Commit Graph
32 Commits
Author SHA1 Message Date
Alexander Zobnin 0aae7e01bc Zanzana: Add remote client metrics (#116012)
* Zanzana: Add remote client metrics

* fix linter
2026-01-08 15:24:54 +01:00
Alexander Zobnin 030c7099cb Zanzana: Fix shadow client context (#114853)
* Zanzana: Fix shadow client context

* don't cancel on parent context cancel

* share timeout
2025-12-04 17:09:04 +01:00
Alexander Zobnin 5c49dbf4c4 Zanzana: Non-blocking shadow compile (#114774) 2025-12-04 11:28:09 +01:00
Alexander Zobnin 4bca10195e Zanzana: Fix shadow client metric (#113771) 2025-11-12 16:48:48 +00:00
Mihai Turdean 7df3582237 Authz: Implement Query operation for Zanzana with folder parent retrieval (#113483) 2025-11-06 09:06:42 -07:00
Alexander Zobnin 7a7fd45bdd Zanzana: app platform style write APIs (#112812)
* refactor zanzana client instantiation

* refactor client imports

* POC write API (Mutate)

* fix linter

* delete exisitng folder parents

* refactor common functions

* minor refactor

* groupd operations by type

* atomic folder operations

* use deleteExisting for deletes

* Add tests for folders

* more tests

* resource permissions tests

* add more tests

* fix mock zanzana client

* fix linter

* fix linter

* re-use types from apps

* add some comments to the protobuf
2025-10-28 11:22:13 +01:00
Ryan McKinley 2f2289f226 Chore: Update authlib (foder as top level argument) (#111800) 2025-10-01 14:40:28 +00:00
Alexander Zobnin 72d212c5f9 Authlib: Update authz client to use zookies (#111291)
* Authlib: Update authz client to use zookies

* fix zookie return

* fix linter
2025-09-18 16:24:22 +02:00
Alexander Zobnin aa92dc860b Zanzana: Improve server side error handling (#106378)
* Zanzana: Split client and server logs

* Zanzana: Improve error handling and logging

* log internal error at the server side

* refactor

* improve errors for list request

* update go modules

* handle errors for read and write

* refactor

* reset go.mod changes
2025-06-05 22:11:26 +02:00
Alexander Zobnin 1584349b99 Zanzana: Use authz client (#104037)
* Zanzana: use client from authzlib

* update go.sum

* use user UID for debugging

* Remove unused function
2025-04-24 10:57:24 +02:00
Alexander Zobnin 4bc9203cf6 Zanzana: Perform shadow requests (#103444)
* Zanzana: Execute checks in the background

* add metrics

* collect metrics

* cleanup

* shadow compile checker

* add time metrics for compiler

* run compile in parallel

* prevent deadlock
2025-04-08 10:03:35 +02:00
Karl Persson fa74d1c36d Authn: Sync authlib and update how we construct authn client interceptor (#101124)
* Sync authlib and update how we construct authn client interceptor

* Remove namespace from checker
2025-02-26 09:22:09 +01:00
Ryan McKinley 680e6bc1f8 Authlib: Use types package rather than claims (#99243) 2025-01-21 12:06:55 +03:00
Karl Persson 2187a66f2b Zanzana: Split up settings into client and server sections (#99066)
* Split up zanzana settings into client and server sections

* Update workspace
2025-01-16 13:39:39 +01:00
Gabriel MABILLE efb7cc0343 Chore: Authlib upgrade (#98319)
* Chore: Authlib upgrade

* Upgrade authlib

* Uncommit file
2024-12-20 15:48:35 +01:00
Alexander Zobnin 170e0e1813 Zanzana: List then search implementation (#96705)
* Zanzana: Search with list

* Allow to pass werb into list request

* split list search into 2 functions

* fix listing resources

* remove unused

* refactor

* remove unused function

* Add more logging to reconciler

* Fix search for users with access to all resources

* fix findFoldersZanzanaList

* search for folders as well by default

* refactor

* use compile for list and search

* remove list from client

* remove only from client

* remove list from interface

* run compile once

* refactor

* refactor

* add search tests

* fix tests

* Fix linter
2024-11-25 14:58:34 +01:00
Alexander ZobninandKarl Persson 1366197522 Zanzana: Search with check server side (#96268)
* pass zclient into dashboard service

* Search then check implementation

* Use GetNamespace() for user

* remove unused orgID

* simple batch check

* refactor

* add tests

* fix batchCheckItem

* client implements batch check

* use batch check in search

* remove unused

* remove All field from response

* refactor: extract checkNamespace

* fix search result uniqueness

* comment fix

* Apply suggestions from code review

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* refactor

* cleanup

* remove unnecessary check

* fix tests

* fix protobuf def

* Fix query page

* fix type

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-11-18 14:01:28 +01:00
Karl Persson ae95a6158f Zanana: Remove opefga from client and implement compile (#96275)
Zanana: Remove opefga from client and implement Compile
2024-11-12 15:30:34 +01:00
Gabriel MABILLE cc9cdbe82d Authz: Move extension proto up a layer (#96254)
* Authz: Move extension proto up a layer

* Lint
2024-11-12 10:19:12 +01:00
Alexander Zobnin 910ec7e7dc Zanzana: Use separate store for each org (#96015)
* Move server init into server package

* map store name to id

* refactor model loading

* pass namespace into reconcilers and collectors

* refactor

* Extend authz server with Read and Write methods

* use new read/write in reconciler

* implement server side read and write

* Sync permissions for every org

* handle namespace in check and list

* split read and write

* provide conditions

* Fix client implementation

* fix nil conditions

* remove unused client code

* use lock for store access

* move type translators to common package

* fix folder collector

* fix store creation

* remove unused AuthorizationModelId

* fix server tests

* fix linter
2024-11-08 14:54:36 +01:00
Karl Persson f0a5b444e3 Zanzana: generic resource only (#96019)
* Remove collectors

* Remove zanzana search check, we need to rewrite that part to the new schema

* Only use generic resource schema and cleanup code we don't want to keep / need to re-write
2024-11-08 09:30:41 +01:00
Karl Persson e0163c93c2 Zanzana: reconcile generic schema (#95492)
* Rename to CheckObject

* Implement authz.AccessClient

* Move folder tree to reconciler and use new schema

* Move shared functionality to common package

* Add reconciler for managed permissions and resource translations

* Add support for folder resources
2024-10-28 16:32:16 +01:00
Karl Persson beaac3c885 Zanzana: Remove model and store initiation from client (#95328)
* Remove model and store initiation from client
2024-10-25 09:31:27 +02:00
Karl Persson b4366ebed2 Zanzana: bootstrap authz server (#95036)
Bootstrap authz extended server
2024-10-21 14:58:57 +02:00
Karl PerssonandAlexander Zobnin 4083b2208e Zanzana: periodic sync of team members (#94752)
* Rewrite zanzana collector to fetch all available pages

* Register access control as a background service

* If zanzana is enabled we run Syncs and start Reconciliation job

* Update pkg/services/authz/zanzana/client/client.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Use server lock when doing performing reconciliation
2024-10-17 15:28:33 +02:00
Alexander Zobnin fcfa4aa777 Zanzana: Add config options for Check and ListObjects queries (#94619)
* Zanzana: Add config options for Check and ListObjects queries

* remove fixme

* pass only zanzana settings
2024-10-14 14:44:47 +03:00
Alexander ZobninandGabriel MABILLE 5d724c2482 Zanzana: Initial dashboard search (#93093)
* Zanzana: Search in a background and compare results

* refactor

* Search with check

* instrument zanzana client

* add single_read option

* refactor

* refactor move check into separate function

* Fix tests

* refactor

* refactor getFindDashboardsFn

* add resource type to span attributes

* run ListObjects concurrently

* Use list and search in less cases

* adjust metrics buckets

* refactor: move Check and ListObjects to AccessControl implementation

* Revert "Fix tests"

This reverts commit b0c2f072a2.

* refactor: use own types for Check and ListObjects inside accesscontrol package

* Fix search scenario with low limit and empty query string

* more accurate search with checks

* revert

* fix linter

* Revert "revert"

This reverts commit ee5f14eea8.

* add search errors metric

* fix query performance under some conditions

* simplify check strategy

* fix pagination

* refactor findDashboardsZanzanaList

* Iterate over multiple pages while making check request

* refactor listUserResources

* avoid unnecessary db call

* remove unused zclient

* Add notes for SkipAccessControlFilter

* use more accurate check loop

* always use check for search with provided UIDs

* rename single_read to zanzana_only_evaluation

* refactor

* update go workspace

* fix linter

* don't use deprecated fields

* refactor

* fail if no org specified

* refactor

* initial integration tests

* Fix tests

* fix linter errors

* fix linter

* Fix tests

* review suggestions

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix limit

* refactor

* refactor tests

* fix db config in tests

* fix migrator (postgres)

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2024-10-04 12:27:10 +02:00
Dave HendersonandRyan McKinley df3d8915ba Chore: Bump Go to 1.23.0 (#92105)
* chore: Bump Go to 1.23.0

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* update swagger files

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* chore: update .bingo/README.md formatting to satisfy prettier

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* chore(lint): Fix new lint errors found by golangci-lint 1.60.1 and Go 1.23

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* keep golden file

* update openapi

* add name to expected output

* chore(lint): rearrange imports to a sensible order

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2024-08-21 11:40:42 -04:00
Alexander Zobnin 87c4f2448c Zanzana: Use modular schema (#92001)
* Zanzana: Use modular schema

* Fix tests

* Add module transform tests
2024-08-19 11:10:51 +02:00
Karl Persson c04be62b65 Zanzana: client integration test (#89997)
* Restructure

* Zanzana: Add integration tests for client

* skip mysql 5.7 integration tests
2024-07-04 11:23:48 +02:00
Karl Persson e568b86ac0 Zanzana: Initial work to allow partial data migrations (#89919)
* Zanana: Add Write method to interface

* Zanzana: Add utilities for translating RBAC to openFGA tuple keys

* RBAC: Add zanzana synchronizer

* Run zanzana sync in access controll provider
2024-07-02 14:45:25 +02:00
Alexander ZobninandKarl Persson 190892bc88 Zanzana: Initial schema loading (#89492)
* Zanzana: Dummy schema loading

* Load authorzation model for client

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-06-27 13:57:06 +02:00