Commit Graph

22 Commits

Author SHA1 Message Date
Alexander Zobnin aa92dc860b Zanzana: Improve server side error handling (#106378)
* Zanzana: Split client and server logs

* Zanzana: Improve error handling and logging

* log internal error at the server side

* refactor

* improve errors for list request

* update go modules

* handle errors for read and write

* refactor

* reset go.mod changes
2025-06-05 22:11:26 +02:00
Alexander Zobnin 1584349b99 Zanzana: Use authz client (#104037)
* Zanzana: use client from authzlib

* update go.sum

* use user UID for debugging

* Remove unused function
2025-04-24 10:57:24 +02:00
Alexander Zobnin 4bc9203cf6 Zanzana: Perform shadow requests (#103444)
* Zanzana: Execute checks in the background

* add metrics

* collect metrics

* cleanup

* shadow compile checker

* add time metrics for compiler

* run compile in parallel

* prevent deadlock
2025-04-08 10:03:35 +02:00
Karl Persson fa74d1c36d Authn: Sync authlib and update how we construct authn client interceptor (#101124)
* Sync authlib and update how we construct authn client interceptor

* Remove namespace from checker
2025-02-26 09:22:09 +01:00
Ryan McKinley 680e6bc1f8 Authlib: Use types package rather than claims (#99243) 2025-01-21 12:06:55 +03:00
Karl Persson 2187a66f2b Zanzana: Split up settings into client and server sections (#99066)
* Split up zanzana settings into client and server sections

* Update workspace
2025-01-16 13:39:39 +01:00
Gabriel MABILLE efb7cc0343 Chore: Authlib upgrade (#98319)
* Chore: Authlib upgrade

* Upgrade authlib

* Uncommit file
2024-12-20 15:48:35 +01:00
Alexander Zobnin 170e0e1813 Zanzana: List then search implementation (#96705)
* Zanzana: Search with list

* Allow to pass werb into list request

* split list search into 2 functions

* fix listing resources

* remove unused

* refactor

* remove unused function

* Add more logging to reconciler

* Fix search for users with access to all resources

* fix findFoldersZanzanaList

* search for folders as well by default

* refactor

* use compile for list and search

* remove list from client

* remove only from client

* remove list from interface

* run compile once

* refactor

* refactor

* add search tests

* fix tests

* Fix linter
2024-11-25 14:58:34 +01:00
Alexander Zobnin 1366197522 Zanzana: Search with check server side (#96268)
* pass zclient into dashboard service

* Search then check implementation

* Use GetNamespace() for user

* remove unused orgID

* simple batch check

* refactor

* add tests

* fix batchCheckItem

* client implements batch check

* use batch check in search

* remove unused

* remove All field from response

* refactor: extract checkNamespace

* fix search result uniqueness

* comment fix

* Apply suggestions from code review

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* refactor

* cleanup

* remove unnecessary check

* fix tests

* fix protobuf def

* Fix query page

* fix type

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-11-18 14:01:28 +01:00
Karl Persson ae95a6158f Zanana: Remove opefga from client and implement compile (#96275)
Zanana: Remove opefga from client and implement Compile
2024-11-12 15:30:34 +01:00
Gabriel MABILLE cc9cdbe82d Authz: Move extension proto up a layer (#96254)
* Authz: Move extension proto up a layer

* Lint
2024-11-12 10:19:12 +01:00
Alexander Zobnin 910ec7e7dc Zanzana: Use separate store for each org (#96015)
* Move server init into server package

* map store name to id

* refactor model loading

* pass namespace into reconcilers and collectors

* refactor

* Extend authz server with Read and Write methods

* use new read/write in reconciler

* implement server side read and write

* Sync permissions for every org

* handle namespace in check and list

* split read and write

* provide conditions

* Fix client implementation

* fix nil conditions

* remove unused client code

* use lock for store access

* move type translators to common package

* fix folder collector

* fix store creation

* remove unused AuthorizationModelId

* fix server tests

* fix linter
2024-11-08 14:54:36 +01:00
Karl Persson f0a5b444e3 Zanzana: generic resource only (#96019)
* Remove collectors

* Remove zanzana search check, we need to rewrite that part to the new schema

* Only use generic resource schema and cleanup code we don't want to keep / need to re-write
2024-11-08 09:30:41 +01:00
Karl Persson e0163c93c2 Zanzana: reconcile generic schema (#95492)
* Rename to CheckObject

* Implement authz.AccessClient

* Move folder tree to reconciler and use new schema

* Move shared functionality to common package

* Add reconciler for managed permissions and resource translations

* Add support for folder resources
2024-10-28 16:32:16 +01:00
Karl Persson beaac3c885 Zanzana: Remove model and store initiation from client (#95328)
* Remove model and store initiation from client
2024-10-25 09:31:27 +02:00
Karl Persson 4083b2208e Zanzana: periodic sync of team members (#94752)
* Rewrite zanzana collector to fetch all available pages

* Register access control as a background service

* If zanzana is enabled we run Syncs and start Reconciliation job

* Update pkg/services/authz/zanzana/client/client.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Use server lock when doing performing reconciliation
2024-10-17 15:28:33 +02:00
Alexander Zobnin 5d724c2482 Zanzana: Initial dashboard search (#93093)
* Zanzana: Search in a background and compare results

* refactor

* Search with check

* instrument zanzana client

* add single_read option

* refactor

* refactor move check into separate function

* Fix tests

* refactor

* refactor getFindDashboardsFn

* add resource type to span attributes

* run ListObjects concurrently

* Use list and search in less cases

* adjust metrics buckets

* refactor: move Check and ListObjects to AccessControl implementation

* Revert "Fix tests"

This reverts commit b0c2f072a2.

* refactor: use own types for Check and ListObjects inside accesscontrol package

* Fix search scenario with low limit and empty query string

* more accurate search with checks

* revert

* fix linter

* Revert "revert"

This reverts commit ee5f14eea8.

* add search errors metric

* fix query performance under some conditions

* simplify check strategy

* fix pagination

* refactor findDashboardsZanzanaList

* Iterate over multiple pages while making check request

* refactor listUserResources

* avoid unnecessary db call

* remove unused zclient

* Add notes for SkipAccessControlFilter

* use more accurate check loop

* always use check for search with provided UIDs

* rename single_read to zanzana_only_evaluation

* refactor

* update go workspace

* fix linter

* don't use deprecated fields

* refactor

* fail if no org specified

* refactor

* initial integration tests

* Fix tests

* fix linter errors

* fix linter

* Fix tests

* review suggestions

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix limit

* refactor

* refactor tests

* fix db config in tests

* fix migrator (postgres)

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2024-10-04 12:27:10 +02:00
Dave Henderson df3d8915ba Chore: Bump Go to 1.23.0 (#92105)
* chore: Bump Go to 1.23.0

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* update swagger files

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* chore: update .bingo/README.md formatting to satisfy prettier

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* chore(lint): Fix new lint errors found by golangci-lint 1.60.1 and Go 1.23

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* keep golden file

* update openapi

* add name to expected output

* chore(lint): rearrange imports to a sensible order

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2024-08-21 11:40:42 -04:00
Alexander Zobnin 87c4f2448c Zanzana: Use modular schema (#92001)
* Zanzana: Use modular schema

* Fix tests

* Add module transform tests
2024-08-19 11:10:51 +02:00
Karl Persson c04be62b65 Zanzana: client integration test (#89997)
* Restructure

* Zanzana: Add integration tests for client

* skip mysql 5.7 integration tests
2024-07-04 11:23:48 +02:00
Karl Persson e568b86ac0 Zanzana: Initial work to allow partial data migrations (#89919)
* Zanana: Add Write method to interface

* Zanzana: Add utilities for translating RBAC to openFGA tuple keys

* RBAC: Add zanzana synchronizer

* Run zanzana sync in access controll provider
2024-07-02 14:45:25 +02:00
Alexander Zobnin 190892bc88 Zanzana: Initial schema loading (#89492)
* Zanzana: Dummy schema loading

* Load authorzation model for client

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-06-27 13:57:06 +02:00