* Alerting: Protect sensitive fields of contact points from unauthorized modification
- Introduce a new permission alert.notifications.receivers.protected:write. The permission is granted to contact point administrators.
- Introduce field Protected to NotifierOption
- Introduce DiffReport for models.Integrations with focus on Settings. The diff report is extended with methods that return all keys that are different between two settings.
- Add new annotation 'grafana.com/access/CanModifyProtected' to Receiver model
- Update receiver service to enforce the permission and return status 403 if unauthorized user modifies protected field
- Update receiver testing API to enforce permission and return status 403 if unauthorized user modifies protected field.
- Update UI to disable protected fields if user cannot modify them
Co-authored-by: Sonia Aguilar <soniaaguilarpeiron@gmail.com>
* yarn run prettier:write
---------
Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
Co-authored-by: Sonia Aguilar <soniaaguilarpeiron@gmail.com>
* Chore: Run annotation data migration in batches (#113589)
* run annotation data migration in batches
* how could i miss it
* run in the background, starting from newest annotations
* update tests
* optionally pass batch size via env
(cherry picked from commit 95e65e2588)
* fix broken cherry pick
* update mysql query
SCIM: Upgrade the User.UID field to allow for the new scim- prefix (#113500)
Upgrade the User.UID field to allow for the new scim- prefix
(cherry picked from commit ca5d898120)
Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
Add index IDX_folder_org_id_parent_uid_uid (#110131)
* Add index IDX_folder_org_id_parent_uid
* Force index on Dashboard Permission Filter (MYSQL)
---------
(cherry picked from commit cfe73925cd)
Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
Co-authored-by: maicon <maiconscosta@gmail.com>
Add permission role_id action index (#110125)
* Add permission role_id action index
* Drop permission role_id index
---------
(cherry picked from commit 99fc606e17)
Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
Co-authored-by: maicon <maiconscosta@gmail.com>
* automatically rename integration tests to follow the common convention
* name tests differently
* alter column type to bigint
* update another column to bigint
* add another alter
* fix subquery for mysql
* apiserver/folders: use exact match on GetFolderByTitle in legacy
Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
---------
Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
* fix: increase login_attempt.ip_address column length for IPv6 support
- Expand ip_address column from VARCHAR(30) to VARCHAR(50) to accommodate IPv6 addresses
- Add database migration with support for PostgreSQL, MySQL, and SQLite
- Add comprehensive integration tests for various IPv6 address formats
- Resolves 500 errors when login fails over IPv6, now returns proper 401 errors
Fixes#106362
* test: add missing test skip to TestIntegrationIPv6AddressSupport
Skip integration test when running with -short flag to separate unit and integration tests
* Update pkg/services/sqlstore/migrations/login_attempt_mig.go
Co-authored-by: Victor Cinaglia <victor@grafana.com>
* fix missing bracket
* fix: resolve PostgreSQL timestamp overflow in IPv6 test
- Use controlled time mock instead of time.Now() to avoid timestamp conversion issues
- Follow existing test patterns with xormStore and mock time functions
- Add proper Since parameter to GetIPLoginAttemptCount query
- Fixes PostgreSQL error: 'pq: value "-62135596800" is out of range for type integer'
* fix: resolve PostgreSQL UTF-8 encoding error in IPv6 test
Replace string(rune(i)) with fmt.Sprintf to avoid null bytes (0x00)
when i=0, which caused 'invalid byte sequence for encoding UTF8' error
---------
Co-authored-by: Victor Cinaglia <victor@grafana.com>
* replace usage of folder guardians with access control evaluators
* remove NewByFolderUID guardian
* bring up to date
* fix test
* more test fixes, and don't fetch the folder before evaluating lib element access
* change what error is returned
* fix alerting test
* try to fix linter errors
* replace the use of newByFolder guardian with direct access control evaluator checks
* remove newByFolder guardian
* get rid of dashboard and folder guardians
* undo unwanted change
* undo unwanted change
* undo unwanted change
* update code owners
* replace xorm.io/xorm imports
* replace xorm from other go.mod files
* clean up workspace
* nolint does not make sense anymore as it is not a module
* try if nolint directive helps
* use nolint:all for xorm
* add more nolints
* try to skip xorm in linter config
* exclude xorm differently
* retrigger ci
* Fix TestIntegrationUpdatingProvisionionedDashboards* tests when running on Spanner by fixing case-insensitive search for dashboard title.
* Fix use of case-insensitive LIKE when running on Spanner.
* Fix use of LikeStr in anonstore.
* Fix use of LikeStr in ngalert/store and org/orgimpl.
* Fix use of LikeStr in queryhistory search.
* Fix use of LikeStr in serviceaccounts.
* Fix use of LikeStr in serviceaccounts.
* Fix use of LikeStr in services/team.
* Remove LikeStr method.
* add columns external_id and is_provisioned to the team table
* generate openapi specs
* rename column to external_uid
* generate open api specs
* increase limit for external_uid to 256
* CI: Allow Bench conversion to fail
We shouldn't mark PRs and commits as X if they fail to convert logs with Bench.
* Fix: Prints should always include new lines
* fix: remove unused import
* Validate authID when user is provisioned
* Add new `user_unique_id` to `user_auth` table
* Validate provisioned user with saml assertion
* Rework `ExternalUID`
* Validate for ExternalUID only
* Enhance verbosity
* Move ExternalUID to saml config
* Rename db variable for externalUID
* Add verbosity to debug ExternalUID
* Assign new error for ExternalUID mismatch
* Add `GetByLoginFn`
* Add new configuration to saml tests
* add validation for empty externalUID
* Fix UNION syntax in resourcepermissions package.
* Fix migrations in usermig package to work with Spanner.
* Fix health query.
* Use more connections for integration tests.
* Add test-go-integration-spanner target to run integration tests against Spanner emulator.
* Add test for enterprise.
* Don't delete sequence number for migration_log.id column.
* Only bump max open connections to 20 for Spanner.
Lower integration test timeout.
Serge Zaitsev
grafana-delivery-bot[bot]andlinoman
Jean-Philippe Quéméner
JoandVictor Cinaglia
Stephanie Hingtgen
Will Browne
Fayzal Ghantiwala
Peter Štibraný
Sofia Papagiannaki
Ieva
Gabriel MABILLE
Georges Chaudy
Nathan VērzemnieksandRyan McKinley
Mariell Hoversholm
Andre Pereira
Mihai Doarna
Syerikjan Kh
owensmallwood
Alexander Akhmetov