grafana/pkg/models/apikey.go
Jeremy Price 6dbb6408d4
Access Control: Add service accounts (#38994)
* Add extra fields to OSS types to support enterprise

* Create a service account at the same time as the API key

* Use service account credentials when accessing API with APIkey

* Add GetRole to service, merge RoleDTO and Role structs

This patch merges the identical OSS and Enterprise data structures, which improves the code for two reasons:

1.  Makes switching between OSS and Enterprise easier
2.  Reduces the chance of incompatibilities developing between the same functions in OSS and Enterprise

* If API key is not linked to a service account, continue login as usual

* Fallback to old auth if no service account linked to key

* Add CloneUserToServiceAccount

* Adding LinkAPIKeyToServiceAccount

* Handle api key link error

* Better error messages for OSS accesscontrol

* Set an invalid user id as default

* Re-arrange field names

* ServiceAccountId is integer

* Better error messages

Co-authored-by: Hugo Häggmark <hugo.haggmark@grafana.com>
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2021-10-20 14:36:11 +02:00

75 lines
1.7 KiB
Go

package models
import (
"errors"
"time"
)
var (
ErrApiKeyNotFound = errors.New("API key not found")
ErrInvalidApiKey = errors.New("invalid API key")
ErrInvalidApiKeyExpiration = errors.New("negative value for SecondsToLive")
ErrDuplicateApiKey = errors.New("API key, organization ID and name must be unique")
)
type ApiKey struct {
Id int64
OrgId int64
Name string
Key string
Role RoleType
Created time.Time
Updated time.Time
Expires *int64
ServiceAccountId int64
}
// ---------------------
// COMMANDS
type AddApiKeyCommand struct {
Name string `json:"name" binding:"Required"`
Role RoleType `json:"role" binding:"Required"`
OrgId int64 `json:"-"`
Key string `json:"-"`
SecondsToLive int64 `json:"secondsToLive"`
ServiceAccountId int64 `json:"serviceAccount"`
CreateNewServiceAccount bool `json:"createServiceAccount"`
Result *ApiKey `json:"-"`
}
type DeleteApiKeyCommand struct {
Id int64 `json:"id"`
OrgId int64 `json:"-"`
}
// ----------------------
// QUERIES
type GetApiKeysQuery struct {
OrgId int64
IncludeExpired bool
Result []*ApiKey
}
type GetApiKeyByNameQuery struct {
KeyName string
OrgId int64
Result *ApiKey
}
type GetApiKeyByIdQuery struct {
ApiKeyId int64
Result *ApiKey
}
// ------------------------
// DTO & Projections
type ApiKeyDTO struct {
Id int64 `json:"id"`
Name string `json:"name"`
Role RoleType `json:"role"`
Expiration *time.Time `json:"expiration,omitempty"`
}