* WIP: mutator added, start working on validator
* first validator iteration
* second validator iteration
* wip: working on integration tests
* re-working mutation and validation, using Connection interface
* fixing some rebase things
* fixing integration tests
* formatting
* fixing unit tests
* k8s codegen
* linting
* moving tests which are available only for enterprise
* addressing comments: using repo config for connections, updating tests
* addressing comments: adding some more info in the app and installation
* fixing app data
* addressing comments: updating connection implementation
* addressing comments
* formatting
* fixing tests
* feat(auth): add ExtraAudience option to RoundTripper
Add ExtraAudience option to RoundTripper to allow operators to include
additional audiences (e.g., provisioning group) when connecting to the
multitenant aggregator. This ensures tokens include both the target API
server's audience and the provisioning group audience, which is required
to pass the enforceManagerProperties check.
- Add ExtraAudience RoundTripperOption
- Improve documentation and comments
- Add comprehensive test coverage
* fix(operators): add ExtraAudience for dashboards/folders API servers
Operators connecting to dashboards and folders API servers need to include
the provisioning group audience in addition to the target API server's
audience to pass the enforceManagerProperties check.
* provisioning: fix settings/stats authorization for AccessPolicy identities
The settings and stats endpoints were returning 403 for users accessing via
ST->MT because the AccessPolicy identity was routed to the access checker,
which doesn't know about these resources.
This fix handles 'settings' and 'stats' resources before the access checker
path, routing them to the role-based authorization that allows:
- settings: Viewer role (read-only, needed by frontend)
- stats: Admin role (can leak information)
* fix: update BootstrapStep component to remove legacy storage handling and adjust resource counting logic
- Removed legacy storage flag from useResourceStats hook in BootstrapStep.
- Updated BootstrapStepResourceCounting to simplify rendering logic and removed target prop.
- Adjusted tests to reflect changes in resource counting and rendering behavior.
* Revert "fix: update BootstrapStep component to remove legacy storage handling and adjust resource counting logic"
This reverts commit 148802cbb5.
* provisioning: allow any authenticated user for settings/stats endpoints
These are read-only endpoints needed by the frontend:
- settings: returns available repository types and configuration for the wizard
- stats: returns resource counts
Authentication is verified before reaching authorization, so any user who
reaches these endpoints is already authenticated. Requiring specific org
roles failed for AccessPolicy tokens which don't carry traditional roles.
* provisioning: remove redundant admin role check from listFolderFiles
The admin role check in listFolderFiles was redundant (route-level auth already
handles access) and broken for AccessPolicy identities which don't have org roles.
File access is controlled by the AccessClient as documented in the route-level
authorization comment.
* provisioning: add isAdminOrAccessPolicy helper for auth checks
Consolidates authorization logic for provisioning endpoints:
- Adds isAdminOrAccessPolicy() helper that allows admin users OR AccessPolicy identities
- AccessPolicy identities (ST->MT flow) are trusted internal callers without org roles
- Regular users must have admin role (matching frontend navtree restriction)
Used in: authorizeSettings, authorizeStats, authorizeJobs, listFolderFiles
* provisioning: consolidate auth helpers into allowForAdminsOrAccessPolicy
Simplifies authorization by:
- Adding isAccessPolicy() helper for AccessPolicy identity check
- Adding allowForAdminsOrAccessPolicy() that returns Decision directly
- Consolidating stats/settings/jobs into single switch case
- Using consistent pattern in files.go
* provisioning: require admin for files subresource at route level
Aligns route-level authorization with handler-level check in listFolderFiles.
Both now require admin role OR AccessPolicy identity for consistency.
* provisioning: restructure authorization with role-based helpers
Reorganizes authorization code for clarity:
Role-based helpers (all support AccessPolicy for ST->MT flow):
- allowForAdminsOrAccessPolicy: admin role required
- allowForEditorsOrAccessPolicy: editor role required
- allowForViewersOrAccessPolicy: viewer role required
Repository subresources by role:
- Admin: repository CRUD, test, files
- Editor: jobs, resources, sync, history
- Viewer: refs, status (GET only)
Connection subresources by role:
- Admin: connection CRUD
- Viewer: status (GET only)
* provisioning: move refs to admin-only
refs subresource now requires admin role (or AccessPolicy).
Updated documentation comments to reflect current permissions.
* provisioning: add fine-grained permissions for connections
Adds connection permissions following the same pattern as repositories:
- provisioning.connections:create
- provisioning.connections:read
- provisioning.connections:write
- provisioning.connections:delete
Roles:
- fixed:provisioning.connections:reader (granted to Admin)
- fixed:provisioning.connections:writer (granted to Admin)
* provisioning: remove non-existent sync subresource from auth
The sync subresource doesn't exist - syncing is done via the jobs endpoint.
Removed dead code from authorization switch case.
* provisioning: use access checker for fine-grained permissions
Refactors authorization to use b.access.Check() with verb-based checks:
Repository subresources:
- CRUD: uses actual verb (get/create/update/delete)
- test: uses 'update' (write permission)
- files/refs/resources/history/status: uses 'get' (read permission)
- jobs: uses actual verb for jobs resource
Connection subresources:
- CRUD: uses actual verb
- status: uses 'get' (read permission)
The access checker maps verbs to actions defined in accesscontrol.go.
Falls back to admin role for backwards compatibility.
Also removes redundant admin check from listFolderFiles since
authorization is now properly handled at route level.
* provisioning: use verb constants instead of string literals
Uses apiutils.VerbGet, apiutils.VerbUpdate instead of "get", "update".
* provisioning: use access checker for jobs and historicjobs resources
Jobs resource: uses actual verb (create/read/write/delete)
HistoricJobs resource: read-only (historicjobs:read)
* provisioning: allow viewers to access settings endpoint
Settings is read-only and needed by multiple UI pages (not just admin pages).
Stats remains admin-only.
* provisioning: consolidate role-based resource authorization
Extract isRoleBasedResource() and authorizeRoleBasedResource() helpers
to avoid duplicating settings/stats resource checks in multiple places.
* provisioning: use resource name constants instead of hardcoded strings
Replace 'repositories', 'connections', 'jobs', 'historicjobs' with
their corresponding ResourceInfo.GetName() constants.
* provisioning: delegate file authorization to connector
Route level: allow any authenticated user for files subresource
Connector: check repositories:read only for directory listing
Individual file CRUD: handled by DualReadWriter based on actual resource
* provisioning: enhance authorization for files and jobs resources
Updated file authorization to fall back to admin role for listing files. Introduced checkAccessForJobs function to manage job permissions, allowing editors to create and manage jobs while maintaining admin-only access for historic jobs. Improved error messaging for permission denials.
* provisioning: refactor authorization with fine-grained permissions
Authorization changes:
- Use access checker with role-based fallback for backwards compatibility
- Repositories/Connections: admin role fallback
- Jobs: editor role fallback (editors can manage jobs)
- HistoricJobs: admin role fallback (read-only)
- Settings: viewer role (needed by multiple UI pages)
- Stats: admin role
Files subresource:
- Route level allows any authenticated user
- Directory listing checks repositories:read in connector
- Individual file CRUD delegated to DualReadWriter
Refactored checkAccessWithFallback to accept fallback role parameter.
* provisioning: refactor access checker integration for improved authorization
Updated the authorization logic to utilize the new access checker across various resources, including files and jobs. This change simplifies the permission checks by removing redundant identity retrieval and enhances error handling. The access checker now supports role-based fallbacks for admin and editor roles, ensuring backward compatibility while streamlining the authorization process for repository and connection subresources.
* provisioning: remove legacy access checker tests and refactor access checker implementation
Deleted the access_checker_test.go file to streamline the codebase and focus on the updated access checker implementation. Refactored the access checker to enhance clarity and maintainability, ensuring it supports role-based fallback behavior. Updated the access checker integration in the API builder to utilize the new fallback role configuration, improving authorization logic across resources.
* refactor: split AccessChecker into TokenAccessChecker and SessionAccessChecker
- Renamed NewMultiTenantAccessChecker -> NewTokenAccessChecker (uses AuthInfoFrom)
- Renamed NewSingleTenantAccessChecker -> NewSessionAccessChecker (uses GetRequester)
- Split into separate files with their own tests
- Added mockery-generated mock for AccessChecker interface
- Names now reflect identity source rather than deployment mode
* fix: correct error message case and use accessWithAdmin for filesConnector
- Fixed error message to use lowercase 'admin role is required'
- Fixed filesConnector to use accessWithAdmin for proper role fallback
- Formatted code
* refactor: reduce cyclomatic complexity in filesConnector.Connect
Split the Connect handler into smaller focused functions:
- handleRequest: main request processing
- createDualReadWriter: setup dependencies
- parseRequestOptions: extract request options
- handleDirectoryListing: GET directory requests
- handleMethodRequest: route to method handlers
- handleGet/handlePost/handlePut/handleDelete: method-specific logic
- handleMove: move operation logic
* security: remove blind TypeAccessPolicy bypass from access checkers
Removed the code that bypassed authorization for TypeAccessPolicy identities.
All identities now go through proper permission verification via the inner
access checker, which will validate permissions from ServiceIdentityClaims.
This addresses the security concern where TypeAccessPolicy was being trusted
blindly without verifying whether the identity came from the wire or in-process.
* feat: allow editors to access repository refs subresource
Change refs authorization from admin to editor fallback so editors can
view repository branches when pushing changes to dashboards/folders.
- Split refs from other read-only subresources (resources, history, status)
- refs now uses accessWithEditor instead of accessWithAdmin
- Updated documentation comment to reflect authorization levels
- Added integration test TestIntegrationProvisioning_RefsPermissions
verifying editor access and viewer denial
* tests: add authorization tests for missing provisioning API endpoints
Add comprehensive authorization tests for:
- Repository subresources (test, resources, history, status)
- Connection status subresource
- HistoricJobs resource
- Settings and Stats resources
All authorization paths are now covered by integration tests.
* test: fix RefsPermissions test to use GitHub repository
Use github-readonly.json.tmpl template instead of local folder,
since refs endpoint requires a versioned repository that supports
git operations.
* chore: format test files
* fix: make settings/stats authorization work in MT mode
Update authorizeRoleBasedResource to check authlib.AuthInfoFrom(ctx)
for AccessPolicy identity type in addition to identity.GetRequester(ctx).
This ensures AccessPolicy identities are recognized in MT mode where
identity.GetRequester may not set the identity type correctly.
* fix: remove unused authorization helper functions
Remove allowForAdminsOrAccessPolicy and allowForViewersOrAccessPolicy
as they are no longer used after refactoring to use authorizeRoleBasedResource.
* Fix AccessPolicy identity detection in ST authorizer
- Add check for AccessPolicy identities via GetAuthID() in authorizeRoleBasedResource
- Extended JWT may set identity type to TypeUser but AuthID is 'access-policy:...'
- Forward user ID token in X-Grafana-Id header in RoundTripper for aggregator forwarding
* Revert "Fix AccessPolicy identity detection in ST authorizer"
This reverts commit 0f4885e503.
* Add fine-grained permissions for settings and stats endpoints
- Add provisioning.settings:read action (granted to Viewer role)
- Add provisioning.stats:read action (granted to Admin role)
- Add accessWithViewer to APIBuilder for Viewer role fallback
- Use access checker for settings/stats authorization
- Remove role-based authorization functions (isRoleBasedResource, authorizeRoleBasedResource)
This makes settings and stats consistent with other provisioning resources
and works properly in both ST and MT modes via the access checker.
* Remove AUTHORIZATION_COVERAGE.md
* Add provisioning resources to RBAC mapper
- Add connections, settings, stats to provisioning.grafana.app mappings
- Required for authz service to translate K8s verbs to legacy actions
- Fixes 403 errors for settings/stats in MT mode
* refactor: merge access checkers with original fallthrough behavior
Merge tokenAccessChecker and sessionAccessChecker into a unified
access checker that implements the original fallthrough behavior:
1. First try to get identity from access token (authlib.AuthInfoFrom)
2. If token exists AND (is TypeAccessPolicy OR useExclusivelyAccessCheckerForAuthz),
use the access checker with token identity
3. If no token or conditions not met, fall back to session identity
(identity.GetRequester) with optional role-based fallback
This fixes the issue where settings/stats/connections endpoints were
failing in MT mode because the tokenAccessChecker was returning an error
when there was no auth info in context, instead of falling through to
session-based authorization.
The unified checker now properly handles:
- MT mode: tries token first, falls back to session if no token
- ST mode: only uses token for AccessPolicy identities, otherwise session
- Role fallback: applies when configured and access checker denies
* Revert "refactor: merge access checkers with original fallthrough behavior"
This reverts commit 96451f948b.
* Grant settings view role to all
* fix: use actual request verb for settings/stats authorization
Use a.GetVerb() instead of hardcoded VerbGet for settings and stats
authorization. When listing resources (hitting collection endpoint),
the verb is 'list' not 'get', and this mismatch could cause issues
with the RBAC service.
* debug: add logging to access checkers for authorization debugging
Add klog debug logs (V4 level) to token and session access checkers
to help diagnose why settings/stats authorization is failing while
connections works.
* debug: improve access checker logging with grafana-app-sdk logger
- Use grafana-app-sdk logging.FromContext instead of klog
- Add error wrapping with resource.group format for better context
- Log more details including folder, group, and allowed status
- Log error.Error() for better error message visibility
* chore: use generic log messages in access checkers
* Revert "Grant settings view role to all"
This reverts commit 3f5758cf36.
* fix: use request verb for historicjobs authorization
The original role-based check allowed any verb for admins. To preserve
this behavior with the access checker, we should pass the actual verb
from the request instead of hardcoding VerbGet.
---------
Co-authored-by: Charandas Batra <charandas.batra@grafana.com>
* Default to folder sync only and block new instance sync repositories
- Change default allowed_targets to folder-only in backend configuration
- Modify validation to only enforce allowedTargets on CREATE operations
- Add deprecation warning for existing instance sync repositories
- Update frontend defaults and tests to reflect new behavior
Fixes#619
* Update warning message: change 'deprecated' to 'not fully supported'
* Fix health check: don't validate allowedTargets for existing repositories
Health checks for existing repositories should treat them as UPDATE operations,
not CREATE operations, so they don't fail validation for instance sync target.
* Fix tests and update i18n translations
- Update BootstrapStep tests to reflect folder-only default behavior
- Run i18n-extract to update translation file structure
* Fix integration tests
* Fix tests
* Fix provisioning test wizard
* Fix fronted test
fix: allow editors to POST jobs in provisioning API
Editors should be able to post jobs in the 'jobs' endpoint for syncing
repositories. This aligns with the requirement that syncing a repository
requires editor privileges.
- Separated 'jobs' subresource authorization from repository/test
- Allow both admins and editors to POST jobs
- Added integration tests to verify permissions
Fixes authorization bug where editors were incorrectly denied access.
* Provisioning: Deprecate single file/folder move and delete on configured branch
Reject individual file and folder move/delete operations on the configured
branch via the single files endpoints (HTTP 405 MethodNotAllowed). Users
must use the bulk operations API (jobs API) instead.
Motivation:
- Reconciliation for these operations is not reliable as it must be
recursive and cannot run synchronously since it could take a long time
- Simplifies authorization logic - fewer operations to secure and validate
- Reduces complexity and surface area for potential bugs
- Bulk operations via jobs API provide better control and observability
Operations on non-configured branches (e.g., creating PRs) continue to work
as before since they don't update the Grafana database.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix: remove trailing whitespace in test file
* Fix behaviour to match current behavior
* Revert changes for individual files
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
* Configurable repository types in monolith and operator
* Default to Github in operators
* Regenerate wire
* Fix and implement unit tests
* Same types for enterprise tests
* Remove unnecessary conversion
* Remove the issue with import cycles
* Provisioning: Use merge patch instead of json path to release orphan resources
* rolling back to json Patch
* adding TODO for testing
* adding integration test
* using struct
* addressing comments on tests
* Add log after jobs
* Use the same helper to create repository in export job
* Improve the logging
* Fix eventually conditions in helpers
* Fix export job tests
* Format code
* Fix linting
* Fix the format
* Fix linting issue
* Fix innefectual assignment
* Chore: Apply proper database settings to integration tests
* add logging
* join host and port in database config to override default ports
* apply test fixes from the original pr
* host might contain port already
* increase timeout
* increase timeout even more
* even larger timeouts
* Use eventually for stats
* Use eventually also for listing settings as index takes some time
---------
Co-authored-by: Roberto Jimenez Sanchez <roberto.jimenez@grafana.com>
* More clean up around waiting for jobs
* Add comment to trigger enterprise integration tests
* Trigger integration tests
* Collect error
* Move tests in wrong spot
* Clean up test
* Remove Eventually
* Remove duplicate not nil check
* Delete comment in infra tests
* Helper to create repository
* Use helper for move
