fix: allow editors to POST jobs in provisioning API
Editors should be able to post jobs in the 'jobs' endpoint for syncing
repositories. This aligns with the requirement that syncing a repository
requires editor privileges.
- Separated 'jobs' subresource authorization from repository/test
- Allow both admins and editors to POST jobs
- Added integration tests to verify permissions
Fixes authorization bug where editors were incorrectly denied access.
* Provisioning: Deprecate single file/folder move and delete on configured branch
Reject individual file and folder move/delete operations on the configured
branch via the single files endpoints (HTTP 405 MethodNotAllowed). Users
must use the bulk operations API (jobs API) instead.
Motivation:
- Reconciliation for these operations is not reliable as it must be
recursive and cannot run synchronously since it could take a long time
- Simplifies authorization logic - fewer operations to secure and validate
- Reduces complexity and surface area for potential bugs
- Bulk operations via jobs API provide better control and observability
Operations on non-configured branches (e.g., creating PRs) continue to work
as before since they don't update the Grafana database.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix: remove trailing whitespace in test file
* Fix behaviour to match current behavior
* Revert changes for individual files
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Previous attempt to land this required this PR and a grafana-enterprise
PR to land at the ~same time.
This PR guards the use of `dsConfigHandlerRequestsDuration` with a nil
check, and doesn't change any existing APIs, so we can land it without
any timing issues with grafana-enterprise.
Once this has landed, we'll make a follow-up PR for grafana-enterprise.
* Fix race condition causing unhealthy repository message to be lost
This commit fixes a race condition in the provisioning repository controller
where the "Repository is unhealthy" message in the sync status could be lost
due to status updates being based on stale repository objects.
## Problem
The issue occurred in the `process` function when:
1. Repository object was fetched from cache with old status
2. `RefreshHealth` immediately patched the health status to "unhealthy"
3. `determineSyncStatusOps` used the stale object to check if unhealthy
message was already set
4. A second patch operation based on stale data would overwrite the
health status update
## Solution
Introduced `RefreshHealthWithPatchOps` method that returns patch operations
instead of immediately applying them. This allows batching all status updates
(health + sync) into a single atomic patch operation, eliminating the race
condition.
## Changes
- Added `HealthCheckerInterface` for better testability
- Added `RefreshHealthWithPatchOps` method to return patch ops without applying
- Updated `process` function to batch health and sync status updates
- Added comprehensive unit tests for the fix
Fixes the issue where unhealthy repositories don't show the "Repository is
unhealthy" message in their sync status.
* Fix staticcheck lint error: remove unnecessary nil check for slice
* `grafana-iam`: Fetch target parent folder
* WIP add different ParentProviders
* Add version
* Move code to a different file
* Instantiate resourceParentProvider
* same import name
* imports
* Add tests
* Remove unecessary test
* forgot wire
* WIP integration tests
* Add test to cover list
* Fix caching problem in integration tests
* comments
* Logger and comments
* Add lazy creation and caching
* Instantiate clients only once
* Rerun wire gen
* feat: legacy ListIterator with batches
* chore: address code review
* chore: remove nil check in nextBatch
* chore: move close before count check
* chore: add err field to batchingIterator for its own errors
* chore: remove unused import
* fix: use dsIndexProvider cache on migrations
* chore: use same comment as before
* feat: org-aware TTL cache for schemaversion migration and warmup for single tenant
* chore: use LRU cache
* chore: change DefaultCacheTTL to 1 minute
* chore: address copilot reviews
* chore: use expirable cache
* chore: remove unused import
* initial generation
* went through doc to add new resource
* added dummy kind so grafana will run
* added dummy handler and custom route
* fix app name
* gets custom route working - still a dummy route
* adds groupOverride to manifest
* adds quotas to grpc client and server
* WIP - trying to get api recognized - not working
* Gets route working
* fixes group and resource vars
* expects group and resource as separate params
* set content-type header on response
* removes Quotas kind and regens
* Update grafana-app-sdk to v0.48.5
* Update codegen
* updates manifest
* formatting
* updates grafana-app-sdk version to 0.48.5
* regen ResourceClient mocks
* adds tests
* remove commented code
* uncomment go mod tidy
* fix tests and make update workspace
* adds quotas app to codeowners
* formatting
* make gen-apps
* deletes temp file
* fix generated folder code
* make gofmt
* make gen-go
* make update-workspace
* add COPY apps/quotas to Dockerfile
* fix test mock
* fixes undefined NewFolderStatus()
* make gen-apps, and add func for NewFolderStatus
* make gen-apps again
* make update-workspace
* regen folder_object_gen.go
* gofmt
* fix linting
* apps/folder make update-workspace
* make gen-apps
* make gen-apps
* fixes enterprise_imports.go
* go get testcontainers
* adds feature toggle
* make update-workspace
* fix go mod
* fix another client mock
---------
Co-authored-by: Steve Simpson <steve@grafana.com>
* Reapply "K8s: read resource configs from API Enablement for API Builders" (#114475)
This reverts commit 4130bd9cd3.
* revert part that broke things
* FF service changes are gonna come later
* MTFF: allow viewers access to MTFF by enforcing runtime_config for custom routes
* unused var
* removed now
* pass the test, include defaults
* revert sample.ini change
* add legacy search (wip)
* fix search field name
* implement team search endpoint
* generate openapi spec
* generate endpoints for frontend
* minor fixes
* fix issues found while testing
* add more fields to search result
* add basic unit tests
* add more unit tests
* improve getColumns() func in legacy search
* configure search endpoint in team.cue
* add team search handler
* add the searchTeams endpoint to manifest.cue
* make gofmt
* update openapi spec
* generate frontend endpoints
* remove unused field
* move fields defiitions to separate builder
* fix legacy search
* fix unit tests
* fix unit test
* address feedback
* fix unit test
* update openapi specs
* yarn generate-apis
* add missing unit tests
Implements the /notification/query endpoint on the historian app. Note that it
does not apply any RBAC right now, that will be a follow up commit.
We have to use a go-kit logger in grafana/alerting, so an adapter is needed.
Going from go-kit to slog is a bit hairy but works well enough.
* OnGoing
comment
* WIP on the wrapper
* Get before Delete
* WIP: add an unimplemented storage authorizer
* WIP implementing the resource permission authorize
* Implement beforeCreate
* Create, Delete, Update
* List
* Use a resource permissions wrapper
* Switch the main authorizer to service
* Add namespace
* Use compile for list
* Comment
* Remove unecessary comments
* fix bug with folder permissions
* Implement tests for List
* Test get
* List test small refactor
* Delete test
* Reorganize code
* imports
* Start splitting the tests
* test AfterDelete
* actually test beforeWrite
* Implement tests for wrapper create
* Test delete
* Test List and Get
* Fix List
* Remaining tests
* simplify
* Remove comments
* Reorder
* Change authorizer to allow access
Matheus Macabu
Costa Alexoglou
Roberto Jiménez Sánchez
Gabriel MABILLE
Gonzalo Trigueros Manzanas
Charandas
beejeebus
Steve SimpsonandCharandas Batra
Misi
Ryan McKinley
Gábor Farkas
Rafael Bortolon Paulovic
Todd Treece
Will Browne
Stephanie Hingtgen
Mihai Doarna
owensmallwoodandSteve Simpson
Renato Costa
Austin Pond
Mustafa Sencer Özcan