From 1215a28817a57f9c7e1680c231c293f6d4c93261 Mon Sep 17 00:00:00 2001 From: Ieva Date: Fri, 7 Mar 2025 15:48:01 +0000 Subject: [PATCH] [release-10.4.17] Service Accounts: Do not show error pop-ups for Service Account and Renderer UI flows (#101804) * backport fixes from https://github.com/grafana/grafana/pull/101679 * Service Accounts: Don't show error pop-ups for Service Account and Renderer UI flows (#101776) * don't show error pop-ups for SAs and renderer * only hide non 4xx error pop'ups * linting (cherry picked from commit 392124de0059f92cbf41c6db84034a84134fa599) --- pkg/api/user.go | 24 +++++++++++++----------- public/app/core/services/backend_srv.ts | 10 ++++++++++ 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/pkg/api/user.go b/pkg/api/user.go index 73e30ac0a86..785a9d7cae5 100644 --- a/pkg/api/user.go +++ b/pkg/api/user.go @@ -35,7 +35,7 @@ import ( // 404: notFoundError // 500: internalServerError func (hs *HTTPServer) GetSignedInUser(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -142,7 +142,7 @@ func (hs *HTTPServer) UpdateSignedInUser(c *contextmodel.ReqContext) response.Re cmd.Email = strings.TrimSpace(cmd.Email) cmd.Login = strings.TrimSpace(cmd.Login) - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -405,7 +405,7 @@ func (hs *HTTPServer) isExternalUser(ctx context.Context, userID int64) (bool, e // 403: forbiddenError // 500: internalServerError func (hs *HTTPServer) GetSignedInUserOrgList(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -425,7 +425,7 @@ func (hs *HTTPServer) GetSignedInUserOrgList(c *contextmodel.ReqContext) respons // 403: forbiddenError // 500: internalServerError func (hs *HTTPServer) GetSignedInUserTeamList(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -535,7 +535,7 @@ func (hs *HTTPServer) UserSetUsingOrg(c *contextmodel.ReqContext) response.Respo return response.Error(http.StatusBadRequest, "id is invalid", err) } - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -563,7 +563,8 @@ func (hs *HTTPServer) ChangeActiveOrgAndRedirectToHome(c *contextmodel.ReqContex namespace, identifier := c.SignedInUser.GetNamespacedID() if namespace != identity.NamespaceUser { - c.JsonApiErr(http.StatusForbidden, "Endpoint only available for users", nil) + hs.log.Debug("Requested endpoint only available to users") + c.JsonApiErr(http.StatusNotModified, "Endpoint only available for users", nil) return } @@ -608,7 +609,7 @@ func (hs *HTTPServer) ChangeUserPassword(c *contextmodel.ReqContext) response.Re return response.Error(http.StatusBadRequest, "bad request data", err) } - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -675,7 +676,7 @@ func (hs *HTTPServer) SetHelpFlag(c *contextmodel.ReqContext) response.Response return response.Error(http.StatusBadRequest, "id is invalid", err) } - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -710,7 +711,7 @@ func (hs *HTTPServer) SetHelpFlag(c *contextmodel.ReqContext) response.Response // 403: forbiddenError // 500: internalServerError func (hs *HTTPServer) ClearHelpFlags(c *contextmodel.ReqContext) response.Response { - userID, errResponse := getUserID(c) + userID, errResponse := hs.getUserID(c) if errResponse != nil { return errResponse } @@ -727,10 +728,11 @@ func (hs *HTTPServer) ClearHelpFlags(c *contextmodel.ReqContext) response.Respon return response.JSON(http.StatusOK, &util.DynMap{"message": "Help flag set", "helpFlags1": cmd.HelpFlags1}) } -func getUserID(c *contextmodel.ReqContext) (int64, *response.NormalResponse) { +func (hs *HTTPServer) getUserID(c *contextmodel.ReqContext) (int64, *response.NormalResponse) { namespace, identifier := c.SignedInUser.GetNamespacedID() if namespace != identity.NamespaceUser { - return 0, response.Error(http.StatusForbidden, "Endpoint only available for users", nil) + hs.log.Debug("Requested endpoint only available to users") + return 0, response.Error(http.StatusNotModified, "Endpoint only available for users", nil) } userID, err := identity.IntIdentifier(namespace, identifier) diff --git a/public/app/core/services/backend_srv.ts b/public/app/core/services/backend_srv.ts index 559fbff18ff..88f4500952f 100644 --- a/public/app/core/services/backend_srv.ts +++ b/public/app/core/services/backend_srv.ts @@ -273,6 +273,16 @@ export class BackendSrv implements BackendService { } showErrorAlert(config: BackendSrvRequest, err: FetchError) { + // do not show non-user error alerts for api keys or render tokens, they are used for kiosk mode and reporting and can't react to error pop-ups + if ( + (err.status < 400 || err.status >= 500) && + this.dependencies.contextSrv.isSignedIn && + (this.dependencies.contextSrv.user.authenticatedBy === 'apikey' || + this.dependencies.contextSrv.user.authenticatedBy === 'render') + ) { + return; + } + if (config.showErrorAlert === false) { return; }