546 Commits

Author SHA1 Message Date
1bd9541507 FrontendService: Add tracing and logging middleware (#107956)
* FrontendService: Add tracing and logging middleware

* tests!

* middleware tests

* context middleware test

* revert http_server back to previous version

* fix lint

* fix test

* use http.NotFound instead of custom http handler

* use existing tracer for package

* use otel/trace.Tracer in request_tracing middleware

* tidy up tracing in contextMiddleware

* fix 404 test

* remove spans from contextMiddleware

* comment
2025-07-22 18:55:44 +01:00
4669b586e9 Security: Fixes for CVE-2025-6197 and CVE-2025-6023 (#108330)
apply security patch: main/439-202506251632.patch

(cherry picked from commit 7f3977c54548dc82d9b2c44c125b30b3dbc2069a)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-07-18 09:06:26 -06:00
759aa12d2b Revert "Build swagger ui in seperate webpack build" (#104580)
Revert "Build swagger ui in seperate webpack build (#102046)"

This reverts commit 314e337d76df9adcecfd30f4a302fa9d73e56da9.
2025-04-25 22:07:43 +01:00
314e337d76 Build swagger ui in seperate webpack build (#102046)
* Build swagger ui in seperate webpack build

* render grafana and swagger

* include light theme

* merge main

* update webassets usage

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2025-04-25 14:22:57 +01:00
7b492d7e16 FEMT: Add feature toggle and expose the service in regular grafana (#104428) 2025-04-25 12:24:25 +03:00
3320dc116e skip trace for '/api/health' endpoint (#103430)
* skip trace for '/api/health' endpoint

* fix formatting

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
2025-04-15 15:47:58 -04:00
757be6365a CI: Bump golangci-lint to 2.0.2 (#103572) 2025-04-10 14:42:23 +02:00
f3fb9592da Org redirection: Fix linking between orgs (#102021)
* don't trim path

* add unit test
2025-03-13 09:42:12 +00:00
3539764008 Hackaton: Add more unit tests, take 3 (#101525)
* serviceaccounts/secretscan: test Service more thoroughly

* middleware/cookies: add tests for CookieOptions

* anonymous/anonimpl: cover a couple more methods

* components/imguploader: Implement WebDAV integration tests

* components/apikeygen: also check IsValid method

* bus: cover invalid callback signature cases

* cloudmigration/objectstorage: add basic unit tests

* login/social/connectors: add test case for GitHub OAuth fetch emails+orgs

* expr/classic: cover more evaluator types in tests
2025-03-05 08:00:12 +01:00
f3433fd472 RBAC: Remove accessControlOnCall feature toggle (#101222)
* RBAC: Remove accessControlOnCall feature toggle

* Leave the other one in place

* Tests

* frontend

* Readd empty ft to frontend test

* Remove legacy RBAC check

* Fix test

* no need for context

* Remove unused variable

* Remove unecessary param

* remove unecessary param from tests

* More tests :D
2025-02-25 13:44:40 +01:00
ea788975e0 K8s: refactor build handler chain func to allow easier injection from enterprise (#100777) 2025-02-15 04:08:00 +02:00
680e6bc1f8 Authlib: Use types package rather than claims (#99243) 2025-01-21 12:06:55 +03:00
4477cad1ba Org: Fix redirection logic to work consistently (#96521)
fix unexpected redirection
2024-12-17 14:20:18 +00:00
Jo
40d3b02648 Auth: Separate anonymous settings to its own struct (#97791)
separate anonymous settings to its own struct
2024-12-13 10:46:27 +01:00
5039725da6 Snapshots: Add RBAC roles for creating and deleting (#96126) 2024-11-26 09:13:17 -03:00
89e7e25b60 Backend: Inject server-timing header to match initial loads with client-side telemetry (#94978)
feat: inject server-timing header to match initial loads with client-side telemetry

Faro Web SDK can read the server-timing info and
correlate the initial request with the client side telemetry gather from navigation timings.
2024-11-19 10:01:58 +02:00
0539ccf10d Auth: Fix redirection when auto_login is enabled (#94311)
* Fix for SAML auto login

* Fix for OAuth auto login
2024-10-07 14:59:00 +02:00
d411ce2664 Auth: Use sessionStorage instead of cookie for automatic redirection (#92759)
* WIP: working as expected, has to be tested

* Rename query param, small changes

* Remove unused code

* Address feedback

* Cleanup

* Use the feature toggle to control the behaviour

* Use the toggle on the FE too

* Prevent the extra redirect/reload

 Co-authored-by: Josh Hunt <joshhunt@users.noreply.github.com>

* Return to login if user is not authenticated

* Add tracking issue

* Align BE redirect constructor to locationSvc
2024-09-24 18:38:09 +02:00
715ee35abc RBAC: Check forceLogin inside CanAdminPlugins (#93449) 2024-09-20 09:35:58 -04:00
e2bce38a79 App Plugins: Allow resource handle to define Cache-Control Header (#92559) 2024-09-17 10:28:38 +02:00
f64b121ddb Canvas: Allow API calls to grafana origin (#91822)
* allow post URL
* check for config
* allow relative paths
* add allowed internal pattern; add checks for method
* update defaults.ini
* add custom header
* update config comment
* use globbing, switch to older middleware - deprecated call
* add codeowner
* update to use current api, add test
* update fall through logic

* Update pkg/middleware/validate_action_url.go

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update pkg/middleware/validate_action_url.go

Co-authored-by: Dan Cech <dcech@grafana.com>

* add more tests

* Update pkg/middleware/validate_action_url_test.go

Co-authored-by: Dan Cech <dcech@grafana.com>

* fix request headers

* add additional tests for all verbs

* fix request headers++

* throw error when method is unknown

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Brian Gann <bkgann@gmail.com>
Co-authored-by: Brian Gann <briangann@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
2024-09-10 10:45:27 -04:00
733ae1f099 Chore: Skip gzip for apiserver routes (#92245) 2024-08-21 23:47:58 +03:00
8bcd9c2594 Identity: Remove typed id (#91801)
* Refactor identity struct to store type in separate field

* Update ResolveIdentity to take string representation of typedID

* Add IsIdentityType to requester interface

* Use IsIdentityType from interface

* Remove usage of TypedID

* Remote typedID struct

* fix GetInternalID
2024-08-13 10:18:28 +02:00
c326d865c5 RBAC: Allow plugins to use scoped actions (#90946)
Co-authored-by: gamab <gabriel.mabille@grafana.com>
2024-07-25 17:22:42 +03:00
9db3bc926e Identity: Rename "namespace" to "type" in the requester interface (#90567) 2024-07-25 12:52:14 +03:00
c210617735 K8s: use contexthandler in standalone handler chain (#90102) 2024-07-08 12:22:10 -07:00
7ac757afcb infra(tracing): Fix span naming order-of-operations bug (#90025) 2024-07-04 07:05:14 -04:00
4ec4994e89 infra(tracing): Always end started spans (#90016)
Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
2024-07-03 16:25:57 -04:00
04f39457cf Chore: Remove sensitive information from presigned URLs prior to logging (#87035)
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>
2024-06-24 14:53:42 +02:00
3bbc821131 Metrics: Add ability to disable classic histogram for HTTP metric (#88315)
metrics: Add ability to disable classic histogram for HTTP metric

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
2024-06-18 15:37:44 -04:00
99d8025829 Chore: Move identity and errutil to apimachinery module (#89116) 2024-06-13 07:11:35 +03:00
4761326568 Fix: Proper plugin logo loading depending on staging (#88247)
* making logos respect the staging

* making it work when served from subfolders

* fixing helper test
2024-05-27 10:26:30 +02:00
c4cfee8d96 User: support setting org and help flags though update function (#86535)
* User: Support setting active org through update function

* User: add support to update help flags through update function
2024-04-29 08:53:05 +02:00
0fa983ad8e AuthN: Use typed namespace id inside authn package (#86048)
* authn: Use typed namespace id inside package
2024-04-24 09:57:34 +02:00
44e1bce55a Feature toggles: Remove dashboardEmbed toggle (#86587) 2024-04-19 12:48:08 +02:00
0913324668 Chore: Remove repetitive words (#84132)
remove repetitive words

Signed-off-by: carrychair <linghuchong404@gmail.com>
2024-03-11 08:55:18 -04:00
96dfb385ca Grafana: Replace magic number with a constant variable in response status (#80132)
* Chore: Replace response status with const var

* Apply suggestions from code review

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>

* Add net/http import

---------

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
2024-02-27 18:39:51 +02:00
8f36f905ee SceneSolo: Minor fixes (#82289)
* SceneSolo: Minor fixes

* remove logging
2024-02-12 16:23:12 +01:00
c9de794d7f instrumentation: these features have been enabled for a while (#81617)
Signed-off-by: bergquist <carl.bergquist@gmail.com>
2024-02-06 00:29:41 -08:00
6768c6c059 Chore: Remove public vars in setting package (#81018)
Removes the public variable setting.SecretKey plus some other ones. 
Introduces some new functions for creating setting.Cfg.
2024-01-23 12:36:22 +01:00
e924627659 Frontend: Reload the browser when backend configuration/assets change (#79057)
* Detect frontend asset changes

* Update

* merge main

* Frontend: Detect new assets / versions / config changes (#79258)

* avoid first check

* Updates and add tests

* Update

* Update

* Updated code

* refine

* use context

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2024-01-04 08:00:07 +01:00
0b511aaace Plugins: Add backend check for app page role access (#78269)
* add backend check for roles

* tidy

* fix tests

* incorporate rbac

* fix linter

* apply PR feedback

* add tests

* fix logic

* add comment

* apply PR feedback
2023-12-18 16:12:46 +01:00
864d91ed3e Export: Remove no-store headers in pdf and image previews (#78844) 2023-12-18 09:21:57 -03:00
ed128ea964 Frontend: Foundations for multi tenant frontend (#78815)
* Frontend: Foundations for multi tenant frontend

* improve manifest parsing for multi-tenant frontend (#78876)

* add test

* add test

* ??

* Updates

* Added cache

* test cleanup

* lint

* fix test

* fix error templates

* cleanup

* remove copy

* revert changes to list testdata

* comment cleanup

* prepare integration tests

* Remove integrety

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2023-12-05 08:34:22 +01:00
4c4f11f4b3 Avatar: Allow browser caching of /avatar/ (#78314)
don't set no-store headers to /avatar/
2023-11-22 17:41:54 +01:00
f69fd3726b FeatureToggles: Add context and and an explicit global check (#78081) 2023-11-14 12:50:27 -08:00
420fb56fda RBAC: Fix plugins pages access-control (#76321)
* RBAC: Fix plugins pages access-control

* Better comment

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Add a small comment on connections/datasources routes

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2023-10-12 10:46:43 +02:00
Jo
dcd0c6b11e Identity: Unfurl OrgID in pkg/services to allow using identity.Requester interface (#76113)
Unfurl OrgID in pkg/services to allow using identity.Requester interface
2023-10-09 10:40:19 +02:00
0fc403d116 Instrumentation: Enable native histograms for HTTP requests (#75731)
Signed-off-by: bergquist <carl.bergquist@gmail.com>
2023-10-03 20:23:55 +02:00
e4c1a7a141 Tracing: Standardize on otel tracing (#75528) 2023-10-03 14:54:20 +02:00