pluginsintegrations	10 months ago
Eric Leijonmarck	248af65f9c	Actionsets: Add ability for plugins to add actions for core actionsets (i.e. `folders:edit`) (#88776 ) * initial commit * Action sets stored remove the dependancy for actionsets got the actionsets registered storing the permissions * fix golanglinting * remove unused struct field * wip * actionset registry for a plugin from the actionsetservice * update to make declareactionset the primary way of plugin registration and modification * declare actually extends actionsets * tests fixed * tests skipped * skip tests * skip tests * skip tests * skip tests * change to warning instead * remove step from pipeline to see if it fails due to plugin not registering * reintroduce step but remove features dependancy * add back the tests that were failing * remove comments and another skip test * fix a comment and remove unneeded changes * fix and clean up, put the behaviour behind a feature toggle * clean up * fixing tests * hard-code allowed action sets for plugins * Apply suggestions from code review Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * small cleanup --------- Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	11 months ago
Kristin Laemmert	77a4869fca	accesscontrol service read replica (#89963 ) * accesscontrol service read replica * now using the ReplDB interface * ReadReplica for GetUser	11 months ago

1 2 3 4 5 ...

543 Commits (ff7ba54cbcd18161b2735a9672b8129168f5037c)