70 Commits

Author SHA1 Message Date
2cddaf0781 RBAC: Remove dashboard and folder guardians (#104646)
* replace usage of folder guardians with access control evaluators

* remove NewByFolderUID guardian

* bring up to date

* fix test

* more test fixes, and don't fetch the folder before evaluating lib element access

* change what error is returned

* fix alerting test

* try to fix linter errors

* replace the use of newByFolder guardian with direct access control evaluator checks

* remove newByFolder guardian

* get rid of dashboard and folder guardians

* undo unwanted change

* undo unwanted change

* undo unwanted change

* update code owners
2025-05-19 09:48:16 +03:00
e385237daf Access control: Make sure that user permission cache is cleared after new dashboard and folder creation (#104193)
* make sure that user permission cache is cleared after new dashboard and folder creation

* more test fixes

* Update pkg/services/dashboards/service/dashboard_service.go

* check identity type in SetDefaultPermissionsAfterCreate, set default permissions for service accounts

* set SA permissions for folders as well

* fix tests
2025-04-24 16:02:39 +03:00
d0d7078953 App Platform: Remove mutable globals (#102962)
* App Platform: Remove mutable globals

* chore: clarify why this exists

* fix: support multi-tenant mode

* refactor: call builder providers directly

* CI: Force re-build
2025-03-27 15:46:09 +01:00
543c0bbccb App platform: Add cleanup job for dashboards when going through /apis (kubectl) (#102506)
* Add dashboard cleanup job

Change log message

Adjust logic to account for new head RV logic

Don't update lastResourceVersion due to pagination

Save improvements

* Address review feedback

* Update docs.

* Remove docs

* Rename config

---------

Co-authored-by: Marco de Abreu <18629099+marcoabreu@users.noreply.github.com>
2025-03-22 23:47:27 +01:00
9264431c81 RBAC: Remove action set feature toggle (#101959)
* remove action set feature toggle

* don't pass feature toggles to action set service instantiation

* linting

* test fixes and frontend clean-up

* fix test
2025-03-13 15:18:23 +00:00
5a40c84568 DualWriter: Support managed DualWriter (#100881) 2025-02-19 17:50:39 +03:00
67be9aeed6 K8s: Search fallback: Support all sort by methods (#100776) 2025-02-18 12:30:11 -06:00
1856d47e47 Remove GetResourceClient hack from unified package. (#100636)
* Remove GetResourceClient hack from unified package.
2025-02-14 12:34:52 +01:00
df84d928e2 K8s: Folders: Fix legacy search (#100393) 2025-02-11 13:14:25 -06:00
5118e82e8c Zanzana: Run reconciliation in its own service (#100361)
* Zanzana: Start reconciliation in its own service

* cleanup

* update go workspaces

* refactor

* remove unused code

* move func definition
2025-02-11 14:09:39 +01:00
c85a175212 RBAC: only query folder service when fetching parent folders (#99893)
* only query folder service when fetching parent folders
* Perform validation and inehrited scopes solvers as service instead of caller
2025-02-03 13:56:25 +01:00
2d491a9367 K8s: Implement folder search (#99781) 2025-01-29 17:44:42 -06:00
a2097fbc2f Folders: Add user service to folder service implementation (#99518)
Add user service to folder service implementation
2025-01-27 14:29:47 +01:00
3a94057ec8 PublicDashboards: Delete on folder deletion (#99040) 2025-01-23 17:23:59 -03:00
192a81d07f Folders: Fix guardian to use folder service (#99339) 2025-01-23 10:30:14 -06:00
2622449718 Dashboards: Use dashboard service in access control (#99053) 2025-01-21 22:57:43 +02:00
cbb688e910 Zanzana: Remove usage from legacy access control (#98883)
* Zanzana: Remove usage from legacy access control

* remove unused

* remove zanzana client from services where it's not used

* remove unused metrics

* fix linter
2025-01-14 10:26:15 +01:00
766d645d82 Filewalkwithme/unistore refactor folder service to hit folder apiserver (#98409)
Refactor folder service to use Unified Storage

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
Co-authored-by: Stephanie Hingtgen <stephanie.hingtgen@grafana.com>
2025-01-13 18:15:35 -03:00
9488bf2915 Dashboards: use service for quotas (#98756) 2025-01-09 22:21:21 -07:00
6957e1f7b7 Folders: Replace sql query with folder service call when collecting folder tree (#98443)
* Replace sql query with folder service call when collecting folder tree
* Update provider for folder service implementation for wire
* Refactor provisioning of oss service in folder permissions test util
2025-01-07 09:53:09 +01:00
03f7a7d89d K8s: Dashboards: Add search to dashboard service (#98395) 2025-01-02 09:39:45 -06:00
d2639f6080 Ensure all internal Services are using FolderService and not FolderStore (#98370)
* Ensure all internal Services are using FolderService and not FolderStore

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>

---------

Signed-off-by: Maicon Costa <maiconscosta@gmail.com>
2024-12-30 13:48:35 -03:00
b3985a4d37 k8s: Dashboards: allow querying of unistore (#97995) 2024-12-17 10:35:46 -06:00
8f6e9f8ed0 Restores in app platform (#97582) 2024-12-13 16:55:43 -06:00
1366197522 Zanzana: Search with check server side (#96268)
* pass zclient into dashboard service

* Search then check implementation

* Use GetNamespace() for user

* remove unused orgID

* simple batch check

* refactor

* add tests

* fix batchCheckItem

* client implements batch check

* use batch check in search

* remove unused

* remove All field from response

* refactor: extract checkNamespace

* fix search result uniqueness

* comment fix

* Apply suggestions from code review

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* refactor

* cleanup

* remove unnecessary check

* fix tests

* fix protobuf def

* Fix query page

* fix type

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-11-18 14:01:28 +01:00
b12c731d59 Stars: Add dashboard_uid and org_id to table (#96408) 2024-11-15 09:51:31 -06:00
4083b2208e Zanzana: periodic sync of team members (#94752)
* Rewrite zanzana collector to fetch all available pages

* Register access control as a background service

* If zanzana is enabled we run Syncs and start Reconciliation job

* Update pkg/services/authz/zanzana/client/client.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Use server lock when doing performing reconciliation
2024-10-17 15:28:33 +02:00
e399fe6d09 Folders: Set folder creation permission as part of legacy create (#94040)
* Add folder store to dashboard permissions
* Include folder store in annotation scope resolver
* Add folder store when initialising library elements
* Include folder store in search v2 service initialisation
* Include folder store in GetInheritedScopes
* Add folder store to folder permissions provider
* Include cfg, folder permissions in folder service
* Move setting of folder permissions for folder service create method
2024-10-01 14:03:02 +02:00
ed75aea21d Folders: Export folder store implementation (#93897)
* Export folder store implementation

* Rename folder store

* Add folder store as a parameter to folder service

* Add folder store to dash service implementation

* Fix folder store comments
2024-09-30 10:28:47 +02:00
a21a232a8e Revert read replica POC (#93551)
* Revert "chore: add replDB to team service (#91799)"

This reverts commit c6ae2d7999aa6fc797db39e9d66c6fea70278f83.

* Revert "experiment: use read replica for Get and Find Dashboards (#91706)"

This reverts commit 54177ca619dbb5ded2dcb158405802d8dbdbc982.

* Revert "QuotaService: refactor to use ReplDB for Get queries (#91333)"

This reverts commit 299c142f6a6e8c5673cfdea9f87b56ac304f9834.

* Revert "refactor replCfg to look more like plugins/plugin config (#91142)"

This reverts commit ac0b4bb34d495914cbe8daad85b7c75c31e8070d.

* Revert "chore (replstore): fix registration with multiple sql drivers, again (#90990)"

This reverts commit daedb358dded00d349d9fac6106aaaa6bf18322e.

* Revert "Chore (sqlstore): add validation and testing for repl config (#90683)"

This reverts commit af19f039b62d9945377292a8e679ee258fd56b3d.

* Revert "ReplStore: Add support for round robin load balancing between multiple read replicas (#90530)"

This reverts commit 27b52b1507f5218a7b38046b4d96bc004d949d46.

* Revert "DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)"

This reverts commit 8a6107cd35f6444c0674ee4230d3d6bcfbbd4a58.

* Revert "accesscontrol service read replica (#89963)"

This reverts commit 77a4869fcadf13827d76d5767d4de74812d6dd6d.

* Revert "Fix: add mapping for the new mysqlRepl driver (#89551)"

This reverts commit ab5a079bcc5b0f0a6929f0a3742eb2859d4a3498.

* Revert "fix: sql instrumentation dual registration error (#89508)"

This reverts commit d988f5c3b064fade6e96511e0024190c22d48e50.

* Revert "Experimental Feature Toggle: databaseReadReplica (#89232)"

This reverts commit 50244ed4a1435cbf3e3c87d4af34fd7937f7c259.
2024-09-25 15:21:39 -08:00
ddee95cb6d Team: Create permission type for team membership (#92352)
* Create permission type enum for team and remove usage of dashboard permission type
2024-08-23 12:34:34 +02:00
b2eeb0dd6e Alerting: update rule versions on folder move (#88376)
* Alerting: update rule versions on folder move (#88361)
* Add tracing to folder.Move and folder.Update
2024-08-13 12:26:26 +02:00
8988e04044 RBAC: Add permission registry (#91247)
* RBAC: Permission registry

* Populate permission registry

* Wire

* conflic_user_cmd

* Update pkg/services/accesscontrol/permreg/permreg_test.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* PR feedback

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Remove ToDo, tackle in subsequent PR

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2024-08-02 09:32:06 +02:00
248af65f9c Actionsets: Add ability for plugins to add actions for core actionsets (i.e. folders:edit) (#88776)
* initial commit

* Action sets stored
remove the dependancy for actionsets
got the actionsets registered
storing the permissions

* fix golanglinting

* remove unused struct field

* wip

* actionset registry for a plugin from the actionsetservice

* update to make declareactionset the primary way of plugin registration and modification

* declare actually extends actionsets

* tests fixed

* tests skipped

* skip tests

* skip tests

* skip tests

* skip tests

* change to warning instead

* remove step from pipeline to see if it fails due to plugin not registering

* reintroduce step but remove features dependancy

* add back the tests that were failing

* remove comments and another skip test

* fix a comment and remove unneeded changes

* fix and clean up, put the behaviour behind a feature toggle

* clean up

* fixing tests

* hard-code allowed action sets for plugins

* Apply suggestions from code review

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* small cleanup

---------

Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2024-07-19 16:16:23 +01:00
8a6107cd35 DashboardStore: Use ReplDB and get dashboard quotas from the ReadReplica (#90235)
* Use ReplDB in dashboard store and update all fixtures - no other changes

* just moving dashboard counts for now

* find the missing test fixture
2024-07-12 10:47:49 -04:00
77a4869fca accesscontrol service read replica (#89963)
* accesscontrol service read replica
* now using the ReplDB interface
* ReadReplica for GetUser
2024-07-08 10:00:13 -04:00
87d86e81ce Zanzana: Evaluate permissions alongside with RBAC engine (#90064)
* Zanzana: Evaluate permissions if feature flag enabled

* Fix tests

* adjust logs

* fix spelling

* remove unused

* only evaluate implemented resources

* refactor
2024-07-05 11:31:23 +02:00
e568b86ac0 Zanzana: Initial work to allow partial data migrations (#89919)
* Zanana: Add Write method to interface

* Zanzana: Add utilities for translating RBAC to openFGA tuple keys

* RBAC: Add zanzana synchronizer

* Run zanzana sync in access controll provider
2024-07-02 14:45:25 +02:00
bd2b248f0e RBAC: Clean up action set code (#88147)
* remove unused action set code, refactor the existing code

* fix import ordering

* use a separate interface for permission expansion after all, to avoid circular dependencies

* add comments, fix a test
2024-05-23 12:14:01 +01:00
3e77768144 RBAC: Expand action sets when fetching permissions (#87967)
* logic to expand action set to the underlying actions when permissions are fetched from the DB

* updates needed for dependency injection

* clean up some code, also deduplicate scopes when grouping scopes and actions

* expand on a comment

* rename a method
2024-05-21 15:09:26 +01:00
167151b211 Chore: Remove use of deprecated method in AC code (#87541)
* switch from using cfg to using featuremgmt for checking a feature toggle in AC code

* merge test fixes
2024-05-10 11:56:52 +01:00
105313f5c2 RBAC: Adding action set resolver for RBAC evaluation (#86801)
* add action set resolver

* rename variables

* some fixes and some tests

* more tests

* more tests, and put action set storing behind a feature toggle

* undo change from cfg to feature mgmt - will cover it in a separate PR due to the amount of test changes

* fix dependency cycle, update some tests

* add one more test

* fix for feature toggle check not being set on test configs

* linting fixes

* check that action set name can be split nicely

* clean up tests by turning GetActionSetNames into a function

* undo accidental change

* test fix

* more test fixes
2024-05-09 10:18:03 +01:00
82dea4b3e5 Access control: Cache basic roles and teams permissions (#87043)
* RBAC: Cache basic roles permissions

* Cache teams permissions

* Set cache TTL to 1 minute

* Add OSS implementation

* Fetch basic role permissions correctly

* fix conflict_user_command

* Fix teams permissions query

* Add traces for GetUserPermissions

* Fix folders tests

* Fix colflict user command

* Update store mock

* Fix linter error

* Reuse GetUserPermissions for fetching basic roles

* tests for GetTeamsPermissions

* pre-allocate slice capacity

* Fix linter
2024-05-07 15:23:11 +02:00
ad5613d7d4 Chore: Remove cfg from folder service (#87212)
remove cfg from folder service
2024-05-02 13:18:54 +02:00
a2cba3d0b5 User: Add tracing (#87028)
* Inject tracer in tests

* Annotate with traces

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2024-04-30 13:15:56 +02:00
cee713e34c Chore: Add tracing to team service (#86999)
* add tracing to team service

* another test fix

* pass in context for team creation and membership checking
2024-04-29 11:32:03 +01:00
522a98c126 Chore: Make Cfg field private in SQLStore (#85593)
* make cfg private in sqlstore

* fix db init in tests

* fix case

* fix folder test init

* fix imports

* make another Cfg private

* remove another Cfg

* remove unused variable

* use store cfg, it has side-effects

* fix mutated cfg in tests
2024-04-24 10:38:40 +02:00
ddabef9895 RBAC: Add actionsets struct and write path (#86108)
* Add actionsets struct and failing test

* update from review

* review comments

* review comments update

* refactor: create interface

* actionset service

* fix tests

* move from wireoss to wire

* Apply suggestions from code review

remove unnecessary comments

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* nil for the actionsetservice

* Revert "nil for the actionsetservice"

This reverts commit e3d3cc817180c1927dea430191f1e940f5c01272.

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2024-04-19 15:38:14 +01:00
faa1244518 Chore: Replace sqlstore with db interface (#85366)
* replace sqlstore with db interface in a few packages

* remove from stats

* remove sqlstore in admin test

* remove sqlstore from api plugin tests

* fix another createUser

* remove sqlstore in publicdashboards

* remove sqlstore from orgs

* clean up orguser test

* more clean up in sso

* clean up service accounts

* further cleanup

* more cleanup in accesscontrol

* last cleanup in accesscontrol

* clean up teams

* more removals

* split cfg from db in testenv

* few remaining fixes

* fix test with bus

* pass cfg for testing inside db as an option

* set query retries when no opts provided

* revert golden test data

* rebase and rollback
2024-04-04 15:04:47 +02:00
8765c48389 Alerting: Remove legacy alerting (#83671)
Removes legacy alerting, so long and thanks for all the fish! 🐟

---------

Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>
Co-authored-by: Sonia Aguilar <soniaAguilarPeiron@users.noreply.github.com>
Co-authored-by: Armand Grillet <armandgrillet@users.noreply.github.com>
Co-authored-by: William Wernert <rwwiv@users.noreply.github.com>
Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
2024-03-14 15:36:35 +01:00