Commit Graph

37 Commits

Author SHA1 Message Date
Kristin Laemmert
2edfbb7767
sqlstore split: dashboard permissions (#49962)
* backend/sqlstore split: remove unused GetDashboardPermissionsForUser from sqlstore
* remove debugging line
* backend/sqlstore: move dashboard permission related functions to dashboard service
2022-06-01 14:16:26 -04:00
Kristin Laemmert
8c753999df
chore: replace artisanal FakeDashboardService with generated mock (#49276)
* chore: replace handmade FakeDashboardService with generated mock

Maintaining a handcrafted FakeDashboardService is not sustainable now that we are in the process of moving the dashboard-related functions out of sqlstore.

* remove dialect global variable
2022-05-23 11:14:27 -04:00
Kristin Laemmert
1df340ff28
backend/services: Move GetDashboard from sqlstore to dashboard service (#48971)
* rename folder to match package name
* backend/sqlstore: move GetDashboard into DashboardService

This is a stepping-stone commit which copies the GetDashboard function - which lets us remove the sqlstore from the interfaces in dashboards - without changing any other callers.
* checkpoint: moving GetDashboard calls into dashboard service
* finish refactoring api tests for dashboardService.GetDashboard
2022-05-17 14:52:22 -04:00
Scott Bock
3d922a4e67
AnnotationsApi: GET /api/annotations/:annotationId (#47739) 2022-05-16 17:16:36 +02:00
ying-jeanne
bde368be55
Chore : Replace dashboardid with dashboardUID in annotation API (#48481)
* replace dashboardid with dashboardUID in annotation API

* add some tests

* modify some docs and add uid into get endpoint

* rebase with main

* add map for avoiding too much retrieve on dashboards
2022-05-02 11:35:36 +02:00
Karl Persson
de50f39c12
Access Control: Refactor scope resolvers with support to resolve into several scopes (#48202)
* Refactor Scope resolver to support resolving into several scopes

* Change permission evaluator to match at least one of passed scopes
2022-05-02 09:29:30 +02:00
Vardan Torosyan
a0553de8dd
Rename FGAC to RBAC in the codebase (#48051) 2022-04-21 14:31:02 +02:00
Ieva
1588cd393a
check that the user has RBAC permissions to save dashboard annotation (#47882) 2022-04-20 09:43:42 +02:00
Serge Zaitsev
18e93c7077
Chore: Remove bus (#47511)
* Chore: Remove bus

* remove unused const
2022-04-08 16:15:06 +02:00
Ieva
bc9b5325a0
update docs, simplify actions and scopes (#47067) 2022-04-04 13:53:58 +01:00
Kat Yang
90f2233ea9
Chore: Remove global database engine variable from annotation (#46940)
* Chore: Remove global database engine variable from annotation

* 💩
2022-03-25 13:23:09 -04:00
Ezequiel Victorero
c5f295b5b3
Access Control: adding FGAC validation to mass delete annotation endpoint (#46846)
* Access Control: adding FGAC validation to mass delete annotation endpoint
2022-03-23 18:39:00 -03:00
ying-jeanne
adc0cbf176
remove global variable in annotation (#46746)
* remove global varaible in annotation

* remove todo

* replace intransaction with withdbtransaction

* fix typo
2022-03-22 19:20:57 +08:00
Ezequiel Victorero
c717320942
Adding FGAC annotations validation for creation and deletion (#46736)
Access Control: Adding FGAC annotations validation for creation and deletion
Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>
2022-03-21 14:28:39 -03:00
Serge Zaitsev
fec634a091
Chore: Remove bus.Dispatch from guardian package (#46711)
* replace bus in guardian with sqlstore

* fix a couple of tests

* replace bus in the rest of the tests

* allow init guardian from other packages

* make linter happy

* init guardian in library elements

* fix another test in libraryelements

* fix more tests

* move guardian mock one level deeper

* fix more tests

* rename init functions
2022-03-21 10:49:49 +01:00
Ieva
f2450575b3
Access control: FGAC for annotation updates (#46462)
* proposal

* PR feedback

* fix canSave bug

* update scope naming

* linting

* linting

Co-authored-by: Ezequiel Victorero <ezequiel.victorero@grafana.com>
2022-03-18 17:33:21 +01:00
Ezequiel Victorero
4f815e3d8e
Access control: adding FGAC to annotation GET endpoints and fixed roles (#45102)
* Access control: adding FGAC to annotation GET endpoints and fixed roles

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2022-02-11 15:43:29 -03:00
Dimitris Sotirakis
605d056136
Security: Sync security changes on main (#45083)
* * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search
* Teams: Ensure that users searching for teams are only able see teams they have access to
* Teams: Require teamGuardian admin privileges to list team members
* Teams: Prevent org viewers from administering teams
* Teams: Add org_id condition to team count query
* Teams: clarify permission requirements in teams api docs
* Teams: expand scenarios for team search tests
* Teams: mock teamGuardian in tests

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove duplicate WHERE statement

* Fix for CVE-2022-21702

(cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e)

* Lint and test fixes

(cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981)

* check content type properly

(cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98)

* basic csrf origin check

(cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1)

* compare origin to host

(cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42)

* simplify url parsing

(cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d)

* check csrf for GET requests, only compare origin

(cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709)

* parse content type properly

(cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0)

* mentioned get in the comment

(cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345)

* add content-type: application/json to test HTTP requests

* fix pluginproxy test

* Fix linter when comparing errors

Co-authored-by: Kevin Minehart <kmineh0151@gmail.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
2022-02-09 13:44:38 +01:00
idafurjes
1b286e6bb5
Remove bus from quota, preferences, plugins, user_token (#44762)
* Remove bus from quota, preferences, plugins, user_token

* Bind sqlstore.Store to *sqlstore.SQLStore

* Fix test

* Fix sqlstore wire injection, dependency
2022-02-03 09:20:20 +01:00
idafurjes
7936c4c522
Rename AddHandlerCtx to AddHandler (#43557) 2021-12-28 16:08:07 +01:00
idafurjes
e6123bc3ef
Replace AddHandler with AddHandlerCtx in tests (#42585) 2021-12-01 15:43:31 +01:00
Serge Zaitsev
d9cdcb550e
Chore: Refactor api handlers to use web.Bind (#42199)
* Chore: Refactor api handlers to use web.Bind

* fix comments

* fix comment

* trying to fix most of the tests and force routing.Wrap type check

* fix library panels tests

* fix frontend logging tests

* allow passing nil as a response to skip writing

* return nil instead of the response

* rewrite login handler function types

* remove handlerFuncCtx

* make linter happy

* remove old bindings from the libraryelements

* restore comments
2021-11-29 10:18:01 +01:00
Hugo Häggmark
63f9231de1
Annotations: Adds tags endpoint (#36199)
* Annotations: Adds tags endpoint

* Chore: fixes sql  statement

* Refactor: adds count to the api

* Chore: changes after PR comments

* Refactor: changes after PR comments
2021-06-30 13:42:54 +02:00
Hugo Häggmark
3d41267fc4
Chore: Moves common and response into separate packages (#30298)
* Chore: moves common and response into separate packages

* Chore: moves common and response into separate packages

* Update pkg/api/utils/common.go

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>

* Chore: changes after PR comments

* Chore: move wrap to routing package

* Chore: move functions in common to response package

* Chore: move functions in common to response package

* Chore: formats imports

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
2021-01-15 14:43:20 +01:00
Arve Knudsen
cb62e69997
Chore: Convert API tests to standard Go lib (#29009)
* Chore: Convert tests to standard Go lib

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
2020-11-13 09:52:38 +01:00
Carl Bergquist
3fdd2648b1
Chore: Avoid aliasing importing models in api package (#22492) 2020-03-04 12:57:20 +01:00
Ryan McKinley
6335509a23 Annotations: use a single row to represent a region (#17673)
* SQLite migrations

* cleanup

* migrate end times

* switch to update with a query

* real migration

* anno migrations

* remove old docs

* set isRegion from time changes

* use <> for is not

* add comment and fix index decleration

* single validation place

* add test

* fix test

* add upgrading docs

* use AnnotationEvent

* fix import

* remove regionId from typescript
2019-08-16 10:49:30 +02:00
SamuelToh
a7a964ec19 Added PATCH verb end point for annotation op
Added new PATCH verb annotation endpoint

Removed unwanted fmt

Added test cases for PATCH verb annotation endpoint

Fixed formatting issue

Check arr len before proceeding

Updated doc to include PATCH verb annotation endpt
2019-02-05 09:43:17 +10:00
Torkel Ödegaard
c03764ff8a
Refactor team pages to react & design change (#12574)
* Rewriting team pages in react

* teams to react progress

* teams: getting team by id returns same DTO as search, needed for AvatarUrl

* teams: progress on new team pages

* fix: team test

* listing team members and removing team members now works

* teams: team member page now works

* ux: fixed adding team member issue

* refactoring TeamPicker to conform to react coding styles better

* teams: very close to being done with team page rewrite

* minor style tweak

* ux: polish to team pages

* feature: team pages in react & everything working

* fix: removed flickering when changing tabs by always rendering PageHeader
2018-07-11 11:23:07 -07:00
Leonard Gram
5e08bf5130 test: fixed usage of wrap in tests. 2018-07-02 17:13:59 +02:00
Augustin
eb4d860fcb Light improve of massive delete annotation api (#12390)
* fix delete annotations

* fix self assignment

* add right unit test using admin role
2018-06-25 04:58:49 -07:00
Julian Kornberger
0a415c50d0 Make golint happier 2018-03-22 22:38:44 +01:00
Dan Cech
c0ecdee375
rename Context to ReqContext 2018-03-07 11:54:50 -05:00
Dan Cech
338655dd37
move Context and session out of middleware 2018-03-06 18:16:49 -05:00
Daniel Lee
a00a42d9ee api: extract api test code to common_test.go 2018-01-30 13:17:48 +01:00
Daniel Lee
b7f023bc26 fix gofmt warning 2018-01-09 14:44:36 +01:00
Daniel Lee
3ae1bf0c16 dashfolders: permissions for saving annotations
ref #10275 Use folder permissions instead of hard coded
permissions on the annotations routes.
2018-01-09 14:44:36 +01:00