57fcfd578d
Chore: replace macaron with web package ( #40136 )
...
* replace macaron with web package
* add web.go
2021-10-11 14:30:59 +02:00
2759b16ef5
Chore: Add context for dashboards ( #39844 )
...
* Add context for dashboards
* Remove GetDashboardCtx
* Remove ctx.TODO
2021-10-05 13:26:24 +02:00
012d4f0905
Alerting: Remove ngalert feature toggle and introduce two new settings for enabling Grafana 8 alerts and disabling them for specific organisations ( #38746 )
...
* Remove `ngalert` feature toggle
* Update frontend
Remove all references of ngalert feature toggle
* Update docs
* Disable unified alerting for specific orgs
* Add backend tests
* Apply suggestions from code review
Co-authored-by: achatterjee-grafana <70489351+achatterjee-grafana@users.noreply.github.com >
* Disabled unified alerting by default
* Ensure backward compatibility with old ngalert feature toggle
* Apply suggestions from code review
Co-authored-by: gotjosh <josue@grafana.com >
2021-09-29 16:16:40 +02:00
64c8d32fe7
Use sdk pkg for gtime ( #39354 )
2021-09-21 13:08:52 +02:00
1e4a660ea7
Chore: Propagate context for quotas ( #39205 )
...
Propagate context for quotas and queries/commands.
Ref #36734
2021-09-20 17:05:30 +02:00
4be9ec8f72
AccessControl: Protect org users lookup ( #38981 )
...
* Move legacy accesscontrol to middleware layer
* Remove bus usage for this endpoint
* Add tests for legacy accesscontrol
* Fix tests for org user and remove one more bus usage
* Added test for FolderAdmin as suggested in the review
2021-09-17 09:19:36 +02:00
e1e385b318
Chore: Remove untyped data map from macaron context ( #39077 )
2021-09-13 15:41:03 +02:00
4c921cf120
remove default return handler from macaron ( #38887 )
2021-09-09 15:41:34 +02:00
51aeb717a4
inject modified request into context ( #38807 )
2021-09-07 09:23:16 +02:00
c3ab2fdeb7
Macaron: remove custom Request type ( #37874 )
...
* remove macaron.Request, use http.Request instead
* remove com dependency from bindings module
* fix another c.Req.Request
2021-09-01 11:18:30 +02:00
78596a6756
Migrate to Wire for dependency injection ( #32289 )
...
Fixes #30144
Co-authored-by: dsotirakis <sotirakis.dim@gmail.com >
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com >
Co-authored-by: Ida Furjesova <ida.furjesova@grafana.com >
Co-authored-by: Jack Westbrook <jack.westbrook@gmail.com >
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com >
Co-authored-by: Leon Sorokin <leeoniya@gmail.com >
Co-authored-by: Andrej Ocenas <mr.ocenas@gmail.com >
Co-authored-by: spinillos <selenepinillos@gmail.com >
Co-authored-by: Karl Persson <kalle.persson@grafana.com >
Co-authored-by: Leonard Gram <leo@xlson.com >
2021-08-25 15:11:22 +02:00
e2227c38a3
Remove debug log from gzipper ( #37790 )
2021-08-11 14:04:08 +02:00
707d3536f0
Macaron: Strip down renderer middleware ( #37627 )
...
* strip down macaron renderer
* inline renderHTML
* remove IndentJSON parameter
* replace renderer with a html/template set
* fix failing test
* fix renderer paths in tests
* make template reloading even simpler
* unify ignored gzip path lookup
* fix csp middleware usage
2021-08-10 13:29:46 +02:00
0dfac9c3aa
Macaron: convert CSP middleware ( #37672 )
2021-08-10 09:03:22 +02:00
ad1f792b8b
Auth: Pass user role to Grafana using auth proxy ( #36729 )
...
* Pass role to Grafana using auth proxy
By default, the role will be applied to the default org of the user.
If the request uses the standard header "X-Grafana-Org-Id", the role will be applied to the specified org
Tested in both unit test and manually E2E
* Address comment: only allow the user role to be applied to the default org
Co-authored-by: Leonard Gram <leo@xlson.com >
2021-07-22 15:49:58 +02:00
7f882eea05
Login: Require user to not be signed in to get request password email ( #35421 )
2021-06-14 18:02:05 +02:00
1c49986b2f
Chore: Remove endpoints that contain the slug field ( #35104 )
...
* Chore: Remove endpoints that contain the slug field
* More cleanups
* Lint fixes
* Remove unnecessary funcs
* Cleanup frontend code
* Remove deprecated endpoints from docs
* Revert change according to reviewer's comments
2021-06-03 16:20:13 +03:00
8143991b94
Security: Update default CSP template and fix firefox CSP issues ( #34836 )
...
* Security: Update default content_security_policy_template
- Add 'strict-dynamic' back to script-src
- Add ws(s)://$ROOT_PATH to connect-src
- Change onEvent to on-event in angular templates to fix CSP issues in firefox.
- Add blob: to style-src
2021-05-28 17:01:10 +02:00
dfbf955aa8
simplify method/code sanitization ( #34723 )
2021-05-26 12:18:54 +02:00
4710566514
bus: add ctx for all signed in user queries ( #33970 )
...
Signed-off-by: bergquist <carl.bergquist@gmail.com >
2021-05-18 18:24:42 +02:00
8254efc027
metrics: instrument request with histograms by default ( #33921 )
...
Signed-off-by: bergquist <carl.bergquist@gmail.com >
2021-05-14 12:53:50 +02:00
765fa675f5
live: disable gzip for ws endpoints ( #34015 )
2021-05-12 18:39:57 +03:00
b6e6fa53fc
instrumentation: prefix metrics with grafana ( #33925 )
...
Signed-off-by: bergquist <carl.bergquist@gmail.com >
2021-05-11 14:37:03 +02:00
540f110220
[Alerting]: Extend quota service to optionally set limits on alerts ( #33283 )
...
* Quota: Extend service to set limit on alerts
* Add test for applying quota to alert rules
* Apply suggestions from code review
Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com >
* Get used alert quota only if naglert is enabled
* Set alert limit to zero if nglalert is not enabled
Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com >
2021-05-04 19:16:28 +03:00
caa420f92f
Chore: Improve request distributed tracing middleware ( #33033 )
...
Before these changes the request tracing was added for each route
registered using the routing.RouteRegister, see code. This had the
consequence that middleware executed earlier/later in the request
pipeline was not part of the request tracing middleware life-cycle
which measures the duration of requests among other things.
In the logger middleware we do extract the current distributed trace
identifier, if available, and set that on request info/error log messages.
With these changes we can extract the current distributed trace identifier,
if available, and set that on the contextual HTTP request logger
(models.ReqContext.Logger) which would improve the possibility to correlate
all HTTP request log messages with traces.
In addition, the request tracing middleware is now executed first and last in
the request pipeline and should therefore result in more accurate timing
measurements (request duration).
Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com >
2021-04-20 15:22:22 +02:00
39a3b0d0b0
Auth: support JWT Authentication ( #29995 )
2021-03-31 08:40:44 -07:00
07f7c60ae0
live: fix writing headers in hijacked connection with gzip enabled ( #32310 )
2021-03-25 21:36:52 +03:00
610999cfa2
Auth: Allow soft token revocation ( #31601 )
...
* Add revoked_at field to user auth token to allow soft revokes
* Allow soft token revocations
* Update token revocations and tests
* Return error info on revokedTokenErr
* Override session cookie only when no revokedErr nor API request
* Display modal on revoked token error
* Feedback: Refactor TokenRevokedModal to FC
* Add GetUserRevokedTokens into UserTokenService
* Backendsrv: adds tests and refactors soft token path
* Apply feedback
* Write redirect cookie on token revoked error
* Update TokenRevokedModal style
* Return meaningful error info
* Some UI changes
* Update backend_srv tests
* Minor style fix on backend_srv tests
* Replace deprecated method usage to publish events
* Fix backend_srv tests
* Apply suggestions from code review
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com >
Co-authored-by: Hugo Häggmark <hugo.haggmark@gmail.com >
* Apply suggestions from code review
* Apply suggestions from code review
Co-authored-by: Hugo Häggmark <hugo.haggmark@gmail.com >
* Minor style fix after PR suggestion commit
* Apply suggestions from code review
Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com >
* Prettier fixes
Co-authored-by: Hugo Häggmark <hugo.haggmark@gmail.com >
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com >
Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com >
2021-03-16 17:44:02 +01:00
a97637a133
Snapshots: Fix usage of sign in link from the snapshot page ( #31986 )
...
Fix redirect to login page from snapshot page when not authenticated.
Fixes #28547
2021-03-16 16:46:34 +01:00
47f13abf7a
Backend: Migrate to using non-global configuration ( #31856 )
...
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2021-03-10 12:41:29 +01:00
7428668835
Profile: Fixes profile preferences being accessible when anonymous access was enabled ( #31516 )
...
* Profile: Fixes profile preferences page being available when anonymous access was enabled
* Minor change
* Renamed property
2021-02-27 18:04:28 +01:00
8f20b13f1c
Snapshots: Disallow anonymous user to create snapshots ( #31263 )
2021-02-17 09:51:50 +01:00
bc857986b6
Chore: remove CSP debug logging line ( #30689 )
2021-01-27 13:31:41 -08:00
50b649a869
Middleware: Add CSP support ( #29740 )
...
* Middleware: Add support for CSP
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
Co-authored by @iOrcohen
2021-01-12 07:42:32 +01:00
25048ebdf8
Chore: Add CloudWatch HTTP API tests ( #29691 )
...
* CloudWatch: Add HTTP API tests
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2021-01-07 11:36:13 +01:00
dd2d206d99
Backend: Remove more globals ( #29644 )
...
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-12-15 19:09:04 +01:00
c2cad26ca9
Chore: Disable default golangci-lint filter ( #29751 )
...
* Disable default golangci-lint filter
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
* Chore: Fix linter warnings
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-12-15 09:32:06 +01:00
ac09baae7d
Chore: Use Header.Set method instead of Header.Add ( #29804 )
...
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-12-14 15:13:01 +01:00
12661e8a9d
Move middleware context handler logic to service ( #29605 )
...
* middleware: Move context handler to own service
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
Co-authored-by: Emil Tullsted <sakjur@users.noreply.github.com >
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com >
2020-12-11 11:44:44 +01:00
7d9a528184
Logging: rate limit fronted logging endpoint ( #29272 )
...
Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com >
Co-authored-by: achatterjee-grafana <70489351+achatterjee-grafana@users.noreply.github.com >
2020-12-09 16:22:24 +01:00
e1d5fc8627
instrumentation: align label name with our other projects ( #29514 )
...
Signed-off-by: bergquist <carl.bergquist@gmail.com >
2020-12-08 14:26:07 +01:00
4e0ad50102
middleware: Make scenario test functions take a testing.T argument ( #29564 )
...
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-12-04 11:09:32 +01:00
f326b79cc1
Security: Add gosec G304 auditing annotations ( #29578 )
...
* Security: Add gosec G304 auditing annotations
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* Add gosec annotations
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* Add gosec annotations
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* add G304 auditing comment
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* Add gosec annotations
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
* space
Signed-off-by: bergquist <carl.bergquist@gmail.com >
* Add gosec annotations
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
Co-authored-by: bergquist <carl.bergquist@gmail.com >
2020-12-03 22:13:06 +01:00
58dbf96a12
Middleware: Rewrite tests to use standard library ( #29535 )
...
* middleware: Rewrite tests to use standard library
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-12-03 08:28:54 +01:00
752a424e1f
Auth proxy: Return standard error type ( #29502 )
...
* Rewrite auth proxy tests to use standard lib
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
* Auth proxy: Use standard error type
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-12-02 16:57:16 +01:00
8d5b0084f1
Middleware: Simplifications ( #29491 )
...
* Middleware: Simplify
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
* middleware: Rename auth_proxy directory to authproxy
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-12-02 12:44:51 +01:00
b7aa6fed1d
Instrumentation: Add examplars for request histograms ( #29357 )
...
Signed-off-by: bergquist <carl.bergquist@gmail.com >
2020-12-01 15:04:59 +01:00
10ff4eecef
Backend: fix IPv6 address parsing erroneous ( #28585 )
...
* Backend: Fix parsing of client IP address
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com >
2020-11-25 07:55:22 +01:00
1076f47509
Dashboard: Fixes kiosk state after being redirected to login page and back ( #29273 )
...
* Login: Fixes issue where url parameters where modified by golang url code
* Add tests
* Fix test cases
* Update pkg/middleware/auth_test.go
Co-authored-by: Sofia Papagiannaki <papagian@users.noreply.github.com >
* fixed formatting
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com >
Co-authored-by: Sofia Papagiannaki <papagian@users.noreply.github.com >
2020-11-20 19:30:37 +01:00
9593d57914
Chore: Enable errorlint linter ( #29227 )
...
* Enable errorlint linter
* Handle wrapped errors
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com >
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com >
2020-11-19 14:47:17 +01:00
Serge Zaitsev
idafurjes
Sofia Papagiannaki
Andres Martinez Gotor
Marcus Efraimsson
Gabriel MABILLE
Arve Knudsen
yuwaMSFT2
Tobias Skarhed
Dimitris Sotirakis
kay delaney
Carl Bergquist
Alexander Emelin
Vladimir Kochnev
Joan López de la Franca Beltran
Torkel Ödegaard
Ryan McKinley
Domas
taciomcosta