Commit Graph

556 Commits

Author SHA1 Message Date
Ieva
9264431c81 RBAC: Remove action set feature toggle (#101959)
* remove action set feature toggle

* don't pass feature toggles to action set service instantiation

* linting

* test fixes and frontend clean-up

* fix test
2025-03-13 15:18:23 +00:00
maicon
927f7befd6 Unistore: Create default permissions through Folder APIServer (#101420)
* Unistore: Declare a new storage to set default folder permissions

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Remove the setting of default permissions from folder legacy storage

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Disable setting of folder permissions when Api Server is enabled

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Reverts grafana/grafana#100019

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Add unit test

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* check error on unit test

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Add unit test

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Remove unused fields

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Add unit tests for folder_storage

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Remove duplicated import

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

* Fix unit test

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
2025-03-11 11:33:08 +00:00
Peter Štibraný
fd6a4908f1 Support Spanner's UNION syntax, which needs to be UNION DISTINCT or UNION ALL. (#101768)
* Support Spanner's UNION syntax, which needs to be UNION DISTINCT or UNION ALL.
2025-03-10 12:33:52 +01:00
Matheus Macabu
b110754c9a Hackaton: Add more unit tests, take 2 (#101473)
* login/social/socialimpl: add assertions for usage stats, support bundle and oauthinfo methods

* accesscontrol/acimpl: add tests for GetRoleByName

* anonymous/sortopts: add tests for Sorter

* cloudmigration/gmsclient: add basic test cases for all methods

* shorturls/shorturlimpl: add more edge test cases

* tag/tagimpl: add test to cover duplicate tag kv and nil pairs

* updatechecker: add test cases for module
2025-03-03 13:12:13 +01:00
Sven Grossmann
b5faf5d9a1 Drilldown: Require datasources:explore RBAC action (#101366)
Drilldown: Require `datasources:explore` acton
2025-02-26 17:33:05 +01:00
Karl Persson
fa74d1c36d Authn: Sync authlib and update how we construct authn client interceptor (#101124)
* Sync authlib and update how we construct authn client interceptor

* Remove namespace from checker
2025-02-26 09:22:09 +01:00
Gabriel MABILLE
f3433fd472 RBAC: Remove accessControlOnCall feature toggle (#101222)
* RBAC: Remove accessControlOnCall feature toggle

* Leave the other one in place

* Tests

* frontend

* Readd empty ft to frontend test

* Remove legacy RBAC check

* Fix test

* no need for context

* Remove unused variable

* Remove unecessary param

* remove unecessary param from tests

* More tests :D
2025-02-25 13:44:40 +01:00
Gabriel MABILLE
0290da6aaa AccessControl: Allow plugin roles to include plugins:write (#101089) 2025-02-21 08:23:04 +01:00
Andre Pereira
e54149e551 Explore: Move drilldown apps from Explore to a new navbar item "Drilldown" (#100409)
* Move drilldown apps from Explore to a new navbar item "Drilldown"

* Commit make i18n-extract

* Update drilldown icon

* Added alert to explore with call out to drilldown apps

* Add isNew field for nav item which shows a "New!" badge on the navbar and expands it by default

* Fix e2e test
2025-02-20 17:56:55 +00:00
Ryan McKinley
5a40c84568 DualWriter: Support managed DualWriter (#100881) 2025-02-19 17:50:39 +03:00
Alexander Zobnin
fcb88f6ccc Zanzana: revert cluster store for fixed roles (#100958)
* Zanzana: revert cluster store for fixed roles

* update go workspace
2025-02-19 13:53:25 +01:00
Stephanie Hingtgen
3e6f40c873 K8s: Move to one feature toggle for folders and dashboards (#100911) 2025-02-19 01:11:26 +02:00
Stephanie Hingtgen
67be9aeed6 K8s: Search fallback: Support all sort by methods (#100776) 2025-02-18 12:30:11 -06:00
Peter Štibraný
1856d47e47 Remove GetResourceClient hack from unified package. (#100636)
* Remove GetResourceClient hack from unified package.
2025-02-14 12:34:52 +01:00
Alexander Zobnin
5118e82e8c Zanzana: Run reconciliation in its own service (#100361)
* Zanzana: Start reconciliation in its own service

* cleanup

* update go workspaces

* refactor

* remove unused code

* move func definition
2025-02-11 14:09:39 +01:00
Karl Persson
39d94eabcd Auth: Fix function name (#100122)
Fix spelling
2025-02-05 15:32:22 +01:00
Stephanie Hingtgen
8ac9c47222 Folders: Validator: add temporary fix (#100019) 2025-02-03 17:08:15 -06:00
Karl Persson
c85a175212 RBAC: only query folder service when fetching parent folders (#99893)
* only query folder service when fetching parent folders
* Perform validation and inehrited scopes solvers as service instead of caller
2025-02-03 13:56:25 +01:00
Arati R.
a2097fbc2f Folders: Add user service to folder service implementation (#99518)
Add user service to folder service implementation
2025-01-27 14:29:47 +01:00
Misi
437b7a565d Auth: Add access token to in-proc communication and ServiceIdentity (#98926)
Use fake access token for in-proc grpc and add ServiceIdentity 
---------

Co-authored-by: gamab <gabriel.mabille@grafana.com>
Co-authored-by: Karl Persson <23356117+kalleep@users.noreply.github.com>
2025-01-24 14:03:23 +01:00
Ezequiel Victorero
3a94057ec8 PublicDashboards: Delete on folder deletion (#99040) 2025-01-23 17:23:59 -03:00
Todd Treece
2622449718 Dashboards: Use dashboard service in access control (#99053) 2025-01-21 22:57:43 +02:00
Ryan McKinley
680e6bc1f8 Authlib: Use types package rather than claims (#99243) 2025-01-21 12:06:55 +03:00
Karl Persson
7329d2c34b Authz: Account for fixed roles when running oss and using authz service (#99244)
* Extract "PermissionStore" from general store interface

* Add static and union permission stores

* Add GetStaticRoles

* Use accesscontrol.Service for inproc to provide static permissions
2025-01-20 16:00:36 +01:00
Alexander Zobnin
cbb688e910 Zanzana: Remove usage from legacy access control (#98883)
* Zanzana: Remove usage from legacy access control

* remove unused

* remove zanzana client from services where it's not used

* remove unused metrics

* fix linter
2025-01-14 10:26:15 +01:00
maicon
766d645d82 Filewalkwithme/unistore refactor folder service to hit folder apiserver (#98409)
Refactor folder service to use Unified Storage

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
2025-01-13 18:15:35 -03:00
Karl Persson
c593b20465 Zanana: Add custom verb for get_permissions and set_permissions. (#98616)
* Add custom verb for get_permissions and update_permissions.

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
2025-01-10 11:49:26 +01:00
Stephanie Hingtgen
9488bf2915 Dashboards: use service for quotas (#98756) 2025-01-09 22:21:21 -07:00
Karl Persson
fb5783691d Zanzana: Fix reconciliation of fixed roles (#98696)
Remove "globalReconciler" and reuse the same one but only run them for cluster namespace
2025-01-09 10:40:18 +01:00
Karl Persson
9ed4bf3cd2 Zanzana: Support sub resources (#98201)
* Create and use common ResourceInfo struct

* Add support for formatting group resource with subresource

* Add initial support for handling subresource

* Add test for checking subresource for generic resource

* Bump authlib
2025-01-07 15:16:14 +01:00
Alexander Zobnin
7e5cb7d8d6 Zanzana: Refactor fixed roles (use global store) (#97884)
* Zanzana: Pass contextual tuples for authorization

* global reconciler for fixed roles

* inject tuples from global store

* fix adding contextual tuples

* cleanup

* don't error on auth context fail

* add todo

* add context for List

* add caching

* remove unused

* use constant for global namespace

* Rename global namespace to cluster namespace
2025-01-07 13:49:55 +01:00
Arati R.
6957e1f7b7 Folders: Replace sql query with folder service call when collecting folder tree (#98443)
* Replace sql query with folder service call when collecting folder tree
* Update provider for folder service implementation for wire
* Refactor provisioning of oss service in folder permissions test util
2025-01-07 09:53:09 +01:00
maicon
d2639f6080 Ensure all internal Services are using FolderService and not FolderStore (#98370)
* Ensure all internal Services are using FolderService and not FolderStore

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
2024-12-30 13:48:35 -03:00
Jo
40d3b02648 Auth: Separate anonymous settings to its own struct (#97791)
separate anonymous settings to its own struct
2024-12-13 10:46:27 +01:00
Alexander Zobnin
61d71ec5b1 Zanzana: Handle anonymous users (#97171)
* add anonymous users to schema

* sync anonymous user role

* remove unused

* fix linter

* only add anonymous reconciler if feature is enabled
2024-12-11 12:22:42 +01:00
Karl Persson
718612aabf Zanzana: Update relation names (#97638)
* Update relation names to match k8s verbs

* Only check namespace if relation is valid

* Only list for valid relations
2024-12-10 09:38:03 +01:00
Karl Persson
e4fbae03a1 RBAC: remove dead code (#97234)
This code is unused and always have been
2024-12-02 16:23:51 +01:00
Ieva
cc0ec349a4 RBAC: Allow passing in user UID when searching for user's permissions (#97125)
* allow passing in user UID instead of ID when searching for user's permissions

* fix tests
2024-11-28 16:36:26 +00:00
Matheus Macabu
f2b96593ea SQL: close rows to release connection (#97147)
* SQL: close rows to release connection

* dont return err from rows.Close()
2024-11-28 14:28:55 +01:00
Alexander Zobnin
c8caf787d4 Zanzana: handle service accounts (#97123)
* add service account to the schema

* sync managed permissions for service accounts

* sync SA basic roles

* sync SA roles

* Fix endless loop in reconciler while read openfga
2024-11-28 10:41:30 +01:00
Karl Persson
3990637af9 IAM: remove duplicated functions (#96989)
* Remove duplicated function and use the one provided by claims package
2024-11-26 09:22:45 +01:00
Alexander Zobnin
170e0e1813 Zanzana: List then search implementation (#96705)
* Zanzana: Search with list

* Allow to pass werb into list request

* split list search into 2 functions

* fix listing resources

* remove unused

* refactor

* remove unused function

* Add more logging to reconciler

* Fix search for users with access to all resources

* fix findFoldersZanzanaList

* search for folders as well by default

* refactor

* use compile for list and search

* remove list from client

* remove only from client

* remove list from interface

* run compile once

* refactor

* refactor

* add search tests

* fix tests

* Fix linter
2024-11-25 14:58:34 +01:00
Karl Persson
e995d4f682 Zanzana: Add setting zanzana reconciliation interval (#96687)
Add config option under RBAC for zanzana reconciliation interval
2024-11-21 09:20:29 +01:00
Ieva
a60953c8f9 GAS: Show mapped roles in role picker (#96681)
* add group mapping UID returned mapped roles

* request mapped roles from the frontend, but don't attempt to update mapped roles

* lock mapped roles and show a pop-up message about why a role is locked

* update role selectors to not allow deselecting a mapped role

* swagger gen

* simplify and set mapped as bool instead of mapping UID array

* swagger gen
2024-11-20 17:37:12 +00:00
Karl Persson
7e442efa9c Zanzana: sync roles and bindings (#96661)
* Sync fix and custom roles and team bindings.

* Add collector for user role bindings
2024-11-19 13:18:44 +01:00
Karl Persson
1f34096fdf Zanzana: reconcile basic roles and bindings (#96473)
* Add reconciler for basic roles

* Add reconciler for basic role bindings
2024-11-15 12:10:22 +01:00
Karl Persson
db6422c8a3 Zanzana: Use correct namespace when evaluating permission (#96258)
Use correct namespace
2024-11-12 11:52:29 +01:00
Gabriel MABILLE
cc9cdbe82d Authz: Move extension proto up a layer (#96254)
* Authz: Move extension proto up a layer

* Lint
2024-11-12 10:19:12 +01:00
Alexander Zobnin
b1fb581ab1 Zanzana: Evaluate access with Check request (server-side) (#96213)
* Zanzana: Evaluate access with Check request (server-side)

* Pass parent folder for checking access

* Review suggestions

* remove fixme comment
2024-11-11 16:39:21 +01:00
Karl Persson
9f66843915 Zanzana: use namespace when performing reconciliation (#96205)
* Special handling for zanzana reconciliation if stack id is configured

* remove sync call
2024-11-11 13:48:49 +01:00