4982ca3b1d
* Add actions and scopes * add resource service for dashboard and folder * Add dashboard guardian with fgac permission evaluation * Add CanDelete function to guardian interface * Add CanDelete property to folder and dashboard dto and set values * change to correct function name * Add accesscontrol to folder endpoints * add access control to dashboard endpoints * check access for nav links * Add fixed roles for dashboard and folders * use correct package * add hack to override guardian Constructor if accesscontrol is enabled * Add services * Add function to handle api backward compatability * Add permissionServices to HttpServer * Set permission when new dashboard is created * Add default permission when creating new dashboard * Set default permission when creating folder and dashboard * Add access control filter for dashboard search * Add to accept list * Add accesscontrol to dashboardimport * Disable access control in tests * Add check to see if user is allow to create a dashboard * Use SetPermissions * Use function to set several permissions at once * remove permissions for folder and dashboard on delete * update required permission * set permission for provisioning * Add CanCreate to dashboard guardian and set correct permisisons for provisioning * Dont set admin on folder / dashboard creation * Add dashboard and folder permission migrations * Add tests for CanCreate * Add roles and update descriptions * Solve uid to id for dashboard and folder permissions * Add folder and dashboard actions to permission filter * Handle viewer_can_edit flag * set folder and dashboard permissions services * Add dashboard permissions when importing a new dashboard * Set access control permissions on provisioning * Pass feature flags and only set permissions if access control is enabled * only add default permissions for folders and dashboards without folders * Batch create permissions in migrations * Remove `dashboards:edit` action * Remove unused function from interface * Update pkg/services/guardian/accesscontrol_guardian_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
154 lines
5.2 KiB
Go
154 lines
5.2 KiB
Go
package dashboards
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/grafana/grafana/pkg/infra/log"
|
|
"github.com/grafana/grafana/pkg/models"
|
|
"github.com/grafana/grafana/pkg/services/accesscontrol"
|
|
"github.com/grafana/grafana/pkg/services/dashboards"
|
|
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
|
"github.com/grafana/grafana/pkg/services/provisioning/utils"
|
|
"github.com/grafana/grafana/pkg/util/errutil"
|
|
)
|
|
|
|
// DashboardProvisioner is responsible for syncing dashboard from disk to
|
|
// Grafana's database.
|
|
type DashboardProvisioner interface {
|
|
Provision(ctx context.Context) error
|
|
PollChanges(ctx context.Context)
|
|
GetProvisionerResolvedPath(name string) string
|
|
GetAllowUIUpdatesFromConfig(name string) bool
|
|
CleanUpOrphanedDashboards(ctx context.Context)
|
|
}
|
|
|
|
// DashboardProvisionerFactory creates DashboardProvisioners based on input
|
|
type DashboardProvisionerFactory func(
|
|
context.Context, string, dashboards.DashboardProvisioningService, utils.OrgStore,
|
|
featuremgmt.FeatureToggles, accesscontrol.PermissionsServices,
|
|
) (DashboardProvisioner, error)
|
|
|
|
// Provisioner is responsible for syncing dashboard from disk to Grafana's database.
|
|
type Provisioner struct {
|
|
log log.Logger
|
|
fileReaders []*FileReader
|
|
configs []*config
|
|
duplicateValidator duplicateValidator
|
|
provisioner dashboards.DashboardProvisioningService
|
|
}
|
|
|
|
// New returns a new DashboardProvisioner
|
|
func New(
|
|
ctx context.Context, configDirectory string, provisioner dashboards.DashboardProvisioningService, orgStore utils.OrgStore,
|
|
features featuremgmt.FeatureToggles, permissionsServices accesscontrol.PermissionsServices,
|
|
) (DashboardProvisioner, error) {
|
|
logger := log.New("provisioning.dashboard")
|
|
cfgReader := &configReader{path: configDirectory, log: logger, orgStore: orgStore}
|
|
configs, err := cfgReader.readConfig(ctx)
|
|
if err != nil {
|
|
return nil, errutil.Wrap("Failed to read dashboards config", err)
|
|
}
|
|
|
|
fileReaders, err := getFileReaders(configs, logger, provisioner, features, permissionsServices)
|
|
if err != nil {
|
|
return nil, errutil.Wrap("Failed to initialize file readers", err)
|
|
}
|
|
|
|
d := &Provisioner{
|
|
log: logger,
|
|
fileReaders: fileReaders,
|
|
configs: configs,
|
|
duplicateValidator: newDuplicateValidator(logger, fileReaders),
|
|
provisioner: provisioner,
|
|
}
|
|
|
|
return d, nil
|
|
}
|
|
|
|
// Provision scans the disk for dashboards and updates
|
|
// the database with the latest versions of those dashboards.
|
|
func (provider *Provisioner) Provision(ctx context.Context) error {
|
|
for _, reader := range provider.fileReaders {
|
|
if err := reader.walkDisk(ctx); err != nil {
|
|
if os.IsNotExist(err) {
|
|
// don't stop the provisioning service in case the folder is missing. The folder can appear after the startup
|
|
provider.log.Warn("Failed to provision config", "name", reader.Cfg.Name, "error", err)
|
|
return nil
|
|
}
|
|
|
|
return errutil.Wrapf(err, "Failed to provision config %v", reader.Cfg.Name)
|
|
}
|
|
}
|
|
|
|
provider.duplicateValidator.validate()
|
|
return nil
|
|
}
|
|
|
|
// CleanUpOrphanedDashboards deletes provisioned dashboards missing a linked reader.
|
|
func (provider *Provisioner) CleanUpOrphanedDashboards(ctx context.Context) {
|
|
currentReaders := make([]string, len(provider.fileReaders))
|
|
|
|
for index, reader := range provider.fileReaders {
|
|
currentReaders[index] = reader.Cfg.Name
|
|
}
|
|
|
|
if err := provider.provisioner.DeleteOrphanedProvisionedDashboards(ctx, &models.DeleteOrphanedProvisionedDashboardsCommand{ReaderNames: currentReaders}); err != nil {
|
|
provider.log.Warn("Failed to delete orphaned provisioned dashboards", "err", err)
|
|
}
|
|
}
|
|
|
|
// PollChanges starts polling for changes in dashboard definition files. It creates a goroutine for each provider
|
|
// defined in the config.
|
|
func (provider *Provisioner) PollChanges(ctx context.Context) {
|
|
for _, reader := range provider.fileReaders {
|
|
go reader.pollChanges(ctx)
|
|
}
|
|
|
|
go provider.duplicateValidator.Run(ctx)
|
|
}
|
|
|
|
// GetProvisionerResolvedPath returns resolved path for the specified provisioner name. Can be used to generate
|
|
// relative path to provisioning file from it's external_id.
|
|
func (provider *Provisioner) GetProvisionerResolvedPath(name string) string {
|
|
for _, reader := range provider.fileReaders {
|
|
if reader.Cfg.Name == name {
|
|
return reader.resolvedPath()
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// GetAllowUIUpdatesFromConfig return if a dashboard provisioner allows updates from the UI
|
|
func (provider *Provisioner) GetAllowUIUpdatesFromConfig(name string) bool {
|
|
for _, config := range provider.configs {
|
|
if config.Name == name {
|
|
return config.AllowUIUpdates
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func getFileReaders(
|
|
configs []*config, logger log.Logger, service dashboards.DashboardProvisioningService,
|
|
features featuremgmt.FeatureToggles, permissionsServices accesscontrol.PermissionsServices,
|
|
) ([]*FileReader, error) {
|
|
var readers []*FileReader
|
|
|
|
for _, config := range configs {
|
|
switch config.Type {
|
|
case "file":
|
|
fileReader, err := NewDashboardFileReader(config, logger.New("type", config.Type, "name", config.Name), service, features, permissionsServices)
|
|
if err != nil {
|
|
return nil, errutil.Wrapf(err, "Failed to create file reader for config %v", config.Name)
|
|
}
|
|
readers = append(readers, fileReader)
|
|
default:
|
|
return nil, fmt.Errorf("type %s is not supported", config.Type)
|
|
}
|
|
}
|
|
|
|
return readers, nil
|
|
}
|