From 0935048c0b82b32e52f3d5f4ccc450f75825b288 Mon Sep 17 00:00:00 2001 From: Ieva Date: Fri, 7 Mar 2025 15:48:17 +0000 Subject: [PATCH] [release-11.0.12] Service Accounts: Do not show error pop-ups for Service Account and Renderer UI flows (#101803) * backport fixes from https://github.com/grafana/grafana/pull/101679 * Service Accounts: Don't show error pop-ups for Service Account and Renderer UI flows (#101776) * don't show error pop-ups for SAs and renderer * only hide non 4xx error pop'ups * linting (cherry picked from commit 392124de0059f92cbf41c6db84034a84134fa599) --- pkg/api/user.go | 24 +++++++++++++----------- public/app/core/services/backend_srv.ts | 10 ++++++++++ 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/pkg/api/user.go b/pkg/api/user.go index eadacc1ed6d..76d814e8981 100644 --- a/pkg/api/user.go +++ b/pkg/api/user.go @@ -31,7 +31,7 @@ import ( // 404: notFoundError // 500: internalServerError func (hs *HTTPServer) GetSignedInUser(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -138,7 +138,7 @@ func (hs *HTTPServer) UpdateSignedInUser(c *contextmodel.ReqContext) response.Re cmd.Email = strings.TrimSpace(cmd.Email) cmd.Login = strings.TrimSpace(cmd.Login) - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -333,7 +333,7 @@ func (hs *HTTPServer) isExternalUser(ctx context.Context, userID int64) (bool, e // 403: forbiddenError // 500: internalServerError func (hs *HTTPServer) GetSignedInUserOrgList(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -353,7 +353,7 @@ func (hs *HTTPServer) GetSignedInUserOrgList(c *contextmodel.ReqContext) respons // 403: forbiddenError // 500: internalServerError func (hs *HTTPServer) GetSignedInUserTeamList(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -463,7 +463,7 @@ func (hs *HTTPServer) UserSetUsingOrg(c *contextmodel.ReqContext) response.Respo return response.Error(http.StatusBadRequest, "id is invalid", err) } - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -491,7 +491,8 @@ func (hs *HTTPServer) ChangeActiveOrgAndRedirectToHome(c *contextmodel.ReqContex namespace, identifier := c.SignedInUser.GetNamespacedID() if namespace != identity.NamespaceUser { - c.JsonApiErr(http.StatusForbidden, "Endpoint only available for users", nil) + hs.log.Debug("Requested endpoint only available to users") + c.JsonApiErr(http.StatusNotModified, "Endpoint only available for users", nil) return } @@ -536,7 +537,7 @@ func (hs *HTTPServer) ChangeUserPassword(c *contextmodel.ReqContext) response.Re return response.Error(http.StatusBadRequest, "bad request data", err) } - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -603,7 +604,7 @@ func (hs *HTTPServer) SetHelpFlag(c *contextmodel.ReqContext) response.Response return response.Error(http.StatusBadRequest, "id is invalid", err) } - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -638,7 +639,7 @@ func (hs *HTTPServer) SetHelpFlag(c *contextmodel.ReqContext) response.Response // 403: forbiddenError // 500: internalServerError func (hs *HTTPServer) ClearHelpFlags(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -655,10 +656,11 @@ func (hs *HTTPServer) ClearHelpFlags(c *contextmodel.ReqContext) response.Respon return response.JSON(http.StatusOK, &util.DynMap{"message": "Help flag set", "helpFlags1": cmd.HelpFlags1}) } -func getUserID(c *contextmodel.ReqContext) (int64, *response.NormalResponse) { +func (hs *HTTPServer) getUserID(c *contextmodel.ReqContext) (int64, *response.NormalResponse) { namespace, identifier := c.SignedInUser.GetNamespacedID() if namespace != identity.NamespaceUser { - return 0, response.Error(http.StatusForbidden, "Endpoint only available for users", nil) + hs.log.Debug("Requested endpoint only available to users") + return 0, response.Error(http.StatusNotModified, "Endpoint only available for users", nil) } userID, err := identity.IntIdentifier(namespace, identifier) diff --git a/public/app/core/services/backend_srv.ts b/public/app/core/services/backend_srv.ts index 559fbff18ff..88f4500952f 100644 --- a/public/app/core/services/backend_srv.ts +++ b/public/app/core/services/backend_srv.ts @@ -273,6 +273,16 @@ export class BackendSrv implements BackendService { } showErrorAlert(config: BackendSrvRequest, err: FetchError) { + // do not show non-user error alerts for api keys or render tokens, they are used for kiosk mode and reporting and can't react to error pop-ups + if ( + (err.status < 400 || err.status >= 500) && + this.dependencies.contextSrv.isSignedIn && + (this.dependencies.contextSrv.user.authenticatedBy === 'apikey' || + this.dependencies.contextSrv.user.authenticatedBy === 'render') + ) { + return; + } + if (config.showErrorAlert === false) { return; }