* `grafana-iam`: Add basic roles to the apis
* Fix validation
* chore: trigger CI
* Leave the hooks intact for now, moving them later
* Remove Role mention from the interface
* Refactor to use a NoopRest backend and Deny access
* add legacy search (wip)
* fix search field name
* implement team search endpoint
* generate openapi spec
* generate endpoints for frontend
* minor fixes
* fix issues found while testing
* add more fields to search result
* add basic unit tests
* add more unit tests
* improve getColumns() func in legacy search
* configure search endpoint in team.cue
* add team search handler
* add the searchTeams endpoint to manifest.cue
* make gofmt
* update openapi spec
* generate frontend endpoints
* remove unused field
* move fields defiitions to separate builder
* fix legacy search
* fix unit tests
* fix unit test
* address feedback
* fix unit test
* update openapi specs
* yarn generate-apis
* add missing unit tests
* OnGoing
comment
* WIP on the wrapper
* Get before Delete
* WIP: add an unimplemented storage authorizer
* WIP implementing the resource permission authorize
* Implement beforeCreate
* Create, Delete, Update
* List
* Use a resource permissions wrapper
* Switch the main authorizer to service
* Add namespace
* Use compile for list
* Comment
* Remove unecessary comments
* fix bug with folder permissions
* Implement tests for List
* Test get
* List test small refactor
* Delete test
* Reorganize code
* imports
* Start splitting the tests
* test AfterDelete
* actually test beforeWrite
* Implement tests for wrapper create
* Test delete
* Test List and Get
* Fix List
* Remaining tests
* simplify
* Remove comments
* Reorder
* Change authorizer to allow access
* implement create method for team bindings
* generate openapi specs
* enable dual writer for team bindings
* add validation rules
* generate openapi
* add integration tests and fix remaining issues
* fix validation test
* use UIDs instead of IDs to build team binding name
* use IDs when generating the TeamBinding name
* fix build error
* remove time truncate
* Use the new authorizer for the User resource
* Use accessClient
* Update pkg/services/authz/rbac/mapper.go
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
---------
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* Extract from #108753
Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>
* Tackle create
Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>
* WIP use identity store to resolve role names
* Commit empty service for now
* Clean
* For now only show name and created at
---------
Co-authored-by: mohammad-hamid <mohammad.hamid@grafana.com>
* Add Create for User + DualWriter setup
* Add delete User
* Fix delete + access check
* Add tests for delete user
* Add tests for create user
* Fixes
* Use sqlx session to fix database locked issues
* wip authz checks
* legacyAccessClient
* Update legacyAccessClient, add tests for create user
* Close rows before running other queries
* Use ExecWithReturningId
* Verify deletion in the tests
* Add Validate and Mutate
* Other changes
* Address feedback
* Update tests
---------
Co-authored-by: Gabriel Mabille <gabriel.mabille@grafana.com>
* IAM: Register CoreRole apis
* one line store instantiation
* Small refactor for readability
* Add authorizer for CoreRole
* Nit
* Error strings should not end with punctiation
* Account for error
* Switch to use the local resource client
* error should not start with upper casing
* noopStorageErr should have a name starting with err
* Update workspace
* I don't know why I don't have the same output as the CI 🤷
* Dependency xOwnership
* imports
* Import order
* Rename alias to make it clear this is legacy
* Extract a helper funtion to perform list with authorization checks
* Add k8s verb to utils package
* Construct default mapping when no custom mapping is passed
* Configure authorization checks for service accounts
* Fix helper and add filtering to service accounts
* Unexport store and create new constructor function
* Add ResourceAuthorizer and LegacyAccessClient
* Configure checks for user store
* List with checks if AccessClient is configured
* Allow system user service account to read all users
---------
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Misi
Gabriel MABILLE
Mihai Doarna
Mihai Turdean
Alexander ZobninandGabriel MABILLE
Ryan McKinley
Karl Persson