* `grafana-iam`: Add basic roles to the apis
* Fix validation
* chore: trigger CI
* Leave the hooks intact for now, moving them later
* Remove Role mention from the interface
* Refactor to use a NoopRest backend and Deny access
* `grafana-iam`: Fetch target parent folder
* WIP add different ParentProviders
* Add version
* Move code to a different file
* Instantiate resourceParentProvider
* same import name
* imports
* Add tests
* Remove unecessary test
* forgot wire
* WIP integration tests
* Add test to cover list
* Fix caching problem in integration tests
* comments
* Logger and comments
* Add lazy creation and caching
* Instantiate clients only once
* Rerun wire gen
* initial generation
* went through doc to add new resource
* added dummy kind so grafana will run
* added dummy handler and custom route
* fix app name
* gets custom route working - still a dummy route
* adds groupOverride to manifest
* adds quotas to grpc client and server
* WIP - trying to get api recognized - not working
* Gets route working
* fixes group and resource vars
* expects group and resource as separate params
* set content-type header on response
* removes Quotas kind and regens
* Update grafana-app-sdk to v0.48.5
* Update codegen
* updates manifest
* formatting
* updates grafana-app-sdk version to 0.48.5
* regen ResourceClient mocks
* adds tests
* remove commented code
* uncomment go mod tidy
* fix tests and make update workspace
* adds quotas app to codeowners
* formatting
* make gen-apps
* deletes temp file
* fix generated folder code
* make gofmt
* make gen-go
* make update-workspace
* add COPY apps/quotas to Dockerfile
* fix test mock
* fixes undefined NewFolderStatus()
* make gen-apps, and add func for NewFolderStatus
* make gen-apps again
* make update-workspace
* regen folder_object_gen.go
* gofmt
* fix linting
* apps/folder make update-workspace
* make gen-apps
* make gen-apps
* fixes enterprise_imports.go
* go get testcontainers
* adds feature toggle
* make update-workspace
* fix go mod
* fix another client mock
---------
Co-authored-by: Steve Simpson <steve@grafana.com>
* add legacy search (wip)
* fix search field name
* implement team search endpoint
* generate openapi spec
* generate endpoints for frontend
* minor fixes
* fix issues found while testing
* add more fields to search result
* add basic unit tests
* add more unit tests
* improve getColumns() func in legacy search
* configure search endpoint in team.cue
* add team search handler
* add the searchTeams endpoint to manifest.cue
* make gofmt
* update openapi spec
* generate frontend endpoints
* remove unused field
* move fields defiitions to separate builder
* fix legacy search
* fix unit tests
* fix unit test
* address feedback
* fix unit test
* update openapi specs
* yarn generate-apis
* add missing unit tests
* OnGoing
comment
* WIP on the wrapper
* Get before Delete
* WIP: add an unimplemented storage authorizer
* WIP implementing the resource permission authorize
* Implement beforeCreate
* Create, Delete, Update
* List
* Use a resource permissions wrapper
* Switch the main authorizer to service
* Add namespace
* Use compile for list
* Comment
* Remove unecessary comments
* fix bug with folder permissions
* Implement tests for List
* Test get
* List test small refactor
* Delete test
* Reorganize code
* imports
* Start splitting the tests
* test AfterDelete
* actually test beforeWrite
* Implement tests for wrapper create
* Test delete
* Test List and Get
* Fix List
* Remaining tests
* simplify
* Remove comments
* Reorder
* Change authorizer to allow access
* Zanzana: Use team bindings write APIs on the client side
* fix linter
* remove unused code
* Apply suggestions from code review
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* fix syntax
---------
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* `grafana-iam`: Use the UniStore as the default store
* Refactor all instantiations
* Remove enableDualWriter
* Nit. dw is clear enough
* Use the correct access control client
* passes nsr to GetResourceStats instead of just namespace
* removes ns check
* fixes failing tests
* make update-workspace
* pass group and resource from rebuild request when getting resource stats
* Add delete and update hooks for roles/core roles
no need to capture non reference types
small cleanup on vars
* fix ticket priming in hooks
* fix ticket priming in hooks
* Revert "fix ticket priming in hooks"
This reverts commit f8e953ca09.
* use old testing blocks
* protect runtime obj in go func
* update test for correctness
* separate files for test correctness. fix leaking goroutines in go tests
* go workspace fixes
* attribute owner
* clean up go mod
* wip
* wip
* wip
(cherry picked from commit 8cedf25892)
* Search seems to be working, the validation is still wip
* Use keyword.Name analyzer for Filterable fields
* Only string fields should be indexed with keyword analyzer
* Change search query for email and login fields to use term query
* Remove unnecessary Exact from the resource protobuf definitions
Co-Authored-By: Ryan McKinley <ryantxu@gmail.com>
* Add legacy search support to the API
* Tests for legacy search, validate and integration tests for user
* Lint
* Add snapshot tests to userDocumentBuilder
* Address CodeQL issues
* Improvements, handle Mode2, tests should pass
* Change default limit from 0 to 1 for requests
* Cleanup
* Add fixme
* Update pkg/registry/apis/iam/register.go
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
* Update pkg/registry/apis/iam/user/legacy_search.go
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
---------
Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
* implement the update method for team bindings
* fix lint error
* add integration tests
* add integration test for non existing team binding
* try to fix lint error
As part of migrating Grafana's authorization system to Zanzana (OpenFGA), we need to ensure that role permissions defined in the IAM API are automatically synced to the authorization backend. Without this sync, roles created through the API would not be enforced by Zanzana, creating an inconsistency between defined permissions and actual authorization decisions.
This is a critical piece of the dual-write pattern during the migration to Zanzana, ensuring that:
Role permissions are immediately available for authorization checks
The legacy RBAC system and new Zanzana system remain in sync
Users experience consistent permission enforcement regardless of which backend is queried
safe to revert
Misi
Gabriel MABILLE
Mihai Doarna
owensmallwoodandSteve Simpson
Alexander ZobninandGabriel MABILLE
Jean-Philippe Quéméner
Jo
Mihai Turdean
Denis VodopianovandDave Henderson
