Alerting: Protect sensitive fields of contact points from unauthorized modification
- Introduce a new permission alert.notifications.receivers.protected:write. The permission is granted to contact point administrators.
- Introduce field Protected to NotifierOption
- Introduce DiffReport for models.Integrations with focus on Settings. The diff report is extended with methods that return all keys that are different between two settings.
- Add new annotation 'grafana.com/access/CanModifyProtected' to Receiver model
- Update receiver service to enforce the permission and return status 403 if unauthorized user modifies protected field
- Update receiver testing API to enforce permission and return status 403 if unauthorized user modifies protected field.
- Update UI to disable protected fields if user cannot modify them
Co-authored-by: Sonia Aguilar <soniaaguilarpeiron@gmail.com>
* Provisioning: allow access check to proceed even when non access policy
* Provisioning: access checker needs this for MT
* add permissions registration
* remove scopes
* use in MT for now
* no need to document an internal flag here
* revert vscode change
* refactor the authZ permission evaluation and mapper code to allow evaluating unscoped actions beyond creation
* update wire
* gofmt
* add boolean to struct
---------
Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>
* Secrets: Refactor data_key_id out of the encoded secure value payload (#111852)
* everything compiles
* tests pass
* remove file included by accident
* add entry to gitignore
* some scaffolding for the migration executor
* remove file
* implement and test the migration
* use xkube.Namespace in our interfaces
* add todo
* update wire deps
* add some logs
* fix wire dependency ordering
* create tests to validate error conditions during migrations
* only run the migration as an MT api server
* formatting issues
* change detection of secrets running as MT server
* add todo
* use more specific initializer flags
* make secrets playwright tests work
* set new properties to true by default
* remove developer mode flag
* fix unit tests
Return the SQL schema for all DS queries in request (to provide information to AI / Autocomplete for SQL expressions).
All DS queries are treated as if they were inputs to SQL expressions in terms of conversion, regardless if they are selected in a query or not.
Requires feature toggle queryService = true
Endpoint is apis/query.grafana.app/v0alpha1/namespaces/default/sqlschemas
---------
Co-authored-by: Todd Treece <360020+toddtreece@users.noreply.github.com>
* Integrate mt querier with query caching
* typo
* let the caller set cache status response header
* fix TestQueryAPI
* make gen-go
* handle CachingServiceClient being nil and make gen-go
* include namespace in cache key
* set signed in user namespace in query_test.go
* fix test
* remove commented out code
* undo services/query/query.go changes
* make gen-go
* remove namespace requirement
* fix tests
* fix test
* remove namespace from SignedInUser in tests
* make gen-go
* Add delete and update hooks for roles/core roles
no need to capture non reference types
small cleanup on vars
* fix ticket priming in hooks
* fix ticket priming in hooks
* Revert "fix ticket priming in hooks"
This reverts commit f8e953ca09.
* use old testing blocks
* protect runtime obj in go func
* update test for correctness
* separate files for test correctness. fix leaking goroutines in go tests
* go workspace fixes
* attribute owner
* clean up go mod
* [API Server] Add Example App for reference use.
* Remove Printlns.
* Upgrade app-sdk to v0.46.0, update apps to handle breaking changes.
* Only start the reconciler for the example app if the v1alpha1 API version is enabled.
* Some comment doc updates.
* Run make update-workspace
* Set codeowner for /apps/example
* Run make gofmt and make update-workspace
* Run prettier on apps/example/README.md
* Add COPY apps/example to Dockerfile
* Add an authorizer to the example app.
* Fix import ordering.
* Update apps/example/kinds/manifest.cue
Co-authored-by: Owen Diehl <ow.diehl@gmail.com>
* Run make update-workspace
* Re-run make gen-go for enterprise import updates
* Run make update-workspace
---------
Co-authored-by: Owen Diehl <ow.diehl@gmail.com>
* wip
* wip
* wip
(cherry picked from commit 8cedf25892)
* Search seems to be working, the validation is still wip
* Use keyword.Name analyzer for Filterable fields
* Only string fields should be indexed with keyword analyzer
* Change search query for email and login fields to use term query
* Remove unnecessary Exact from the resource protobuf definitions
Co-Authored-By: Ryan McKinley <ryantxu@gmail.com>
* Add legacy search support to the API
* Tests for legacy search, validate and integration tests for user
* Lint
* Add snapshot tests to userDocumentBuilder
* Address CodeQL issues
* Improvements, handle Mode2, tests should pass
* Change default limit from 0 to 1 for requests
* Cleanup
* Add fixme
* Update pkg/registry/apis/iam/register.go
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
* Update pkg/registry/apis/iam/user/legacy_search.go
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
---------
Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
* implement the update method for team bindings
* fix lint error
* add integration tests
* add integration test for non existing team binding
* try to fix lint error
As part of migrating Grafana's authorization system to Zanzana (OpenFGA), we need to ensure that role permissions defined in the IAM API are automatically synced to the authorization backend. Without this sync, roles created through the API would not be enforced by Zanzana, creating an inconsistency between defined permissions and actual authorization decisions.
This is a critical piece of the dual-write pattern during the migration to Zanzana, ensuring that:
Role permissions are immediately available for authorization checks
The legacy RBAC system and new Zanzana system remain in sync
Users experience consistent permission enforcement regardless of which backend is queried
safe to revert
* Skip informers if Provisioning disable controllers is enabled
* Hydrate requester correctly for Grafana Live
* revert to old code because eventualRestConfig provider issues
---------
Co-authored-by: Charandas Batra <charandas.batra@grafana.com>
This is because MySQL doesn't support storing of NaN valuels, and therefore go-mysql-server isn't going to either.
Float fields/columns are always mapped to be nullable now, otherwise we would have to replace NaN/Inf with 0.
Yuri TseretyanandSonia Aguilar
CharandasandIevaVasiljeva
Stephanie Hingtgen
Owen Diehl
Jo
Tania
Misi
Ryan McKinley
Michael Mandrus
Kyle BrandtandTodd Treece
Costa Alexoglou
Bruno
Austin PondandOwen Diehl
Mihai Turdean
Denis VodopianovandDave Henderson
Mihai Doarna
Gilles De Mey
Gábor Farkas
Andres Martinez Gotor
Roberto Jiménez SánchezandCharandas Batra
Matheus Macabu
Jean-Philippe Quéméner
Liza Detrick
Torkel Ödegaard