* WIP: List
* make toV0ResourcePermissions work with an ordered list of assignments to ensure consistency in the results
* Test templates
* Split list query in two. I clearly need scopePatterns
* Add pagination with offsets
* Remove unecessary comment
* implement listiterator
* add listiterator tests
* return the correct resource version
* use SkipIntegrationTestInShortMode
* No need for the extra check on pagination being correctly set
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* Spec is out of date
* Remove wrong comment
* Add a test for the pagination token
---------
Co-authored-by: mohammad-hamid <mohammad.hamid@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* Replace remaining calls to testing.Short where possible.
* Update style guide.
* Revert change in TestAlertmanager_ExtraDedupStage, as it doesn't work.
* Make TestAlertRulePostExport into integration test.
* Extract from #108753
Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>
* Tackle create
Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>
* WIP use identity store to resolve role names
* WIP
* create role
* Remove unecessary comments
* comments
* sql templates
* test role insert tplt
* Add tests 😅
* Test permission insert template
* Test permission delete template
* Test assignment_insert template
* Manually test insertion
* Remove delete permissions. This is a create case we don't have permissions for that resource
* generate name handled by the apiserver library
* Remove comment and conversion
* Small renaming nits
* changes from main
* Add storage backend tests
* Add test to sql
* Test role contains a unique permission
* linting
* Account for pr feedback
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* Reuse mappers
* Move function to models
* Add check between name and spec resource
* Check if the resource does not already exist
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* fix query
* Check basic roles
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* Account for error
* Make struct names consistent
* Nit. I prefer createAndAssignManagedRole
* Remove notifyign
* log errors instead of returning them
* Fix exist query join
* Test errors
* Remove dup
---------
Co-authored-by: mohammad-hamid <mohammad.hamid@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* resource permissions get
* address review feedback
* address comments
- read using rp name
- narrow by scope and actionsets
- update sql tests
* align with verb simplification
* keep original format to avoid conflicts
* add sqltests
* cleanup
* Remove unecessary errors
* Move query template to queries
* Use splitN to make sure we have three parts
* Revert user permission management for now. We don't need it
* Revert error change
* group permissions by resource
* extract parse scope
* Move sql_test
* Move & test parseScope
* Add tests to getResourcePermission
* Linting
* Use namespace
* Add test to the backend
* Ongoing tests
* Remove pagination, fix query boolean, insert basic role binding
* Linting
* Straightened the created and updated times
* error handling and uniformization with other backend
* Restore comments to avoid later conflicts
* Integration testing
* switch to function, no need to make it a method
* isServiceAccount should default to FALSE instead of TRUE :surprised:
* PR feedback
* Sort spec permissions
* Shouldn't happen but double proofing
---------
Co-authored-by: Gabriel Mabille <gabriel.mabille@grafana.com>
* Extract from #108753
Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>
* Tackle create
Co-Authored-By: mohammad-hamid <mohammad.hamid@grafana.com>
* WIP use identity store to resolve role names
* Commit empty service for now
* Clean
* For now only show name and created at
---------
Co-authored-by: mohammad-hamid <mohammad.hamid@grafana.com>
* WIP added ListSinceModified to StorageBackend interface
* fix compile time check
* Fix method name
* Fix naming
* fix the rest of the ListSinceModified names
* Uses resource key without name field
* get latest rv from resource_version. Update test.
* adds moar tests
* adds method stub for ListModifiedSince to other StorageBackend implementations
* adds dummy impl to noop storage backend for ListModifiedSince
* skip tests for badger kv backend for now
* fixes tests and adds badgerkv impl for ListModifiedSince
* add badger kv impl
* adds test for new query
* adds test data for new query
* adds ListModifiedSince stub to mockStorageBackend
* uncomment tests
* refactors ListModifiedSince to return an iter.seq2 and handles deduplication. Updates tests. Updates query result sorting.
* remove comments
* remove folder from query (dont need it, yet?)
* regen test queries
* updates test
* updates function comment
* use resourcepb.ResourceKey instead of ModifiedResourceKey
* wrap seq in single transaction. Rollback transaction after 30s if iterator never used. Only track last seen event. Formatting.
* skip TestListModifiedSince for kv backend
* use WatchEvent_Type for action type
* remove redundant fields from order by clause and regen test data for query
* remove redundant fields from order by clause and regen test data for query
* Add Create for User + DualWriter setup
* Add delete User
* Fix delete + access check
* Add tests for delete user
* Add tests for create user
* Fixes
* Use sqlx session to fix database locked issues
* wip authz checks
* legacyAccessClient
* Update legacyAccessClient, add tests for create user
* Close rows before running other queries
* Use ExecWithReturningId
* Verify deletion in the tests
* Add Validate and Mutate
* Other changes
* Address feedback
* Update tests
---------
Co-authored-by: Gabriel Mabille <gabriel.mabille@grafana.com>
* wip
* Use serviceaccount model from /apps/iam
* revert version update
* Add tembinding, userteam, other improvements
* Change serviceaccounttoken spec
* Revert the change of ServiceAccountToken
* Revert the change of UserTeam
* Clean up
* Remove files that are not needed for now
* Lint
* Update sql query's integration tests
* Fix tests
* update openapi spec
* Move LastSeenAt to the annotations
* Updte openapi_snapshots
* Change lastSeenAt annotation name
* IAM: Register CoreRole apis
* one line store instantiation
* Small refactor for readability
* Add authorizer for CoreRole
* Nit
* Error strings should not end with punctiation
* Account for error
* Switch to use the local resource client
* error should not start with upper casing
* noopStorageErr should have a name starting with err
* Update workspace
* I don't know why I don't have the same output as the CI 🤷
* Dependency xOwnership
* imports
* Import order
* Rename alias to make it clear this is legacy
* SQLTemplates: Add helper to ensure all templates have a test-case associated
* UnifiedStorage: Add missing sql template test case
* LegacyDashboards: Add sql templates fs to test cases for exhaustiveness check
* RBACStore: Add sql templates fs to test cases for exhaustiveness check
* LegacyIAM: Add missing sql template test cases
* update generated iam client
* update API
* with meta api
* regenerate client
* with identify ref
---------
Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
* Zanzana: Remove usage from legacy access control
* remove unused
* remove zanzana client from services where it's not used
* remove unused metrics
* fix linter
* Extract a helper funtion to perform list with authorization checks
* Add k8s verb to utils package
* Construct default mapping when no custom mapping is passed
* Configure authorization checks for service accounts
* Fix helper and add filtering to service accounts
* Unexport store and create new constructor function
* Add ResourceAuthorizer and LegacyAccessClient
* Configure checks for user store
* List with checks if AccessClient is configured
* Allow system user service account to read all users
---------
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Gabriel MABILLE
Peter Štibraný
MisiandRyan McKinley
owensmallwood
Victor Cinaglia
Stephanie Hingtgen
Matheus Macabu
Jo
Mariell Hoversholm
Karl Persson
Ashley HarrisonandRyan McKinley
Alexander Zobnin
Karl Persson
Adela AlmasanandLeon Sorokin
Charandas