Commit Graph
17 Commits
Author SHA1 Message Date
Gabriel MABILLE e5b0353c41 grafana-iam: Use an API Installer interface (#115310)
* `grafana-iam`: Add basic roles to the apis

* Fix validation

* chore: trigger CI

* Leave the hooks intact for now, moving them later

* Remove Role mention from the interface

* Refactor to use a NoopRest backend and Deny access
2025-12-18 10:29:50 +01:00
Gabriel MABILLE 478ae15f0e grafana-iam: Use parent folder to authorize ResourcePermissions (#115008)
* `grafana-iam`: Fetch target parent folder

* WIP add different ParentProviders

* Add version

* Move code to a different file

* Instantiate resourceParentProvider

* same import name

* imports

* Add tests

* Remove unecessary test

* forgot wire

* WIP integration tests

* Add test to cover list

* Fix caching problem in integration tests

* comments

* Logger and comments

* Add lazy creation and caching

* Instantiate clients only once

* Rerun wire gen
2025-12-12 11:43:12 +01:00
Misi 0c264b7a5f IAM: Add user search endpoint (#114542)
* wip: initial changes, api registration

* wip

* LegacySearch working with sorting

* Revert mapper change for now

* Clean up

* Cleanup, add integration tests

* Improve tests

* OpenAPI def regen

* Use wildcard search, fix lastSeenAt handling, add lastSeenAtAge

* Add missing files

* Fix merge

* Fixes

* Add tests, regen openapi def

* Address feedback

* Address feedback batch 2

* Chores

* regen openapidef

* Address feedback

* Add tests for paging

* gen apis

* Revert go.mod, go.sum. go.work.sum

* Fix + remove extra tracer parameter
2025-12-11 19:54:48 +01:00
Mihai Doarna b2e1b257b3 IAM: Add search for teams in app platform (#113503)
* add legacy search (wip)

* fix search field name

* implement team search endpoint

* generate openapi spec

* generate endpoints for frontend

* minor fixes

* fix issues found while testing

* add more fields to search result

* add basic unit tests

* add more unit tests

* improve getColumns() func in legacy search

* configure search endpoint in team.cue

* add team search handler

* add the searchTeams endpoint to manifest.cue

* make gofmt

* update openapi spec

* generate frontend endpoints

* remove unused field

* move fields defiitions to separate builder

* fix legacy search

* fix unit tests

* fix unit test

* address feedback

* fix unit test

* update openapi specs

* yarn generate-apis

* add missing unit tests
2025-12-08 15:02:59 +02:00
Misi 93ec32dd6a IAM: Add teams/{id}/groups as a custom endpoint to Teams API (#114228)
* Add teams/{id}/groups as a custom endpoint

* TeamGroupsHandler OSS and Ent registration

* Update OpenAPI spec

* Add indexer tests for external group mapping

* Remove noopsearch

* Remove unnecessary interface declaration, fixes

* Chores

* fmt

* Rename constant

* Align the rest to the changes of main

* Update workspace

* Add missing file
2025-11-25 14:19:57 +01:00
Gabriel MABILLE b5a50e7772 grafana-iam: Use the UniStore as the default store (#113614)
* `grafana-iam`: Use the UniStore as the default store

* Refactor all instantiations

* Remove enableDualWriter

* Nit. dw is clear enough

* Use the correct access control client
2025-11-20 15:51:50 +01:00
Misi 06373ae47b IAM: Add ExternalGroupMapping kind for TeamSync (#113052)
* wip

* wip

* Add authorizer -> VERIFY it's working correctly

* Update openapi definitions

* Authorizer wip

* regen apis

* Increase timeout of pg int tests to 20m

* Revert "Increase timeout of pg int tests to 20m"

This reverts commit 8c20568217.

* Fix NewTestStore when Truncate is enabled
2025-11-05 18:02:34 +01:00
ad9d8098ef IAM: Add email, login field validation to User create/update API (#112391)
* wip

* wip

* wip

(cherry picked from commit 8cedf25892)

* Search seems to be working, the validation is still wip

* Use keyword.Name analyzer for Filterable fields

* Only string fields should be indexed with keyword analyzer

* Change search query for email and login fields to use term query
* Remove unnecessary Exact from the resource protobuf definitions

Co-Authored-By: Ryan McKinley <ryantxu@gmail.com>

* Add legacy search support to the API

* Tests for legacy search, validate and integration tests for user

* Lint

* Add snapshot tests to userDocumentBuilder

* Address CodeQL issues

* Improvements, handle Mode2, tests should pass

* Change default limit from 0 to 1 for requests

* Cleanup

* Add fixme

* Update pkg/registry/apis/iam/register.go

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>

* Update pkg/registry/apis/iam/user/legacy_search.go

Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
2025-10-23 11:29:02 +02:00
Gabriel MABILLE 0eb28d4f37 grafana-iam: Async write to zanzana (#112357)
* `grafana-iam`: Async write to zanzana

* More succint

* Add a metric to keep track of waiting times for future calibration

* metrics
2025-10-16 08:33:06 +02:00
Gabriel MABILLE 0e34164329 grafana-iam: Populate Zanzana on resource permission creation (#111654)
* `grafana-iam`: Populate Zanzana on resource permission creation

* use zanzana const

* Adding a toggle

* Add a new feature toggle to manage zanzana sync

* wire

* wire

* WIP

* Fix hook issue

* comments and tests

* Account for PR feedback

* Add a timeout to writes

* Check tuples len

* comment

* validate basic role

* shorter error

* object reads better than entry
2025-10-13 21:37:13 +02:00
Alexander ZobninandGabriel MABILLE 893523dd7c grafana-iam: Wire RoleBindings APIs to OSS (#111728)
* Update role binding specs

* Wire role bindings APIs in OSS

* gofmt

* revert modules updates

* update specs

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* update registration

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix reader

* fix format

* add role bindings mapper

* remove namespace from subject spec

* fix formatting

* update api specs

* Fix role binding registration

* remove mapper

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2025-09-29 14:28:12 +02:00
Gabriel MABILLEandmohammad-hamid b6226c6173 grafana-iam: Skeleton of the resource permission api backend (#110218)
* Extract from #108753

Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>

* Tackle create

Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>

* WIP use identity store to resolve role names

* Commit empty service for now

* Clean

* For now only show name and created at

---------

Co-authored-by: mohammad-hamid <mohammad.hamid@grafana.com>
2025-08-27 15:00:09 +02:00
Gabriel MABILLE 1a7a7f1d99 grafana-iam: Wire the roles api (#108577) 2025-07-28 13:36:27 +02:00
Victor Cinaglia 5f6fc38430 iam/authn: Introduce feature flag for authz resource mutations (#108698)
* iam/authz: introduce feature flag for authz resource mutations

* lint: fix typo
2025-07-25 12:05:32 -03:00
Victor CinagliaandCharandas Batra 4c17c1cbb6 IAM: Instantiate DualWriter only when in single-tenant mode (#108558)
* Instantiate dual writer only in ST case

* minor cleanup

---------

Co-authored-by: Charandas Batra <charandas.batra@grafana.com>
2025-07-24 09:33:53 -03:00
MisiandGabriel Mabille c6a6b9fdd2 IAM: Create and delete user from the legacy store (#107694)
* Add Create for User + DualWriter setup

* Add delete User

* Fix delete + access check

* Add tests for delete user

* Add tests for create user

* Fixes

* Use sqlx session to fix database locked issues

* wip authz checks

* legacyAccessClient

* Update legacyAccessClient, add tests for create user

* Close rows before running other queries

* Use ExecWithReturningId

* Verify deletion in the tests

* Add Validate and Mutate

* Other changes

* Address feedback

* Update tests

---------

Co-authored-by: Gabriel Mabille <gabriel.mabille@grafana.com>
2025-07-17 11:50:40 +02:00
Gabriel MABILLE 3d543a336f IAM: Register CoreRole apis (#106924)
* IAM: Register CoreRole apis

* one line store instantiation

* Small refactor for readability

* Add authorizer for CoreRole

* Nit

* Error strings should not end with punctiation

* Account for error

* Switch to use the local resource client

* error should not start with upper casing

* noopStorageErr should have a name starting with err

* Update workspace

* I don't know why I don't have the same output as the CI 🤷

* Dependency xOwnership

* imports

* Import order

* Rename alias to make it clear this is legacy
2025-06-26 10:11:28 +02:00