Commit Graph

3618 Commits

Author SHA1 Message Date
Karl Persson
ffb75d0ae5 Identity: remove GetTypedID (#91745)
(cherry picked from commit bcfb66b416)
2024-08-21 15:26:18 +01:00
Kristin Laemmert
f4b646da29 QuotaService: refactor to use ReplDB for Get queries (#91333)
* Feature (quota service): Use ReplDB for quota service Gets

This adds the replDB to the quota service, as well as some more test helper functions to simplify updating tests. My intent is that the helper functions can be removed when this is fully rolled out (or not) and we're consistently using the ReplDB interface (or not!)

* test updates

(cherry picked from commit 299c142f6a)
2024-08-21 15:23:47 +01:00
Alexander Zobnin
0e5d7633f7 Access Control: Make it possible to exclude role grants (#91647) 2024-08-08 14:11:17 +02:00
lean.dev
b5e32b31b1 Grafana: Enables use of encrypted certificates with password for https (#91418) 2024-08-06 19:18:32 -03:00
Jeff Levin
d4916207a0 chore(tracing): add tracing for frontend and db session (#91509)
This PR adds instrumentation for loading frontend SPA along with select methods in the dashboard service, and cleans up span handling in sqlstore.

---------

Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
2024-08-05 17:17:39 -08:00
Josh Hunt
e55b438f14 E2C: Reduce UI poll interval and make configurable (#91386)
* E2C: Reduce UI poll interval and make configurable

* fix default
2024-08-02 10:46:41 +01:00
Gabriel MABILLE
8988e04044 RBAC: Add permission registry (#91247)
* RBAC: Permission registry

* Populate permission registry

* Wire

* conflic_user_cmd

* Update pkg/services/accesscontrol/permreg/permreg_test.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* PR feedback

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Remove ToDo, tackle in subsequent PR

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2024-08-02 09:32:06 +02:00
Ieva
2e2ddc5c42 Folders: Allow folder editors and admins to create subfolders without any additional permissions (#91215)
* separate permissions for root level folder creation and subfolder creation

* fix tests

* fix tests

* fix tests

* frontend fix

* Update pkg/api/accesscontrol.go

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>

* fix frontend when action sets are disabled

---------

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
2024-08-01 18:20:38 +03:00
Ryan McKinley
728150bdbd Identity: extend k8s user.Info (#90937) 2024-07-30 08:27:23 +03:00
Will Browne
1b3fa8c47f Plugins: Hide version information when plugin is managed (#88065)
* first pass

* fixup

* fix linter issues

* fix API test

* update naming

* rework

* update var name

* empty check

* prettier

* fix test

* fix lint
2024-07-29 11:18:43 +01:00
Kevin Minehart
c326d865c5 RBAC: Allow plugins to use scoped actions (#90946)
Co-authored-by: gamab <gabriel.mabille@grafana.com>
2024-07-25 17:22:42 +03:00
Diego Augusto Molina
95000f9fc8 fix data race in GetWebAssets (#90939) 2024-07-25 11:14:40 -03:00
Ryan McKinley
9db3bc926e Identity: Rename "namespace" to "type" in the requester interface (#90567) 2024-07-25 12:52:14 +03:00
Alex Khomenko
8cdf5ee824 E2C: Add Public Preview banner (#90922)
* E2C: Add public preview message

* Read feedback URL from the settings

* Translate strings

* Add missing translation

* Add missing translation[2]
2024-07-25 12:44:49 +03:00
Ieva
9bb2cf4968 RBAC: Allow omitting default permissions when a new resource is created (#90720)
* Cfg: Move rbac settings to own struct

* Cfg: Add setting to control if resource should generate managed permissions when created

* Dashboards: Check if we should generate default permissions when dashboard is created

* Folders: Check if we should generate default permissions when folder is created

* Datasource: Check if we should generate default permissions when datasource is created

* ServiceAccount: Check if we should generate default permissions when service account is created

* Cfg: Add option to specify resources for wich we should default seed

* ManagedPermissions: Move providers to their own files

* Dashboards: Default seed all possible managed permissions if configured

* Folders: Default seed all possible managed permissions if configured

* Cfg: Remove service account from list

* RBAC: Move utility function

* remove managed permission settings from the config file examples, change the setting names

* remove ini file changes from the PR

* fix setting reading

* fix linting errors

* fix tests

* fix wildcard role seeding

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: jguer <me@jguer.space>
2024-07-24 19:31:26 +03:00
Julien Duchesne
25f0c70022 OpenAPI: Document the /api/health endpoint (#88203)
Document `/api/health` with OpenAPI
To do so, the response build had to be re-implemented as a struct
2024-07-23 09:41:03 -04:00
Eric Leijonmarck
248af65f9c Actionsets: Add ability for plugins to add actions for core actionsets (i.e. folders:edit) (#88776)
* initial commit

* Action sets stored
remove the dependancy for actionsets
got the actionsets registered
storing the permissions

* fix golanglinting

* remove unused struct field

* wip

* actionset registry for a plugin from the actionsetservice

* update to make declareactionset the primary way of plugin registration and modification

* declare actually extends actionsets

* tests fixed

* tests skipped

* skip tests

* skip tests

* skip tests

* skip tests

* change to warning instead

* remove step from pipeline to see if it fails due to plugin not registering

* reintroduce step but remove features dependancy

* add back the tests that were failing

* remove comments and another skip test

* fix a comment and remove unneeded changes

* fix and clean up, put the behaviour behind a feature toggle

* clean up

* fixing tests

* hard-code allowed action sets for plugins

* Apply suggestions from code review

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* small cleanup

---------

Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2024-07-19 16:16:23 +01:00
Hugo Kiyodi Oshiro
5c966fd400 Plugins: Add logs to for plugin management actions (#90587)
* Plugins: Add logs to for plugin management actions

---------

Co-authored-by: Giuseppe Guerra <giuseppe.guerra@grafana.com>
2024-07-18 17:19:36 +02:00
Kristina
6eb695b258 Explore: Add setting for default time offset (#90401)
* Add setting for explore for a different time offset

* fix linter

* Add validation for duration value
2024-07-17 11:47:49 -05:00
Andrew Hackmann
319a874033 MSSQL: Password auth for Azure AD (#89746)
* Password auth for Azure AD

* rename auth fields

* add azure flag for client password cred enabled

* prettier

* rename flag

* Update go.mod

* Update public/app/plugins/datasource/mssql/azureauth/AzureCredentialsForm.tsx

Co-authored-by: Andreas Christou <andreas.christou@grafana.com>

* Apply suggestions from code review

Co-authored-by: Andreas Christou <andreas.christou@grafana.com>

* update package

* go mod

* prettier

* remove password

* gowork

* remove unused env test

* linter

---------

Co-authored-by: Andreas Christou <andreas.christou@grafana.com>
2024-07-16 14:08:51 -05:00
Kristin Laemmert
8a6107cd35 DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)
* Use ReplDB in dashboard store and update all fixtures - no other changes

* just moving dashboard counts for now

* find the missing test fixture
2024-07-12 10:47:49 -04:00
Aaron Godin
7e767e40a9 IAM: Fix logic for enabling a user (#90309)
fix: correct logic on enabling a disabled user account
2024-07-12 10:54:27 +02:00
Nihal
c1d9e793be Metrics: Fix internal metrics endpoint not accessible from browser if basic auth is enabled (#86904)
* add WWW-Authenticate header in the http response of /metrics endpoint in case of wrong basic auth credentials

Signed-off-by: Syed Nihal <syed.nihal@nokia.com>

* added change log for the change fixing the issue https://github.com/grafana/grafana/issues/86902

Signed-off-by: Syed Nihal <syed.nihal@nokia.com>

* Update CHANGELOG.md

---------

Signed-off-by: Syed Nihal <syed.nihal@nokia.com>
2024-07-11 14:55:48 +02:00
Alex Khomenko
62494248e3 Restore dashboards: Add RBAC (#90270)
* Restore dashboards: Add RBAC

* Add check to navtree

* Prevent non-admins from searching deleted dbs

* Add check to the route

* Cleanup

* Update translations

* Update API permissions

* Correct permissions

* Update warning message

* Update translation

* Return 401 for deleted query without admin role
2024-07-11 13:20:04 +03:00
Giuseppe Guerra
9216a3df7d Plugins: Remove datasourceQueryMultiStatus feature toggle (#90191)
* Remove datasourceQueryMultiStatus feature toggle

* PR review suggestion
2024-07-10 11:15:10 +02:00
Charandas
c210617735 K8s: use contexthandler in standalone handler chain (#90102) 2024-07-08 12:22:10 -07:00
Timur Olzhabayev
f763f2085b Feat: Extending report interaction with static context that can be appended to all interaction events (#88927)
* Extending report interaction with static context that can be appended to all requests
2024-07-08 16:37:45 +02:00
Kristin Laemmert
77a4869fca accesscontrol service read replica (#89963)
* accesscontrol service read replica
* now using the ReplDB interface
* ReadReplica for GetUser
2024-07-08 10:00:13 -04:00
Ieva
e9ebb6eaa4 Folders: Fix folder pagination for cloud instances with many folders (#90008)
* filter the k6 folder out in the SQL queries rather than during post processing to ensure that the correct number of results is always returned

* linting
2024-07-05 11:19:03 +01:00
Karl Persson
7a78ad3893 Authn: Remove response writer from auth req (#90110)
Authn: Remove response writer from request
2024-07-05 11:42:12 +02:00
Alexander Zobnin
87d86e81ce Zanzana: Evaluate permissions alongside with RBAC engine (#90064)
* Zanzana: Evaluate permissions if feature flag enabled

* Fix tests

* adjust logs

* fix spelling

* remove unused

* only evaluate implemented resources

* refactor
2024-07-05 11:31:23 +02:00
Andres Martinez Gotor
be98ab1111 Add apiVersion to datasource settings DTO (#90057) 2024-07-04 16:44:19 +02:00
Joao Silva
9004b58851 Navigation: Backend to save navigation customization into preferences (#89783) 2024-07-03 10:40:51 +01:00
Jeff Levin
cfe8317d45 Add auth spans and remove deduplication code for scopes (#89804)
Adds more spans for timing in accesscontrol and remove permission deduplicating code after benchmarking

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2024-07-02 22:08:57 -08:00
Josh Hunt
52ea6236d4 E2C: Set up page route so cloud-migrations doesn't 404 (#89947) 2024-07-02 17:11:18 +01:00
Karl Persson
e568b86ac0 Zanzana: Initial work to allow partial data migrations (#89919)
* Zanana: Add Write method to interface

* Zanzana: Add utilities for translating RBAC to openFGA tuple keys

* RBAC: Add zanzana synchronizer

* Run zanzana sync in access controll provider
2024-07-02 14:45:25 +02:00
Andres Martinez Gotor
a22c1ae424 Chore: Remove provisional APIVersion from plugin info (#89831) 2024-07-01 10:53:16 +02:00
Jeff Levin
ed13959e33 Optimize memory allocations in permissions cache (#89645)
This PR reduces the number of allocations made while caching permissions from the database, fixes the hierarchy of spans and adds new spans for tracing.

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
2024-06-26 23:03:13 +03:00
Marcus Andersson
04f39457cf Chore: Remove sensitive information from presigned URLs prior to logging (#87035)
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>
2024-06-24 14:53:42 +02:00
Ryan McKinley
27e800768e K8s: Improve identity mapping setup (#89450) 2024-06-20 17:53:07 +03:00
Laura Benz
34b3dbdbf3 RestoreDashboards: Adjust path (#89233)
* refactor: change path

* fix: page headline

* refactor: remove condition
2024-06-18 17:24:48 +02:00
Ryan McKinley
99d8025829 Chore: Move identity and errutil to apimachinery module (#89116) 2024-06-13 07:11:35 +03:00
Ashley Harrison
822644714a Navigation: Remove ApplyAdminIA logic (#89113)
make admin IA more normal
2024-06-12 16:45:13 +01:00
Aaron Godin
59a6a6513f Prevent moving a k6 folder (#88884)
* iam-716 - prevent a folder move operation when the folder's uid or any of its parents uids begin with k6-app

* fox folder move check and only list non-k6 folders to users

* adding tests for moving

* add a test for listing folders

* fix the other tests

* use method that adds folder parent

---------

Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>
2024-06-10 09:17:51 -05:00
Marcus Efraimsson
fe3e5917f1 Plugins: Preserve trailing slash in plugin proxy (#86859)
* Plugins: Preserve trailing slash in plugin proxy

* enable toggle by default
2024-06-05 13:36:14 +02:00
Andres Martinez Gotor
60ce523b72 Refactor plugin context initialization (#88343) 2024-05-28 16:59:06 +03:00
Tim Levett
b5cf90ce78 API: Add in theme support to /render/* endpoint (#88304)
add in theme support to render endpoint
2024-05-24 14:12:31 -05:00
Ryan McKinley
ffc2702552 Plugins: Support Admission validation hooks (#87718) 2024-05-24 18:45:16 +03:00
Juan Cabanas
a85c1b69d5 PublicDashboards: Remove publicDashboardUid from DashboardMeta (#85126) 2024-05-23 11:21:21 -03:00
Ieva
bd2b248f0e RBAC: Clean up action set code (#88147)
* remove unused action set code, refactor the existing code

* fix import ordering

* use a separate interface for permission expansion after all, to avoid circular dependencies

* add comments, fix a test
2024-05-23 12:14:01 +01:00