* fetch inherited folder scopes for search v2
* fix error and don't fetch parents for the general folder
* remove feature toggle check and lower log level
* extend IsInherited function to work for nested folders
* add tests
* update tests and logic
* process inherited permissions seprately to correctly grey them out in the frontend
* add nested folder scope inheritance to managed permission services
* add a more specific erorr
* remove circular dependencies
* use errutil for returning erorr
* fix tests
* fix tests
* define a new error in ac package
* Add checker and update the resource filter function for new search
* Add tests for checker
* small fixes
* handle location for panels correctly
* clean up checker code and extend the tests for it
* more fixes, but tests don't quite work yet
* a small change to return error
* cleanup
* more simplification
* fix tests
* correct wrong argument ordering & use constant
* Apply suggestions from code review
Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>
* import
* check general folder from permission checker function
* handle root folder aka general folder properly
* update tests
* clean up
* lint
* add fix from main
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>
* OnCall role and action definitions
* change verbs from write to update or edit
* Update docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
Co-authored-by: Joey Orlando <joseph.t.orlando@gmail.com>
* initial commit
* clean up
* fix a bug and add tests
* more tests
* undo some unintended changes
* undo some unintended changes
* linting
* PR feedback - add user ID to search options
* simplify the query
* Apply suggestions from code review
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* remove unneeded formatting changes
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* add docs for RBAC provisioning with Terraform
* remove unnecessary bit
* shuffle the structure around, as docs can't go more than four levels deep
* Update index.md
* Update index.md
* allow setting team managed permissions for service accounts
* Revert "allow setting team managed permissions for service accounts"
This reverts commit 7598626397.
* fix org user removal for OSS
* remove comment
* add the migration
* Update pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
* update action names
* correctly retrieve teams for signed in user
* remove test
* undo swagger changes
* undo swagger changes pt2
* add migration from old action names to the new ones
* rename from list to read
* linting
* also update alertign actions
* fix migration
* Add RBAC section to settings
* Default to RBAC enabled settings to true
* Update tests to respect RBAC
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
* reduce the usage of access control flag further by removing it from SQL store methods
* fixing tests
* fix another test
* linting
* remove AC feature toggle use from API keys
* remove unneeded function
* forbid setting role higher than user's role
* change response code
* can assign API key permissions to non-admin users
* add: assign viewer role directly upon creation
* refactor: add AddSATcommand infavor of AddAPIkey
* refactor: frontend fixes for ServiceAccountToken
Co-authored-by: eleijonmarck <eric.leijonmarck@gmail.com>
* pass in user to attribute scope resolver
* add SQL filter to annotation listing
* check annotation FGAC permissions before exposing them for commenting
* remove the requirement to be able to list all annotations from annotation listing endpoint
* adding tests for annotation listing
* remove changes that got moved to a different PR
* unused var
* Update pkg/services/sqlstore/annotation.go
Co-authored-by: Ezequiel Victorero <evictorero@gmail.com>
* remove unneeded check
* remove unneeded check
* undo accidental change
* undo accidental change
* doc update
* move tests
* redo the approach for passing the user in for scope resolution
* accidental change
* cleanup
* error handling
Co-authored-by: Ezequiel Victorero <evictorero@gmail.com>
* filter teams for editors to only show the teams that they are members of
* frontend changes to only allow clicking on teams that the user can edit
* update frontend test snapshots
* extend docs
* reword
* remove the comment for now
* Update backend tests
* reword the warning, and add it back in
* docs feedback
Co-authored-by: gamab <gabi.mabs@gmail.com>
* docs for teams with FGAC
* Update docs/sources/enterprise/access-control/fine-grained-access-control-references.md
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* show teams page for user who can't list teams but can create teams
* Fixing buttons and routes
* Small refactor
Co-authored-by: gamab <gabi.mabs@gmail.com>
* add actions for team group sync
* extend the hook to allow specifying whether the user is external
* move user struct to type package
* interface for permission service to allow mocking it
* reuse existing permissions
* test fix
* refactor
* linting
* document licensing permissions and roles
* Update docs/sources/enterprise/access-control/fine-grained-access-control-references.md
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* Update docs/sources/enterprise/access-control/permissions.md
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* update action name for "licensing.reports:read"
* put licensing editor role back in, more table formatting
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* refactor licenseURL function to use context and export permission evaluation fction
* remove provisioning file
* refactor licenseURL to take in a bool to avoid circular dependencies
* remove function for appending nav link, as it was only used once and move the function to create admin node
* better argument names
* create a function for permission checking
* extend permission checking when displaying server stats
* enable the use of enterprise access control actions when evaluating permissions
* import ordering
* move licensing FGAC action definitions to models package to allow access from oss
* move evaluatePermissions for routes to context serve
* change permission evaluator to take in more permissions
* move licensing FGAC actions again to appease wire
* avoid index out of bounds issue in case no children are passed in when creating server admin node
* simplify syntax for permission checking
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
* update loading state for server stats
* linting
* more linting
* fix test
* fix a frontend test
* update "licensing.reports:read" action naming
* UI doesn't allow reading only licensing reports and not the rest of licensing info
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
Ieva
