Folders: Add admin permissions upon creation of a folder w. SA (#95072)
* add admin permissions upon creation of a folder w. SA
* Update pkg/services/folder/folderimpl/folder.go
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
* Grant service account permissions for creation of dashboards
* Grant service account admin permissions upon creating a datasource
* fetch user using the userservice with the userid
* Revert "fetch user using the userservice with the userid"
This reverts commit 23cba78752.
* revert back to original datasource creation
---------
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
(cherry picked from commit 9ab064bfc5)
* Fix: Deduplicate OrgID in SA logins (#94378)
* Fix: Deduplicate OrgID in SA logins
(cherry picked from commit b90e09e966)
* Fix: Actually call the DedupOrgInLogin migration (#94520)
* Fix: Account for conflicting logins in dedupOrgInlogin migration (#94669)
---------
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Azure: Fix duplicated traces in multi-resource trace query (#95156)
Use first resource as base resource for query
(cherry picked from commit 8bb7475e4f)
Co-authored-by: Andreas Christou <andreas.christou@grafana.com>
Migration: Remove table aliasing in delete statement to make it work for mariadb (#95226)
Migration: remove table aliasing in delete statement to make it work in mariadb
(cherry picked from commit 6f7528f896)
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
CI: Support more version formats in publishing (#94575)
* cleanup dead code
* add tests and rewrite publish grafanacom steps to reuse
* add pkg/build tests; don't upload CDN assets on grafana releases
(cherry picked from commit 7a2edd35d5)
GCM: Time field naming (#94548)
* Name time field correctly
* Update tests
* Lint
(cherry picked from commit 7c79f8f7a5)
Co-authored-by: Andreas Christou <andreas.christou@grafana.com>
Fix: Ensure SA migrations doesn't hit migrated SAs if rerun (#94347)
* ensure mig doesn't hit migrated SAs if rerun
* Fix small issue with the test
---------
Co-authored-by: gamab <gabriel.mabille@grafana.com>
(cherry picked from commit 945dd052b1)
Co-authored-by: Jo <joao.guerreiro@grafana.com>
ServiceAccounts: Run migration in batches (#94429)
* ServiceAccounts: Run migration in batches
(cherry picked from commit 2d0ea60017)
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
ServiceAccounts: Remove permissions to service account when it is deleted (#93877)
* Service account: clean up permissions related to service accounts when deleted
* Add migration for deleting orphaned service account permissions
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
(cherry picked from commit c7ca2bfcf5)
Canvas: Allow API calls to grafana origin (#91822)
* allow post URL
* check for config
* allow relative paths
* add allowed internal pattern; add checks for method
* update defaults.ini
* add custom header
* update config comment
* use globbing, switch to older middleware - deprecated call
* add codeowner
* update to use current api, add test
* update fall through logic
* Update pkg/middleware/validate_action_url.go
Co-authored-by: Dan Cech <dcech@grafana.com>
* Update pkg/middleware/validate_action_url.go
Co-authored-by: Dan Cech <dcech@grafana.com>
* add more tests
* Update pkg/middleware/validate_action_url_test.go
Co-authored-by: Dan Cech <dcech@grafana.com>
* fix request headers
* add additional tests for all verbs
* fix request headers++
* throw error when method is unknown
---------
Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Brian Gann <bkgann@gmail.com>
Co-authored-by: Brian Gann <briangann@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
(cherry picked from commit f64b121ddb)
Co-authored-by: Adela Almasan <88068998+adela-almasan@users.noreply.github.com>
Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] (#93940)
Fix endpoint permission on rule write endpoint
(cherry picked from commit c2799b4901)
Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
Correlations: Limit access to correlations page to users who can access Explore (#93519)
Correlations: Limit access to correlations page to users who can access Explore
(cherry picked from commit 813e1c1364)
Co-authored-by: Piotr Jamróz <pm.jamroz@gmail.com>
Annotations: Optimize search by tags (#93547)
* Annotations: Optimize search on large number of dashboards
* refactor
* fix batch size
* Return early if no annotations found
* revert go.mod
* return nil in case of error
* Move default limit to the API package
* fix empty access control filter
* Set default limit to 100
* optimize query when number of annotations is less than limit
* Update pkg/services/annotations/annotationsimpl/annotations.go
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* remove limit from store since it's set in API
* set default limit in Find method (do not break tests)
* Only add limit to the query if it's set
* use limit trick for all searches without dashboard filter
* set default page if not provided
---------
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
(cherry picked from commit 5e713673e1)
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
CloudMigrations: improve nil handling (#93257)
* CloudMigrations: fail token decryption if session is not found or without a token
* CloudMigrations: do not report event if session is nil
(cherry picked from commit 4f21ecf982)
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
Cloud migrations: GetSnapshotList only returns snapshots that belong to a session that exists (#91798)
* Cloud migrations: GetSnapshotList only returns snapshots that belong to a session that exists
* Cloud migrations: test GetSnapshotList
* add one more test case for GetSnapshotList
* fix test
* store encryption key for testing
(cherry picked from commit 90b44fdcbf)
Co-authored-by: Bruno <brunotj2015@hotmail.com>
CloudMigrations: Fix snapshot creation on Windows systems (#92941)
* cloudmigration: improve error logging stringify body
* deps: update migration snapshot library to v1.3.0 (fix to Windows)
(cherry picked from commit 95ef2a1eb2)
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
RBAC: Always store action sets (#92833)
always store action sets, even if FT is disabled
(cherry picked from commit 46e81e98cf)
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
IAM docs: Transform `API keys` to `Migrate API keys` docs (#92380)
* IAM docs: Transform `API keys` to `Migrate API keys` docs
* Update links to `API keys` in other doc pages
* Grafana UI: update help button link
* Update OpenAPI/Swagger links
* Update docs/sources/administration/service-accounts/migrate-api-keys.md
Co-authored-by: Jack Baldry <jack.baldry@grafana.com>
* Update `relref` links to the new URL
* fix space before em dash
spaces before or after em dashes are not recommended (https://developers.google.com/style/dashes)
---------
Co-authored-by: Jack Baldry <jack.baldry@grafana.com>
Co-authored-by: Irene Rodriguez <irene.rodriguez@grafana.com>
(cherry picked from commit 6a29e4aecf)
Authn: No longer hash service account token twice during authentication (#92598)
* APIKey: Only decode and hash token once during authentication
* Only update last used every 5 minutes
(cherry picked from commit 56487d37db)
Annotations: only set userID if caller is a user or service account (#91898)
* Ignore errors when extracting current user id
* Only set userID if caller is user or service account
* Fix patch api
(cherry picked from commit e9bb3b4d73)
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
QuotaService: refactor to use ReplDB for Get queries (#91333)
* Feature (quota service): Use ReplDB for quota service Gets
This adds the replDB to the quota service, as well as some more test helper functions to simplify updating tests. My intent is that the helper functions can be removed when this is fully rolled out (or not) and we're consistently using the ReplDB interface (or not!)
* test updates
(cherry picked from commit 299c142f6a)
Co-authored-by: Kristin Laemmert <mildwonkey@users.noreply.github.com>
