63 Commits

Author SHA1 Message Date
d8b66d5c4b RBAC: remove some IsDisabled checks (#69272)
* remove some access contorl IsDisabled() checks

* cleaning up tests

* update tests

* linting
2023-05-31 09:58:57 +01:00
4980b64274 RBAC: Remove legacy ac from authorization middleware (#68898)
remove legacy AC fallback from RBAC middleware, and some unused auth logic
2023-05-24 09:49:42 +01:00
1d1f58f0ed Service accounts: fix usage of errutil errors and convert more errors to errutil (#64299)
* fix usage of errutil errors and convert more errors to errutil

* fix tests
2023-03-08 11:32:09 +00:00
ad4b053231 API keys: Remove state hideAPIkeys and refactor interface to IsDisabled (#64018)
* remove state and refactor interface to IsDisabled

* update docs and span

* Update pkg/services/apikey/apikey.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

---------

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
2023-03-03 16:12:34 +00:00
76bc288d67 Service accounts: Remove revertapikeys endpoint (#64020)
* remove revertapikeys endpoints

* remove unused method
2023-03-03 09:03:06 +00:00
3fb1894739 Service accounts: Creation logic simplification (#63884)
* SA creation improvements

* PR feedback - put salt and rand back in and remove an unneeded line:
2023-03-01 16:31:20 +00:00
9d6ab92e39 Service accounts: Remove Add API keys buttons and remove one state of migrating for API keys tab (#63411)
* add: hide apikeys tab on start

* make use of store method

* added hiding of apikeys tab for new org creation

* missing err check

* removed unused files

* implemennted fake to make tests run

* move check for globalHideApikeys from org to admin

* refactor to remove the fake

* removed unused method calls for interface

* Update pkg/services/serviceaccounts/manager/service.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Update pkg/services/serviceaccounts/manager/service.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* remove the checkglobal method

* removed duplicate global set const

* add count of apikeys for performance

* remove apikeys adding in UI

* added back deleted file

* added comment on component

* changed wording and copy for hiding and migrating service accounts

* refactor: remove migrationstatus in front/backend

This removes the migrationstatus state from the UI in favor of only
looking at the number of API keys to determine what to show to the user.
This simplifies the logic and makes less calls to the backend with each
page load. This was called both on the API keys page and the Service
accounts page.

- removes the state of migrationstatus from the UI
- removes the backend call
- removes the backend endpoint for migrationstatus

* Update pkg/services/apikey/apikeyimpl/xorm_store.go

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* changes the contet to also be primary

* change id of version for footer component

---------

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2023-03-01 15:34:53 +00:00
51bef166c2 Chore: Remove Result field from serviceaccounts, ualert (#62476)
* Chore: Remove Result field from serviceaccounts
* Chore: Remove Result field from ualert
2023-01-31 09:51:55 +01:00
6c5a573772 Chore: Move ReqContext to contexthandler service (#62102)
* Chore: Move ReqContext to contexthandler service

* Rename package to contextmodel

* Generate ngalert files

* Remove unused imports
2023-01-27 08:50:36 +01:00
371d7850a5 Auth: Service account store refactor (#58961)
* refactor: renaming of files from database to store

* refactor: make service account store private

- moves store interface to manager package
- adds an interface to the ProvideAPI constructor
- refactors tests to use the store when necessary
- adds mocks for the new interface implementations in the tests package

* wip

* refactor: make fakestore in service

* wip

* wip

* wip

* working tests

* trailing whitespaces

* Update pkg/services/serviceaccounts/api/api.go

* Update pkg/services/serviceaccounts/tests/common.go

* Update pkg/services/serviceaccounts/tests/common.go

* refactor: doc string for retriever

* fix import unused

* remove: serviceaccount from featuretoggle

* added: back legacy serviceaccounts feature toggle

* added: docs

* refactor: make query for the SearchQuery

* add: validation of service input fields

* add validation
2022-12-13 14:56:10 +01:00
a8bae3f0b0 Access Control: Clear user's permission cache after resource creation (#59101)
* refresh user's permission cache after resource creation

* clear the cache instead of reloading the permissions

* don't error if can't clear cache

* fix tests

* fix tests again
2022-11-24 14:38:55 +00:00
Jo
4a9137ac40 API Keys: Add revocation for SATs (#53896)
* add apikey is_revoked field

* add token store tests

* Apply suggestions from code review

* remove unused fields
2022-08-18 16:54:39 +02:00
a14621fff6 Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343)
* Chore: Add user service method SetUsingOrg

* Chore: Add user service method GetSignedInUserWithCacheCtx

* Use method GetSignedInUserWithCacheCtx from user service

* Fix lint after rebase

* Fix lint

* Fix lint error

* roll back some changes

* Roll back changes in api and middleware

* Add xorm tags to SignedInUser ID fields
2022-08-11 13:28:55 +02:00
6afad51761 Move SignedInUser to user service and RoleType and Roles to org (#53445)
* Move SignedInUser to user service and RoleType and Roles to org

* Use go naming convention for roles

* Fix some imports and leftovers

* Fix ldap debug test

* Fix lint

* Fix lint 2

* Fix lint 3

* Fix type and not needed conversion

* Clean up messages in api tests

* Clean up api tests 2
2022-08-10 11:56:48 +02:00
7ba076de10 Chore: Move swagger definitions to the handlers (#52643) 2022-07-27 09:54:37 -04:00
18867d6d78 Service account: Ensure that you can revert only service accounts which you can access (#52626)
* Service account: Ensure that you can revert only service accounts which you can access

* Remove prettier messup with docs

* Remove prettier messup with docs

* Prettier run
2022-07-22 10:35:01 +02:00
d85df0a560 Service Accounts: Managed permissions for service accounts (#51818)
* backend changes

* frontend changes

* linting

* nit

* import order

* allow SA creator to access the SA page

* fix merge

* tests

* fix frontend tests

Co-authored-by: alexanderzobnin alexanderzobnin@gmail.com
2022-07-08 05:53:18 -04:00
5eaba5b5b2 Service account: Update service accounts creation (#51848) 2022-07-07 17:32:56 +01:00
f1661166b2 Service accounts: Grafana service accounts are enabled by default (#51402)
* Remove feature flag for service accounts

* Fix failing tests and remove remaining usage

* Fix failing tests and remove remaining usage
2022-06-27 10:22:49 +02:00
859148942e Service accounts: refactor errors (#50917) 2022-06-16 16:02:03 +02:00
f3e3828279 ServiceAccounts: Fix errors returning API key and simplify conditions (#50885)
* ServiceAccounts: Fix naming API key->Service account token

* simplify redundant elses

* Apply suggestions from code review

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
2022-06-16 12:11:22 +02:00
f82264c2b1 ServiceAccounts: API keys migration (#50002)
* ServiceAccounts: able to get upgrade status

* Banner with API keys migration info

* Show API keys migration info on Service accounts page

* Migrate individual API keys

* Use transaction for key migration

* Migrate all api keys to service accounts

* Hide api keys after migration

* Migrate API keys separately for each org

* Revert API key

* Revert key API method

* Rename migration actions and reducers

* Fix linter errors

* Tests for migrating single API key

* Tests for migrating all api keys

* More tests

* Fix reverting tokens

* API: rename convert to migrate

* Add api route descriptions to methods

* rearrange methods in api.go

* Refactor: rename and move some methods

* Prevent assigning tokens to non-existing service accounts

* Refactor: ID TO Id

* Refactor: fix error message

* Delete service account if migration failed

* Fix linter errors
2022-06-15 14:59:40 +02:00
50538d5309 ServiceAccounts: refactor UI (#49508)
* ServiceAccounts: refactor ServiceAccountRoleRow

* Refactor ServiceAccountRoleRow

* Refactor ServiceAccountProfile

* Refactor components

* Change service accounts icon

* Refine service accounts page header

* Improve service accounts filtering

* Change delete button style

* Tweak account id

* Auto focus name field when create service account

* Add disable/enable button

* Enable/disable service accounts

* Optimize updating service account (do not fetch all)

* Remove status column (replace by enable/disable button)

* Add banner with service accounts description

* Add tokens from main page

* Update tokens count when add token from main page

* Fix action buttons column

* Fix tokens count when change role

* Refine table row classes

* Fix buttons

* Simplify working with state

* Show message when service account updated

* Able to filter disabled accounts

* Mark disabled accounts in a table

* Refine disabled account view

* Move non-critical components to separate folder

* Remove confusing focusing

* Fix date picker position when creating new token

* DatePicker: able to set minimum date that can be selected

* Don't allow to select expiration dates prior today

* Set tomorrow as a default token expiration date

* Fix displaying expiration period

* Rename Add token button

* Refine page styles

* Show modal when disabling SA from main page

* Arrange role picker

* Refine SA page styles

* Generate default token name

* More smooth navigation between SA pages

* Stop loading indicator in case of error

* Remove legacy styles usage

* Tweaks after code review

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

* Get rid of useDisapatch in favor of mapDispatchToProps

* Tests for ServiceAccountsListPage

* Tests for service account page

* Show new role picker only with license

* Get rid of deprecated css classes

* Apply suggestion from code review

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

* Fix service accounts icon

* Tests for service account create page

* Return service account info when update

* Add behaviour tests for ServiceAccountsListPage

* Fix disabled cursor on confirm button

* More behavior tests for service account page

* Temporary disable service account migration banner

* Use safe where condition

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Apply review suggestions

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

* Remove autofocus from search

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
Co-authored-by: Jguer <joao.guerreiro@grafana.com>
2022-06-01 09:35:16 +02:00
e9a93ebfc9 Access Control: Move access control middlewares to domain package (#48322)
* Move access control middleware to domain package
2022-04-28 10:46:18 +02:00
b43e9b50b4 Service accounts: RBAC the service account UI (#47788)
* WIP

* fix: bug for saving name did not remove edit

* refactor: better error msg

* Display the column Roles even when user can't see the role picker

* Remove spaces when building the search query request

* Disable Edit button and fix token addition and deletion

* Fix the error message text

Co-authored-by: Vardan Torosyan <vardants@gmail.com>
2022-04-14 23:06:08 +01:00
a245531f0c Access control: service account role check (#47710)
* forbid setting role higher than user's role

* change response code

* can assign API key permissions to non-admin users

* add: assign viewer role directly upon creation

* refactor: add AddSATcommand infavor of AddAPIkey

* refactor: frontend fixes for ServiceAccountToken

Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com>
2022-04-13 18:11:03 +02:00
0bf889e058 Fix unmaarshal of double pointer (#47586)
* Fix unmaarshal of double pointer

* update sdk version
2022-04-12 09:30:34 +02:00
7ab1ef8d6e Access Control: Support other attributes than id for resource permissions (#46727)
* Add option to set ResourceAttribute for a permissions service
* Use prefix in access control sql filter to parse scopes
* Use prefix in access control metadata to check access
2022-03-21 17:58:18 +01:00
c592e6606c Filtering of service accounts by expired tokens (#46251)
* Refactor to ServiceAccounts Query

* filtering expiredtokens on backend

* WIP

* WIP

* WIP

* fix: missing that we do not cover for no service accounts

* fix: wrong link

* feat: filter able to get only service accounts with expired tokens

* refactor: naming

* Update pkg/services/serviceaccounts/models.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* goimported

* Update pkg/services/serviceaccounts/api/api.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2022-03-18 15:50:34 +01:00
f4bed21cee remove /upgradeall apiendpoint (#46638) 2022-03-16 15:33:13 +01:00
75935c75c1 ServiceAccounts: Fix role update (#46568)
* ServiceAccounts: Fix role update

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Fix patch missing metadata

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Fix patch missing metadata

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

Co-authored-by: Jguer <joao.guerreiro@grafana.com>
2022-03-15 10:48:10 +01:00
ef9fe26886 Service accounts: Split user and service account database (#46442)
* ServiceAccounts: remove unused endpoint

* ServiceAccounts: remove usage of getOrgUsers from service accounts

* use dialect for boolean str true in delete

* return service account results directly

* Move Service Account Deletions to sa package

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: gamab <gabi.mabs@gmail.com>

* Move service account methods to service accounts

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: gamab <gabi.mabs@gmail.com>

* Service accounts should not interfere with users

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* filter service accounts in user services

* mispell fix

* fix overextended lines

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix variable

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: gamab <gabi.mabs@gmail.com>
2022-03-14 18:24:07 +01:00
2aeae69a16 Service Accounts: Display name to ID (#46258)
* ServiceAccounts: modernize SA creation interface

* ServiceAccounts: improve service account ID generation

* ServiceAccounts: remove unused method

* ServiceAccounts: Make SA ID display name dependent

* ServiceAccounts: Add tests for Service Account creation

* trim trailing whitespace

* Update pkg/services/serviceaccounts/api/api.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Update pkg/services/serviceaccounts/api/api.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2022-03-08 12:07:58 +01:00
3d168eb34b Searchable service accounts (#45844)
* WIP

* draft of WIP

* feat: search and filtering works 🌈

* Update pkg/models/org_user.go

* Apply suggestions from code review

* refactor: remove unsed function

* refactor: formatting

* Apply suggestions from code review

Co-authored-by: J Guerreiro <joao.guerreiro@grafana.com>

* WIP

* comment

* Update public/app/features/serviceaccounts/ServiceAccountsListPage.tsx

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

* review comments

* wip

* working search and initial load of service accounts

* number of tokens working

* removed api call

* Apply suggestions from code review

* added accescontrol param

* accesscontrol prefix corrected

Co-authored-by: J Guerreiro <joao.guerreiro@grafana.com>
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
2022-03-04 12:04:07 +01:00
bc5237e840 Service Accounts: Link final components in service accounts detail page (#45929)
* ServiceAccounts: Delete/Disable service account from details page

* ServiceAccounts: capitalize viewable messages from UI

* ServiceAccounts: Link new update endpoint to details page

* ServiceAccounts: reimplement service account retrieve to include is_disabled and only target service accounts

* Cleanup styles

* Fix modal show

* ServiceAccounts: simplify handler functions

* Apply suggestions from code review

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

Co-authored-by: Clarity-89 <homes89@ukr.net>
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
2022-03-01 09:21:55 +01:00
5cb03d6e62 Separate API key store from SA token store (#45862)
* ServiceAccounts: Fix token-apikey cross deletion

* ServiceAccounts: separate API key store and service account token store

* ServiceAccounts: hide service account tokens from API Keys page

* ServiceAccounts: uppercase statement

* ServiceAccounts: fix and add new tests for SAT store

* ServiceAccounts: remove service account ID from add API key

* ServiceAccounts: clear up errors
2022-02-28 11:30:45 +01:00
14ec0cbd3b Service Accounts: Polish service account detail page (#45846)
* ServiceAccounts: add teams to service account DTO

* ServiceAccounts: Add team display to service accounts

* ServiceAccounts: add AC metadata to detail route

* ServiceAccounts: add role picker to detail page

* ServiceAccounts: Add role to profile DTO

* ServiceAccounts: remove wip mention of created by
2022-02-25 11:33:34 +01:00
e201b777c2 Service Accounts: small typo and dto fixes (#45677)
* ServiceAccounts: respect js casing and small fixes to displayed values

* ServiceAccounts: fix typos on service account

* ServiceAccounts: fix missing orgID in service account

* ServiceAccounts: Small fixes to dtos for profile

* ServiceAccounts: use result org id

* ServiceAccounts: return value is always nil
2022-02-22 14:58:42 +01:00
14bee49f9a AccessControl: Compute metadata from context permissions (#45578)
* AccessControl: Compute metadata from context permissions

* Remove nil

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Check user permissions are set

Co-authored-by: Jguer <joao.guerreiro@grafana.com>
2022-02-18 11:27:00 +01:00
42d21e1af5 ServiceAccounts: Use http library for status codes (#45525) 2022-02-17 15:00:56 +01:00
8afd5d54f7 Service Account detailed edit (#45404)
* ServiceAccounts: Update service account route

* ServiceAccounts: Update service account tests

* ServiceAccounts: remove extraneous file
2022-02-17 12:19:58 +00:00
6fbf346747 AccessControl: Add endpoint to get user permissions (#45309)
* AccessControl: Add endpoint to get user permissions

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Fix SA tests

* Linter is wrong :p

* Wait I was wrong

* Adding the route for teams:creator too

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
2022-02-11 17:40:43 +01:00
2cf421dfe3 ServiceAccounts: Add access control metadata to service accounts (#45096)
* add role to DTO

* add access control metadata
2022-02-08 19:19:22 +00:00
79340c087f Add number of tokens to the service accounts view (#44919)
* feat: add serviceaccountDTO

* WIP

* feat: listing number of tokens for a given service account

* nit: removed fmt

* Update pkg/services/serviceaccounts/database/database.go

* Update public/app/features/serviceaccounts/ServiceAccountsListPage.tsx

* fixes

* align DTOProfile data to the frontend

* reviewed myself fixes

* fix: tests fix
2022-02-08 14:31:34 +01:00
e04169de1a fix: scoping for service accoutns (#44993)
* fix: scoping for service accoutns

* fix: scoping for service accoutns

* Update pkg/services/serviceaccounts/api/api.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
2022-02-08 12:44:27 +00:00
8c49e96439 ServiceAccounts: Add token view for Service Accounts (#45013)
* fix SA creation scope

* add writer action to SA fixed role

* ServiceAccounts: Add token table to SA detail page

* ServiceAccounts: Allow deletion of tokens from token table

* refactor service account page

* avoid using store for delete
2022-02-08 11:35:15 +00:00
94820e1f29 Add/Delete API keys to Service accounts (#44871)
* ServiceAccounts: move token handlers to specific file

* ServiceAccounts: move Add API key to Service account

* APIKeys: api keys can still be used even when service accounts are enabled

* APIKeys: legacy endpoint can't be used to add SA tokens

* ServiceAccount: add tests for creation with nil and non-nil service account ids

* ServiceAccounts: fix unnasigned cfg and AC typo

* Test: test service account token adding

* fix linting error

* ServiceAccounts: Handle Token deletion

* rename token funcs

* rename token funcs and api wrapping

* add token deletion tests

* review

Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com>

* remove bus

* Update pkg/api/apikey.go

Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com>
2022-02-07 14:51:54 +01:00
334c29eebf feat: creation of service account (#44913)
* feat: creation of service account

* added back button for the details page

* refactor: remove unused file, renamed fields

* oppps
2022-02-07 14:12:39 +01:00
525d9d97a8 Fix crash on no service accounts (#44389)
* Fix crash on no service accounts

* Fix tests

* Update org_users.go

* Update org_users.go

* linter, again

* Update build.go

* Update pkg/services/serviceaccounts/tests/common.go

* fix: big D

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
2022-02-04 11:06:30 +00:00
1dd2579528 fix: remove migrated, and /org endpoint (#44788)
* fix: remove migrated, and /org endpoint

* Update pkg/api/index.go
2022-02-02 16:32:37 +01:00