37 Commits

Author SHA1 Message Date
2edfbb7767 sqlstore split: dashboard permissions (#49962)
* backend/sqlstore split: remove unused GetDashboardPermissionsForUser from sqlstore
* remove debugging line
* backend/sqlstore: move dashboard permission related functions to dashboard service
2022-06-01 14:16:26 -04:00
8c753999df chore: replace artisanal FakeDashboardService with generated mock (#49276)
* chore: replace handmade FakeDashboardService with generated mock

Maintaining a handcrafted FakeDashboardService is not sustainable now that we are in the process of moving the dashboard-related functions out of sqlstore.

* remove dialect global variable
2022-05-23 11:14:27 -04:00
1df340ff28 backend/services: Move GetDashboard from sqlstore to dashboard service (#48971)
* rename folder to match package name
* backend/sqlstore: move GetDashboard into DashboardService

This is a stepping-stone commit which copies the GetDashboard function - which lets us remove the sqlstore from the interfaces in dashboards - without changing any other callers.
* checkpoint: moving GetDashboard calls into dashboard service
* finish refactoring api tests for dashboardService.GetDashboard
2022-05-17 14:52:22 -04:00
3d922a4e67 AnnotationsApi: GET /api/annotations/:annotationId (#47739) 2022-05-16 17:16:36 +02:00
bde368be55 Chore : Replace dashboardid with dashboardUID in annotation API (#48481)
* replace dashboardid with dashboardUID in annotation API

* add some tests

* modify some docs and add uid into get endpoint

* rebase with main

* add map for avoiding too much retrieve on dashboards
2022-05-02 11:35:36 +02:00
de50f39c12 Access Control: Refactor scope resolvers with support to resolve into several scopes (#48202)
* Refactor Scope resolver to support resolving into several scopes

* Change permission evaluator to match at least one of passed scopes
2022-05-02 09:29:30 +02:00
a0553de8dd Rename FGAC to RBAC in the codebase (#48051) 2022-04-21 14:31:02 +02:00
1588cd393a check that the user has RBAC permissions to save dashboard annotation (#47882) 2022-04-20 09:43:42 +02:00
18e93c7077 Chore: Remove bus (#47511)
* Chore: Remove bus

* remove unused const
2022-04-08 16:15:06 +02:00
bc9b5325a0 update docs, simplify actions and scopes (#47067) 2022-04-04 13:53:58 +01:00
90f2233ea9 Chore: Remove global database engine variable from annotation (#46940)
* Chore: Remove global database engine variable from annotation

* 💩
2022-03-25 13:23:09 -04:00
c5f295b5b3 Access Control: adding FGAC validation to mass delete annotation endpoint (#46846)
* Access Control: adding FGAC validation to mass delete annotation endpoint
2022-03-23 18:39:00 -03:00
adc0cbf176 remove global variable in annotation (#46746)
* remove global varaible in annotation

* remove todo

* replace intransaction with withdbtransaction

* fix typo
2022-03-22 19:20:57 +08:00
c717320942 Adding FGAC annotations validation for creation and deletion (#46736)
Access Control: Adding FGAC annotations validation for creation and deletion
Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>
2022-03-21 14:28:39 -03:00
fec634a091 Chore: Remove bus.Dispatch from guardian package (#46711)
* replace bus in guardian with sqlstore

* fix a couple of tests

* replace bus in the rest of the tests

* allow init guardian from other packages

* make linter happy

* init guardian in library elements

* fix another test in libraryelements

* fix more tests

* move guardian mock one level deeper

* fix more tests

* rename init functions
2022-03-21 10:49:49 +01:00
f2450575b3 Access control: FGAC for annotation updates (#46462)
* proposal

* PR feedback

* fix canSave bug

* update scope naming

* linting

* linting

Co-authored-by: Ezequiel Victorero <ezequiel.victorero@grafana.com>
2022-03-18 17:33:21 +01:00
4f815e3d8e Access control: adding FGAC to annotation GET endpoints and fixed roles (#45102)
* Access control: adding FGAC to annotation GET endpoints and fixed roles

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2022-02-11 15:43:29 -03:00
605d056136 Security: Sync security changes on main (#45083)
* * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search
* Teams: Ensure that users searching for teams are only able see teams they have access to
* Teams: Require teamGuardian admin privileges to list team members
* Teams: Prevent org viewers from administering teams
* Teams: Add org_id condition to team count query
* Teams: clarify permission requirements in teams api docs
* Teams: expand scenarios for team search tests
* Teams: mock teamGuardian in tests

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove duplicate WHERE statement

* Fix for CVE-2022-21702

(cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e)

* Lint and test fixes

(cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981)

* check content type properly

(cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98)

* basic csrf origin check

(cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1)

* compare origin to host

(cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42)

* simplify url parsing

(cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d)

* check csrf for GET requests, only compare origin

(cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709)

* parse content type properly

(cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0)

* mentioned get in the comment

(cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345)

* add content-type: application/json to test HTTP requests

* fix pluginproxy test

* Fix linter when comparing errors

Co-authored-by: Kevin Minehart <kmineh0151@gmail.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
2022-02-09 13:44:38 +01:00
1b286e6bb5 Remove bus from quota, preferences, plugins, user_token (#44762)
* Remove bus from quota, preferences, plugins, user_token

* Bind sqlstore.Store to *sqlstore.SQLStore

* Fix test

* Fix sqlstore wire injection, dependency
2022-02-03 09:20:20 +01:00
7936c4c522 Rename AddHandlerCtx to AddHandler (#43557) 2021-12-28 16:08:07 +01:00
e6123bc3ef Replace AddHandler with AddHandlerCtx in tests (#42585) 2021-12-01 15:43:31 +01:00
d9cdcb550e Chore: Refactor api handlers to use web.Bind (#42199)
* Chore: Refactor api handlers to use web.Bind

* fix comments

* fix comment

* trying to fix most of the tests and force routing.Wrap type check

* fix library panels tests

* fix frontend logging tests

* allow passing nil as a response to skip writing

* return nil instead of the response

* rewrite login handler function types

* remove handlerFuncCtx

* make linter happy

* remove old bindings from the libraryelements

* restore comments
2021-11-29 10:18:01 +01:00
63f9231de1 Annotations: Adds tags endpoint (#36199)
* Annotations: Adds tags endpoint

* Chore: fixes sql  statement

* Refactor: adds count to the api

* Chore: changes after PR comments

* Refactor: changes after PR comments
2021-06-30 13:42:54 +02:00
3d41267fc4 Chore: Moves common and response into separate packages (#30298)
* Chore: moves common and response into separate packages

* Chore: moves common and response into separate packages

* Update pkg/api/utils/common.go

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>

* Chore: changes after PR comments

* Chore: move wrap to routing package

* Chore: move functions in common to response package

* Chore: move functions in common to response package

* Chore: formats imports

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
2021-01-15 14:43:20 +01:00
cb62e69997 Chore: Convert API tests to standard Go lib (#29009)
* Chore: Convert tests to standard Go lib

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
2020-11-13 09:52:38 +01:00
3fdd2648b1 Chore: Avoid aliasing importing models in api package (#22492) 2020-03-04 12:57:20 +01:00
6335509a23 Annotations: use a single row to represent a region (#17673)
* SQLite migrations

* cleanup

* migrate end times

* switch to update with a query

* real migration

* anno migrations

* remove old docs

* set isRegion from time changes

* use <> for is not

* add comment and fix index decleration

* single validation place

* add test

* fix test

* add upgrading docs

* use AnnotationEvent

* fix import

* remove regionId from typescript
2019-08-16 10:49:30 +02:00
a7a964ec19 Added PATCH verb end point for annotation op
Added new PATCH verb annotation endpoint

Removed unwanted fmt

Added test cases for PATCH verb annotation endpoint

Fixed formatting issue

Check arr len before proceeding

Updated doc to include PATCH verb annotation endpt
2019-02-05 09:43:17 +10:00
c03764ff8a Refactor team pages to react & design change (#12574)
* Rewriting team pages in react

* teams to react progress

* teams: getting team by id returns same DTO as search, needed for AvatarUrl

* teams: progress on new team pages

* fix: team test

* listing team members and removing team members now works

* teams: team member page now works

* ux: fixed adding team member issue

* refactoring TeamPicker to conform to react coding styles better

* teams: very close to being done with team page rewrite

* minor style tweak

* ux: polish to team pages

* feature: team pages in react & everything working

* fix: removed flickering when changing tabs by always rendering PageHeader
2018-07-11 11:23:07 -07:00
5e08bf5130 test: fixed usage of wrap in tests. 2018-07-02 17:13:59 +02:00
eb4d860fcb Light improve of massive delete annotation api (#12390)
* fix delete annotations

* fix self assignment

* add right unit test using admin role
2018-06-25 04:58:49 -07:00
0a415c50d0 Make golint happier 2018-03-22 22:38:44 +01:00
c0ecdee375 rename Context to ReqContext 2018-03-07 11:54:50 -05:00
338655dd37 move Context and session out of middleware 2018-03-06 18:16:49 -05:00
a00a42d9ee api: extract api test code to common_test.go 2018-01-30 13:17:48 +01:00
b7f023bc26 fix gofmt warning 2018-01-09 14:44:36 +01:00
3ae1bf0c16 dashfolders: permissions for saving annotations
ref #10275 Use folder permissions instead of hard coded
permissions on the annotations routes.
2018-01-09 14:44:36 +01:00