root
/
grafana
mirror of https://github.com/grafana/grafana.git
1
0
Fork 0
Code Issues Actions 21 Packages Projects Releases Wiki Activity
grafana/pkg/services/ngalert/api/authorization.go

440 lines
22 KiB
Go
Raw Normal View History

Alerting: Split grafana and lotex routes (#44742) * split Lotex and Grafana routes * update template to use authorize function for every route
2022-02-05 01:42:04 +08:00
package api
import (
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
"fmt"
"net/http"
Alerting: Split grafana and lotex routes (#44742) * split Lotex and Grafana routes * update template to use authorize function for every route
2022-02-05 01:42:04 +08:00
"github.com/grafana/grafana/pkg/middleware"
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/datasources"
Alerting: Split grafana and lotex routes (#44742) * split Lotex and Grafana routes * update template to use authorize function for every route
2022-02-05 01:42:04 +08:00
"github.com/grafana/grafana/pkg/web"
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
//nolint:gocyclo
Alerting: Split grafana and lotex routes (#44742) * split Lotex and Grafana routes * update template to use authorize function for every route
2022-02-05 01:42:04 +08:00
func (api *API) authorize(method, path string) web.Handler {
Access Control: Move access control middlewares to domain package (#48322) * Move access control middleware to domain package
2022-04-28 16:46:18 +08:00
authorize := ac.Middleware(api.AccessControl)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
var eval ac.Evaluator = nil
switch method + path {
// Alert Rules
// Grafana Paths
Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289) * require "folders:read" and "alert.rules:read" in all rules API requests (write and read). * add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup * check only access to datasource in rule testing API --------- Co-authored-by: William Wernert <william.wernert@grafana.com>
2024-03-20 10:20:30 +08:00
case http.MethodDelete + "/api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname}",
http.MethodDelete + "/api/ruler/grafana/api/v1/rules/{Namespace}":
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleDelete, dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))),
ac.EvalPermission(ac.ActionAlertingRuleRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))),
ac.EvalPermission(dashboards.ActionFoldersRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodGet + "/api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname}":
Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289) * require "folders:read" and "alert.rules:read" in all rules API requests (write and read). * add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup * check only access to datasource in rule testing API --------- Co-authored-by: William Wernert <william.wernert@grafana.com>
2024-03-20 10:20:30 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))),
ac.EvalPermission(dashboards.ActionFoldersRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodGet + "/api/ruler/grafana/api/v1/rules/{Namespace}":
Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289) * require "folders:read" and "alert.rules:read" in all rules API requests (write and read). * add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup * check only access to datasource in rule testing API --------- Co-authored-by: William Wernert <william.wernert@grafana.com>
2024-03-20 10:20:30 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))),
ac.EvalPermission(dashboards.ActionFoldersRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))),
)
Alerting: Rule Modify Export APIs (#75322) * extend RuleStore interface to get namespace by UID * add new export API endpoints * implement request handlers * update authorization and wire handlers to paths * add folder error matchers to errorToResponse * add tests for export methods
2023-10-02 23:47:59 +08:00
case http.MethodGet + "/api/ruler/grafana/api/v1/rules",
http.MethodGet + "/api/ruler/grafana/api/v1/export/rules":
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
Alerting: Rule version history API (#99041) * implement store method to read rule versions * implement request handler * declare a new endpoint * fix fake to return correct response * add tests * add integration tests * rename history to versions * apply diff from swagger CI step Signed-off-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com> --------- Signed-off-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
2025-02-04 02:26:18 +08:00
case http.MethodGet + "/api/ruler/grafana/api/v1/rule/{RuleUID}",
http.MethodGet + "/api/ruler/grafana/api/v1/rule/{RuleUID}/versions":
Alerting: Get grafana-managed alert rule by UID (#86845) * Add auth checks and test * Check user is authorized to view rule and add tests * Change naming * Update Swagger params * Update auth test and swagger gen * Update swagger gen * Change response to GettableExtendedRuleNode * openapi3-gen * Update tests with refactors models pkg
2024-05-02 22:24:59 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead),
ac.EvalPermission(dashboards.ActionFoldersRead),
)
Alerting: Rule Modify Export APIs (#75322) * extend RuleStore interface to get namespace by UID * add new export API endpoints * implement request handlers * update authorization and wire handlers to paths * add folder error matchers to errorToResponse * add tests for export methods
2023-10-02 23:47:59 +08:00
case http.MethodPost + "/api/ruler/grafana/api/v1/rules/{Namespace}/export":
Alerting: Fix authorisation to use namespace UIDs for scope (#81231)
2024-01-26 04:19:51 +08:00
scope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))
Alerting: Rule Modify Export APIs (#75322) * extend RuleStore interface to get namespace by UID * add new export API endpoints * implement request handlers * update authorization and wire handlers to paths * add folder error matchers to errorToResponse * add tests for export methods
2023-10-02 23:47:59 +08:00
// more granular permissions are enforced by the handler via "authorizeRuleChanges"
Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289) * require "folders:read" and "alert.rules:read" in all rules API requests (write and read). * add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup * check only access to datasource in rule testing API --------- Co-authored-by: William Wernert <william.wernert@grafana.com>
2024-03-20 10:20:30 +08:00
eval = ac.EvalAll(ac.EvalPermission(ac.ActionAlertingRuleRead, scope),
ac.EvalPermission(dashboards.ActionFoldersRead, scope),
)
Alerting: API to pause all alert rules in a folder (#104674)
2025-05-13 23:04:01 +08:00
case http.MethodPost + "/api/ruler/grafana/api/v1/rules/{Namespace}",
http.MethodPatch + "/api/ruler/grafana/api/v1/rules/{Namespace}":
Alerting: Fix authorisation to use namespace UIDs for scope (#81231)
2024-01-26 04:19:51 +08:00
scope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":Namespace"))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// more granular permissions are enforced by the handler via "authorizeRuleChanges"
Alerting: Update rule access control to explicitly check for permissions "alert.rules:read" and "folders:read" (#78289) * require "folders:read" and "alert.rules:read" in all rules API requests (write and read). * add check for permissions "folders:read" and "alert.rules:read" to AuthorizeAccessToRuleGroup and HasAccessToRuleGroup * check only access to datasource in rule testing API --------- Co-authored-by: William Wernert <william.wernert@grafana.com>
2024-03-20 10:20:30 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead, scope),
ac.EvalPermission(dashboards.ActionFoldersRead, scope),
ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingRuleUpdate, scope),
ac.EvalPermission(ac.ActionAlertingRuleCreate, scope),
ac.EvalPermission(ac.ActionAlertingRuleDelete, scope),
),
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
)
Alerting: Allow administrators delete rules permanently via UI (#101974) * add query parameter to existing APIs to control the permanent deletion of rules * add GUID to gettable rule * add new endpoint /ruler/grafana/api/v1/trash/rule/guid/{RuleGUID} to delete rules from trash permanently --------- Signed-off-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
2025-03-15 04:14:06 +08:00
case http.MethodDelete + "/api/ruler/grafana/api/v1/trash/rule/guid/{RuleGUID}":
return middleware.ReqOrgAdmin
Alerting: Receivers API (read only endpoints) (#81751) * Add single receiver method * Add receiver permissions * Add single/multi GET endpoints for receivers * Remove stable tag from time intervals See end of PR description here: https://github.com/grafana/grafana/pull/81672
2024-02-06 02:12:15 +08:00
// Grafana rule state history paths
Alerting: Add endpoint for querying state history (#62166) * Define endpoint and generate * Wire up and register endpoint * Cleanup, define authorization * Forgot the leading slash * Wire up query and SignedInUser * Wire up timerange query params * Add todo for label queries * Drop comment * Update path to rules subtree
2023-02-03 01:34:00 +08:00
case http.MethodGet + "/api/v1/rules/history":
eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Grafana, Prometheus-compatible Paths
case http.MethodGet + "/api/prometheus/grafana/api/v1/rules":
eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
// Grafana Rules Testing Paths
case http.MethodPost + "/api/v1/rule/test/grafana":
// additional authorization is done in the request handler
eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
Alerting: rule backtesting API (#57318) * Implement backtesting engine that can process regular rule specification (with queries to datasource) as well as special kind of rules that have data frame instead of query. * declare a new API endpoint and model * add feature toggle `alertingBacktesting`
2022-12-14 22:44:14 +08:00
// Grafana Rules Testing Paths
case http.MethodPost + "/api/v1/rule/backtest":
// additional authorization is done in the request handler
eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodPost + "/api/v1/eval":
// additional authorization is done in the request handler
eval = ac.EvalPermission(ac.ActionAlertingRuleRead)
// Lotex Paths
Alerting: modify ruler endpoints for proxying using the datasource UID (#48046) * Modify ruler endpoints to expect the data source UID * Update frontend * Apply suggestion from code review
2022-05-05 19:58:32 +08:00
case http.MethodDelete + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}":
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodDelete + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}/{Groupname}":
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodGet + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}":
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodGet + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}/{Groupname}":
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodGet + "/api/ruler/{DatasourceUID}/api/v1/rules":
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodPost + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}":
Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] (#93940) Fix endpoint permission on rule write endpoint
2024-09-28 03:23:21 +08:00
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Lotex Prometheus-compatible Paths
Alerting: modify prometheus endpoints for proxying using the datasource UID (#48052) * Modify prometheus endpoints to expect the data source UID * Update frontend
2022-05-07 03:05:02 +08:00
case http.MethodGet + "/api/prometheus/{DatasourceUID}/api/v1/rules":
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Lotex Rules testing
Alerting: Modify endpoint for testing a datasource rule using the UID (#48070) * Modify testing endpoint to expect the datasource UID * Update docs
2022-05-17 19:10:20 +08:00
case http.MethodPost + "/api/v1/rule/test/{DatasourceUID}":
eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
Alerting: conversion API structure (#100258)
2025-02-12 15:13:21 +08:00
// convert/prometheus API paths
case http.MethodGet + "/api/convert/prometheus/config/v1/rules/{NamespaceTitle}/{Group}",
Alerting: API paths for cortextool to import Loki rules (#101409) Alerting: Legacy rules paths for cortextool
2025-02-28 00:20:49 +08:00
http.MethodGet + "/api/convert/api/prom/rules/{NamespaceTitle}/{Group}",
http.MethodGet + "/api/convert/prometheus/config/v1/rules/{NamespaceTitle}",
http.MethodGet + "/api/convert/api/prom/rules/{NamespaceTitle}":
Alerting: conversion API structure (#100258)
2025-02-12 15:13:21 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead),
ac.EvalPermission(dashboards.ActionFoldersRead),
)
Alerting: API paths for cortextool to import Loki rules (#101409) Alerting: Legacy rules paths for cortextool
2025-02-28 00:20:49 +08:00
case http.MethodGet + "/api/convert/prometheus/config/v1/rules",
http.MethodGet + "/api/convert/api/prom/rules":
Alerting: API to create rule groups using mimirtool (#100558) What is this feature? Adds an API endpoint to create alert rules with mimirtool: - POST /convert/prometheus/config/v1/rules/{NamespaceTitle} - Accepts a single rule group in a Prometheus YAML format and creates or updates a Grafana rule group from it. The endpoint uses the conversion package from #100224. Key parts The API works similarly to the provisioning API. If the rule does not exist, it will be created, otherwise updated. Any rules not present in the new group will be deleted, ensuring the group is fully synchronized with the provided configuration. Since the API works with namespace titles (folders), the handler automatically creates a folder in the root based on the provided title if it does not exist. It also requires a special header, X-Grafana-Alerting-Datasource-UID. This header specifies which datasource to use for the new rules. If the rule group's evaluation interval is not specified, it uses the DefaultRuleEvaluationInterval from settings.
2025-02-25 18:26:36 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead),
ac.EvalPermission(dashboards.ActionFoldersRead),
)
Alerting: conversion API structure (#100258)
2025-02-12 15:13:21 +08:00
Alerting: API paths for cortextool to import Loki rules (#101409) Alerting: Legacy rules paths for cortextool
2025-02-28 00:20:49 +08:00
case http.MethodPost + "/api/convert/prometheus/config/v1/rules/{NamespaceTitle}",
Alerting: API to convert submitted Prometheus rules to GMA (#102231) * placeholder commit * Complete function in api_convert_prometheus.go * MVP before extensive testing * Cleanup * Updated tests * cleanup * Fix random logs and lint * Remove comment * Fix errors after rebase * Update test * Update swagger * swagger * Refactor to accept groups in body * Fix auth tests and some cleanup * Some cleanup before refactoring * Remove unnecessary fields * Also refactor RouteConvertPrometheusPostRuleGroup * Remove unused code * Rebase + cleanup * Update authorization_test * address comments * Regen swagger files * Remove namespace and group filters * Final comments
2025-03-27 23:30:11 +08:00
http.MethodPost + "/api/convert/api/prom/rules/{NamespaceTitle}",
http.MethodPost + "/api/convert/prometheus/config/v1/rules",
Alerting: Fix path for cortex-style Prometheus namespaces conversion endpoint (#103655)
2025-04-09 16:40:22 +08:00
http.MethodPost + "/api/convert/api/prom/rules":
Alerting: conversion API structure (#100258)
2025-02-12 15:13:21 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleCreate),
Alerting: API to create rule groups using mimirtool (#100558) What is this feature? Adds an API endpoint to create alert rules with mimirtool: - POST /convert/prometheus/config/v1/rules/{NamespaceTitle} - Accepts a single rule group in a Prometheus YAML format and creates or updates a Grafana rule group from it. The endpoint uses the conversion package from #100224. Key parts The API works similarly to the provisioning API. If the rule does not exist, it will be created, otherwise updated. Any rules not present in the new group will be deleted, ensuring the group is fully synchronized with the provided configuration. Since the API works with namespace titles (folders), the handler automatically creates a folder in the root based on the provided title if it does not exist. It also requires a special header, X-Grafana-Alerting-Datasource-UID. This header specifies which datasource to use for the new rules. If the rule group's evaluation interval is not specified, it uses the DefaultRuleEvaluationInterval from settings.
2025-02-25 18:26:36 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
Alerting: conversion API structure (#100258)
2025-02-12 15:13:21 +08:00
)
case http.MethodDelete + "/api/convert/prometheus/config/v1/rules/{NamespaceTitle}/{Group}",
Alerting: API paths for cortextool to import Loki rules (#101409) Alerting: Legacy rules paths for cortextool
2025-02-28 00:20:49 +08:00
http.MethodDelete + "/api/convert/api/prom/rules/{NamespaceTitle}/{Group}",
http.MethodDelete + "/api/convert/prometheus/config/v1/rules/{NamespaceTitle}",
http.MethodDelete + "/api/convert/api/prom/rules/{NamespaceTitle}":
Alerting: Allow specifying a folder for Prometheus rule import (#101406) What is this feature? Allows the creation of alert rules with mimirtool in a specified folder. Why do we need this feature? Currently, the APIs for mimirtool create namespaces and rule groups in the root folder without the ability to set a custom folder. For example, it could be a special "Imported" folder, etc. This PR makes it possible with a special header: mimirtool ... --extra-headers="X-Grafana-Alerting-Folder-UID=123". If it's not present, the root folder is used, otherwise, the specified one is used. mimirtool does not support nested folder structures, while Grafana allows folder nesting. To keep compatibility, we return only direct child folders of the working folder (as namespaces) with rule groups and rules that are directly in these child folders as if there are no nested folders. For example, given this folder structure in Grafana: ``` grafana/ ├── production/ │ ├── service1/ │ │ └── alerts/ │ └── service2/ └── testing/ └── service3/ ``` If the working folder is "grafana": Only namespaces "production" and "testing" are returned Only rule groups directly within these folders are included If the working folder is "production": - Only namespaces "service1" and "service2" are returned Only rule groups directly within these folders are included
2025-03-04 00:59:01 +08:00
eval = ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead),
ac.EvalPermission(dashboards.ActionFoldersRead),
ac.EvalPermission(ac.ActionAlertingRuleDelete),
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
Alerting: conversion API structure (#100258)
2025-02-12 15:13:21 +08:00
)
Alerting: Empty endpoints to manage alertmanager configurations (#106546)
2025-06-11 19:45:02 +08:00
case http.MethodPost + "/api/convert/api/v1/alerts",
http.MethodDelete + "/api/convert/api/v1/alerts":
Alerting: Empty endpoint to load alertmanager config with mimirtool (#106266)
2025-06-10 17:35:57 +08:00
eval = ac.EvalPermission(ac.ActionAlertingNotificationsWrite)
Alerting: Empty endpoints to manage alertmanager configurations (#106546)
2025-06-11 19:45:02 +08:00
case http.MethodGet + "/api/convert/api/v1/alerts":
eval = ac.EvalPermission(ac.ActionAlertingNotificationsRead)
Alerting: Empty endpoint to load alertmanager config with mimirtool (#106266)
2025-06-10 17:35:57 +08:00
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Alert Instances and Silences
Alerting: Hook up GMA silence APIs to new authentication handler (#86625) This PR connects the new RBAC authentication service to existing alertmanager API silence endpoints.
2024-05-04 03:32:30 +08:00
// Silences for Grafana paths.
// These permissions are required but not sufficient, further authorization is done in the request handler.
case http.MethodDelete + "/api/alertmanager/grafana/api/v2/silence/{SilenceId}": // Delete endpoint is used for silence expiration.
eval = ac.EvalAll(
ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingInstanceRead),
ac.EvalPermission(ac.ActionAlertingSilencesRead),
),
ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingInstanceUpdate),
ac.EvalPermission(ac.ActionAlertingSilencesWrite),
),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodGet + "/api/alertmanager/grafana/api/v2/silence/{SilenceId}":
Alerting: Hook up GMA silence APIs to new authentication handler (#86625) This PR connects the new RBAC authentication service to existing alertmanager API silence endpoints.
2024-05-04 03:32:30 +08:00
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingInstanceRead),
ac.EvalPermission(ac.ActionAlertingSilencesRead),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodGet + "/api/alertmanager/grafana/api/v2/silences":
Alerting: Hook up GMA silence APIs to new authentication handler (#86625) This PR connects the new RBAC authentication service to existing alertmanager API silence endpoints.
2024-05-04 03:32:30 +08:00
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingInstanceRead),
ac.EvalPermission(ac.ActionAlertingSilencesRead),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodPost + "/api/alertmanager/grafana/api/v2/silences":
Alerting: Hook up GMA silence APIs to new authentication handler (#86625) This PR connects the new RBAC authentication service to existing alertmanager API silence endpoints.
2024-05-04 03:32:30 +08:00
eval = ac.EvalAll(
ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingInstanceRead),
ac.EvalPermission(ac.ActionAlertingSilencesRead),
),
ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingInstanceCreate),
ac.EvalPermission(ac.ActionAlertingInstanceUpdate),
ac.EvalPermission(ac.ActionAlertingSilencesCreate),
ac.EvalPermission(ac.ActionAlertingSilencesWrite),
),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Alert Instances. Grafana Paths
case http.MethodGet + "/api/alertmanager/grafana/api/v2/alerts/groups":
eval = ac.EvalPermission(ac.ActionAlertingInstanceRead)
case http.MethodGet + "/api/alertmanager/grafana/api/v2/alerts":
eval = ac.EvalPermission(ac.ActionAlertingInstanceRead)
// Grafana Prometheus-compatible Paths
case http.MethodGet + "/api/prometheus/grafana/api/v1/alerts":
eval = ac.EvalPermission(ac.ActionAlertingInstanceRead)
// Silences. External AM.
Alerting: modify alertmanager endpoints for proxying using the datasource UID (#47978) * Alerting: enable proxying alertmanager calls using the datasource UID * Remove use of datasource ID from the API * Update frontend
2022-04-29 15:25:22 +08:00
case http.MethodDelete + "/api/alertmanager/{DatasourceUID}/api/v2/silence/{SilenceId}":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodPost + "/api/alertmanager/{DatasourceUID}/api/v2/silences":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodGet + "/api/alertmanager/{DatasourceUID}/api/v2/silence/{SilenceId}":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodGet + "/api/alertmanager/{DatasourceUID}/api/v2/silences":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Alert instances. External AM.
Alerting: modify alertmanager endpoints for proxying using the datasource UID (#47978) * Alerting: enable proxying alertmanager calls using the datasource UID * Remove use of datasource ID from the API * Update frontend
2022-04-29 15:25:22 +08:00
case http.MethodGet + "/api/alertmanager/{DatasourceUID}/api/v2/alerts/groups":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodGet + "/api/alertmanager/{DatasourceUID}/api/v2/alerts":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodPost + "/api/alertmanager/{DatasourceUID}/api/v2/alerts":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Prometheus-compatible Paths
Alerting: modify prometheus endpoints for proxying using the datasource UID (#48052) * Modify prometheus endpoints to expect the data source UID * Update frontend
2022-05-07 03:05:02 +08:00
case http.MethodGet + "/api/prometheus/{DatasourceUID}/api/v1/alerts":
eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Notification Policies, Contact Points and Templates
// Grafana Paths
case http.MethodDelete + "/api/alertmanager/grafana/config/api/v1/alerts": // reset alertmanager config to the default
Alerting: Fix RBAC actions for notification policies (#49185) * squash actions "alert.notifications:update", "alert.notifications:create", "alert.notifications:delete" to "alert.notifications:write" * add migration * update UI to use the write action * update docs * changelog
2022-05-20 22:55:07 +08:00
eval = ac.EvalPermission(ac.ActionAlertingNotificationsWrite)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodGet + "/api/alertmanager/grafana/config/api/v1/alerts":
eval = ac.EvalPermission(ac.ActionAlertingNotificationsRead)
Alerting: Fetch all applied alerting configurations (#65728) * WIP * skip invalid historic configurations instead of erroring * add warning log when bad historic config is found * remove unused custom marshaller for GettableHistoricUserConfig * add id to historic user config, move limit check to store, fix typo * swagger spec
2023-04-01 04:43:04 +08:00
case http.MethodGet + "/api/alertmanager/grafana/config/history":
eval = ac.EvalPermission(ac.ActionAlertingNotificationsRead)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodGet + "/api/alertmanager/grafana/api/v2/status":
eval = ac.EvalPermission(ac.ActionAlertingNotificationsRead)
Alerting: Add endpoint to revert to a previous alertmanager configuration (#65751) * Alerting: Add endpoint to revert to a previous alertmanager configuration This endpoint is meant to be used in conjunction with /api/alertmanager/grafana/config/history to revert to a previously applied alertmanager configuration. This is done by ID instead of raw config string in order to avoid secure field complications.
2023-04-06 02:10:03 +08:00
case http.MethodPost + "/api/alertmanager/grafana/config/history/{id}/_activate":
eval = ac.EvalAny(ac.EvalPermission(ac.ActionAlertingNotificationsWrite))
Alerting: Expose info about notification delivery errors in a new /receivers endpoint (#55429) * (WIP) switch to fork AM, first implementation of the API, generate spec * get receivers avoiding race conditions * use latest version of our forked AM, tests * make linter happy, delete TODO comment * update number of expected paths to += 2 * delete unused endpoint code, code review comments, tests * Update pkg/services/ngalert/notifier/alertmanager.go Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com> * remove call to fmt.Println * clear naming for fields * shorter variable names in GetReceivers Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>
2022-10-03 21:58:41 +08:00
case http.MethodGet + "/api/alertmanager/grafana/config/api/v1/receivers":
Alerting: Add access control to receiver status API (#94287)
2024-10-08 03:21:29 +08:00
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingNotificationsRead),
ac.EvalPermission(ac.ActionAlertingReceiversRead),
ac.EvalPermission(ac.ActionAlertingReceiversReadSecrets),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
case http.MethodPost + "/api/alertmanager/grafana/config/api/v1/receivers/test":
Alerting: Update permissions to reciever and template test API (#94282) * add action "alert.notifications.receivers:test" to receiver creator * update API permissions to accept new granular actions
2024-10-05 03:52:44 +08:00
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingNotificationsWrite),
ac.EvalPermission(ac.ActionAlertingReceiversTest),
)
Alerting: Template Testing API (#67450)
2023-04-28 22:56:59 +08:00
case http.MethodPost + "/api/alertmanager/grafana/config/api/v1/templates/test":
Alerting: Update permissions to reciever and template test API (#94282) * add action "alert.notifications.receivers:test" to receiver creator * update API permissions to accept new granular actions
2024-10-05 03:52:44 +08:00
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingNotificationsWrite),
ac.EvalPermission(ac.ActionAlertingNotificationsTemplatesRead),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// External Alertmanager Paths
Alerting: modify alertmanager endpoints for proxying using the datasource UID (#47978) * Alerting: enable proxying alertmanager calls using the datasource UID * Remove use of datasource ID from the API * Update frontend
2022-04-29 15:25:22 +08:00
case http.MethodDelete + "/api/alertmanager/{DatasourceUID}/config/api/v1/alerts":
Alerting: Fix RBAC actions for notification policies (#49185) * squash actions "alert.notifications:update", "alert.notifications:create", "alert.notifications:delete" to "alert.notifications:write" * add migration * update UI to use the write action * update docs * changelog
2022-05-20 22:55:07 +08:00
eval = ac.EvalPermission(ac.ActionAlertingNotificationsExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: modify alertmanager endpoints for proxying using the datasource UID (#47978) * Alerting: enable proxying alertmanager calls using the datasource UID * Remove use of datasource ID from the API * Update frontend
2022-04-29 15:25:22 +08:00
case http.MethodGet + "/api/alertmanager/{DatasourceUID}/api/v2/status":
eval = ac.EvalPermission(ac.ActionAlertingNotificationsExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodGet + "/api/alertmanager/{DatasourceUID}/config/api/v1/alerts":
eval = ac.EvalPermission(ac.ActionAlertingNotificationsExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
case http.MethodPost + "/api/alertmanager/{DatasourceUID}/config/api/v1/alerts":
Alerting: Use correct permission scope for external AM updates (#50159) Co-authored-by: konrad147 <konrad.lalik@grafana.com>
2022-06-03 21:12:34 +08:00
eval = ac.EvalPermission(ac.ActionAlertingNotificationsExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID")))
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
Alerting: New API endpoint GET /api/v1/ngalert (#55134) * declare new endpoint /api/v1/ngalert * add authorization for new path * add request handler for the new path
2022-09-15 02:03:10 +08:00
case http.MethodGet + "/api/v1/ngalert":
// let user with any alerting permission access this API
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingInstanceRead),
ac.EvalPermission(ac.ActionAlertingInstancesExternalRead),
ac.EvalPermission(ac.ActionAlertingRuleRead),
ac.EvalPermission(ac.ActionAlertingRuleExternalRead),
ac.EvalPermission(ac.ActionAlertingNotificationsRead),
ac.EvalPermission(ac.ActionAlertingNotificationsExternalRead),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
// Raw Alertmanager Config Paths
case http.MethodDelete + "/api/v1/ngalert/admin_config",
http.MethodGet + "/api/v1/ngalert/admin_config",
http.MethodPost + "/api/v1/ngalert/admin_config",
http.MethodGet + "/api/v1/ngalert/alertmanagers":
return middleware.ReqOrgAdmin
Alerting: Provisioning API - Notification Policies (#46755) * Base-line API for provisioning notification policies * Wire API up, some simple tests * Return provenance status through API * Fix missing call * Transactions * Clarity in package dependencies * Unify receivers in definitions * Fix issue introduced by receiver change * Drop unused internal test implementation * FGAC hooks for provisioning routes * Polish, swap names * Asserting on number of exposed routes * Don't bubble up updated object * Integrate with new concurrency token feature in store * Back out duplicated changes * Remove redundant tests * Regenerate and create unit tests for API layer * Integration tests for auth * Address linter errors * Put route behind toggle * Use alternative store API and fix feature toggle in tests * Fixes, polish * Fix whitespace * Re-kick drone * Rename services to provisioning
2022-04-06 05:48:51 +08:00
Alerting: Add manage permissions UI logic for Contact Points (#92885) * Add showPolicies prop * Add manage permissions component for easier reuse within alerting * Add method for checking whether to show access control within alerting * Remove accidental console.log from main * Tweak styling for contact point width and add manage permissions drawer * Improve typing for access control type response * Add basic test for manage permissions on contact points list * Only show manage permissions if grafana AM and alertingApiServer is enabled * Update i18n * Add test utils for turning features on and back off * Add access control handlers * Update tests with new util * Pass AM in and add tests * Receiver OSS resource permissions There is a complication that is not fully addressed: Viewer defaults to read:* and Editor defaults to read+write+delete:* This is different to other resource permissions where non-admin are not granted any global permissions and instead access is handled solely by resource-specific permissions that are populated on create and removed on delete. This allows them to easily remove permission to view or edit a single resource from basic roles. The reason this is tricky here is that we have multiple APIs that can create/delete receivers: config api, provisioning api, and k8s receivers api. Config api in particular is not well-equipped to determine when creates/deletes are happening and thus ensuring that the proper resource-specific permissions are created/deleted is finicky. We would also have to create a migration to populate resource-specific permissions for all current receivers. This migration would need to be reset so it can run again if the flag is disabled. * Add access control permissions * Pass in contact point ID to receivers form * Temporarily remove access control check for contact points * Include access control metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/accessControl` * Include new permissions for contact points navbar * Fix receiver creator fixed role to not give global read * Include in-use metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/inUse` * Add receiver creator permission to receiver writer * Add receiver creator permission to navbar * Always allow listing receivers, don't return 403 * Remove receiver read precondition from receiver create Otherwise, Creator role will not be able to create their first receiver * Update routes permissions * Add further support for RBAC in contact points * Update routes permissions * Update contact points header logic * Back out test feature toggle refactor Not working atm, not sure why * Tidy up imports * Update mock permissions * Revert more test changes * Update i18n * Sync inuse metadata pr * Add back canAdmin permissions after main merge * Split out check for policies navtree item * Tidy up utils and imports and fix rules in use * Fix contact point tests and act warnings * Add missing ReceiverPermissionAdmin after merge conflict * Move contact points permissions * Only show contact points filter when permissions are correct * Move to constants * Fallback to empty array and remove labelSelectors (not needed) * Allow `toAbility` to take multiple actions * Show builtin alertmanager if contact points permission * Add empty state and hide templates if missing permissions * Translations * Tidy up mock data * Fix tests and templates permission * Update message for unused contact points * Don't return 403 when user lists receivers and has access to none * Fix receiver create not adding empty uid permissions * Move SetDefaultPermissions to ReceiverPermissionService * Have SetDefaultPermissions use uid from string Fixes circular dependency * Add FakeReceiverPermissionsService and fix test wiring * Implement resource permission handling in provisioning API and renames Create: Sets to default permissions Delete: Removes permissions Update: If receiver name is modified and the new name doesn't exist, it copies the permissions from the old receiver to the newly created one. If old receiver is now empty, it removes the old permissions as well. * Split contact point permissions checks for read/modify * Generalise getting annotation values from k8s entities * Proxy RouteDeleteAlertingConfig through MultiOrgAlertmanager * Cleanup permissions on config api reset and restore * Cleanup permissions on config api POST note this is still not available with feature flag enabled * Gate the permission manager behind FF until initial migration is added * Sync changes from config api PR * Switch to named export * Revert unnecessary changes * Revert Filter auth change and implement in k8s api only * Don't allow new scoped permissions to give access without FF Prevents complications around mixed support for the scoped permissions causing oddities in the UI. * Fix integration tests to account for list permission change * Move to `permissions` file * Add additional tests for contact points * Fix redirect for viewer on edit page * Combine alerting test utils and move to new file location * Allow new permissions to access provisioning export paths with FF * Always allow exporting if its grafana flavoured * Fix logic for showing auto generated policies * Fix delete logic for contact point only referenced by a rule * Suppress warning message when renaming a contact point * Clear team and role perm cache on receiver rename Prevents temporarily broken UI permissions after rename when a user's source of elevated permissions comes from a cached team or basic role permission. * Debug log failed cache clear on CopyPermissions --------- Co-authored-by: Matt Jacobson <matthew.jacobson@grafana.com>
2024-09-28 02:56:32 +08:00
// Grafana-only Provisioning Export Paths for everything except contact points.
Alerting: Let users with regular permissions access export endpoints (#76082) let users with regular permissions access export endpoints
2023-10-07 02:48:20 +08:00
case http.MethodGet + "/api/v1/provisioning/policies/export",
Alerting: Add export of mute timings to file provisioning formats (#79225) * add export of mute timings to file provisioning formats * support export of mute timings to HCL
2023-12-12 10:36:51 +08:00
http.MethodGet + "/api/v1/provisioning/mute-timings/export",
http.MethodGet + "/api/v1/provisioning/mute-timings/{name}/export":
Alerting: Let users with regular permissions access export endpoints (#76082) let users with regular permissions access export endpoints
2023-10-07 02:48:20 +08:00
eval = ac.EvalAny(
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingNotificationsRead), // organization scope
ac.EvalPermission(ac.ActionAlertingProvisioningRead), // organization scope
ac.EvalPermission(ac.ActionAlertingNotificationsProvisioningRead), // organization scope
ac.EvalPermission(ac.ActionAlertingProvisioningReadSecrets), // organization scope
Alerting: Let users with regular permissions access export endpoints (#76082) let users with regular permissions access export endpoints
2023-10-07 02:48:20 +08:00
)
Alerting: Add manage permissions UI logic for Contact Points (#92885) * Add showPolicies prop * Add manage permissions component for easier reuse within alerting * Add method for checking whether to show access control within alerting * Remove accidental console.log from main * Tweak styling for contact point width and add manage permissions drawer * Improve typing for access control type response * Add basic test for manage permissions on contact points list * Only show manage permissions if grafana AM and alertingApiServer is enabled * Update i18n * Add test utils for turning features on and back off * Add access control handlers * Update tests with new util * Pass AM in and add tests * Receiver OSS resource permissions There is a complication that is not fully addressed: Viewer defaults to read:* and Editor defaults to read+write+delete:* This is different to other resource permissions where non-admin are not granted any global permissions and instead access is handled solely by resource-specific permissions that are populated on create and removed on delete. This allows them to easily remove permission to view or edit a single resource from basic roles. The reason this is tricky here is that we have multiple APIs that can create/delete receivers: config api, provisioning api, and k8s receivers api. Config api in particular is not well-equipped to determine when creates/deletes are happening and thus ensuring that the proper resource-specific permissions are created/deleted is finicky. We would also have to create a migration to populate resource-specific permissions for all current receivers. This migration would need to be reset so it can run again if the flag is disabled. * Add access control permissions * Pass in contact point ID to receivers form * Temporarily remove access control check for contact points * Include access control metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/accessControl` * Include new permissions for contact points navbar * Fix receiver creator fixed role to not give global read * Include in-use metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/inUse` * Add receiver creator permission to receiver writer * Add receiver creator permission to navbar * Always allow listing receivers, don't return 403 * Remove receiver read precondition from receiver create Otherwise, Creator role will not be able to create their first receiver * Update routes permissions * Add further support for RBAC in contact points * Update routes permissions * Update contact points header logic * Back out test feature toggle refactor Not working atm, not sure why * Tidy up imports * Update mock permissions * Revert more test changes * Update i18n * Sync inuse metadata pr * Add back canAdmin permissions after main merge * Split out check for policies navtree item * Tidy up utils and imports and fix rules in use * Fix contact point tests and act warnings * Add missing ReceiverPermissionAdmin after merge conflict * Move contact points permissions * Only show contact points filter when permissions are correct * Move to constants * Fallback to empty array and remove labelSelectors (not needed) * Allow `toAbility` to take multiple actions * Show builtin alertmanager if contact points permission * Add empty state and hide templates if missing permissions * Translations * Tidy up mock data * Fix tests and templates permission * Update message for unused contact points * Don't return 403 when user lists receivers and has access to none * Fix receiver create not adding empty uid permissions * Move SetDefaultPermissions to ReceiverPermissionService * Have SetDefaultPermissions use uid from string Fixes circular dependency * Add FakeReceiverPermissionsService and fix test wiring * Implement resource permission handling in provisioning API and renames Create: Sets to default permissions Delete: Removes permissions Update: If receiver name is modified and the new name doesn't exist, it copies the permissions from the old receiver to the newly created one. If old receiver is now empty, it removes the old permissions as well. * Split contact point permissions checks for read/modify * Generalise getting annotation values from k8s entities * Proxy RouteDeleteAlertingConfig through MultiOrgAlertmanager * Cleanup permissions on config api reset and restore * Cleanup permissions on config api POST note this is still not available with feature flag enabled * Gate the permission manager behind FF until initial migration is added * Sync changes from config api PR * Switch to named export * Revert unnecessary changes * Revert Filter auth change and implement in k8s api only * Don't allow new scoped permissions to give access without FF Prevents complications around mixed support for the scoped permissions causing oddities in the UI. * Fix integration tests to account for list permission change * Move to `permissions` file * Add additional tests for contact points * Fix redirect for viewer on edit page * Combine alerting test utils and move to new file location * Allow new permissions to access provisioning export paths with FF * Always allow exporting if its grafana flavoured * Fix logic for showing auto generated policies * Fix delete logic for contact point only referenced by a rule * Suppress warning message when renaming a contact point * Clear team and role perm cache on receiver rename Prevents temporarily broken UI permissions after rename when a user's source of elevated permissions comes from a cached team or basic role permission. * Debug log failed cache clear on CopyPermissions --------- Co-authored-by: Matt Jacobson <matthew.jacobson@grafana.com>
2024-09-28 02:56:32 +08:00
// Grafana-only Provisioning Export Paths for contact points.
case http.MethodGet + "/api/v1/provisioning/contact-points/export":
perms := []ac.Evaluator{
ac.EvalPermission(ac.ActionAlertingNotificationsRead), // organization scope
ac.EvalPermission(ac.ActionAlertingProvisioningRead), // organization scope
ac.EvalPermission(ac.ActionAlertingNotificationsProvisioningRead), // organization scope
ac.EvalPermission(ac.ActionAlertingProvisioningReadSecrets), // organization scope
Alerting: Remove the POST endpoint for the internal Grafana Alertmanager config (#103819) * Remove POST config for Grafana Alertmanager * Delete auth + test for removed path * Alerting: Remove check for `alertingApiServer` toggle in UI (#103805) * Remove check for alertingApiServer in UI * Update tests to no longer care about alertingApiServer * Add contact points handlers now that we use alertingApiServer all the time * Fix test broken from removing camelCase for UIDs --------- Co-authored-by: Tom Ratcliffe <tom.ratcliffe@grafana.com>
2025-04-12 05:38:53 +08:00
ac.EvalPermission(ac.ActionAlertingReceiversRead), // organization scope
ac.EvalPermission(ac.ActionAlertingReceiversReadSecrets), // organization scope
Alerting: Add manage permissions UI logic for Contact Points (#92885) * Add showPolicies prop * Add manage permissions component for easier reuse within alerting * Add method for checking whether to show access control within alerting * Remove accidental console.log from main * Tweak styling for contact point width and add manage permissions drawer * Improve typing for access control type response * Add basic test for manage permissions on contact points list * Only show manage permissions if grafana AM and alertingApiServer is enabled * Update i18n * Add test utils for turning features on and back off * Add access control handlers * Update tests with new util * Pass AM in and add tests * Receiver OSS resource permissions There is a complication that is not fully addressed: Viewer defaults to read:* and Editor defaults to read+write+delete:* This is different to other resource permissions where non-admin are not granted any global permissions and instead access is handled solely by resource-specific permissions that are populated on create and removed on delete. This allows them to easily remove permission to view or edit a single resource from basic roles. The reason this is tricky here is that we have multiple APIs that can create/delete receivers: config api, provisioning api, and k8s receivers api. Config api in particular is not well-equipped to determine when creates/deletes are happening and thus ensuring that the proper resource-specific permissions are created/deleted is finicky. We would also have to create a migration to populate resource-specific permissions for all current receivers. This migration would need to be reset so it can run again if the flag is disabled. * Add access control permissions * Pass in contact point ID to receivers form * Temporarily remove access control check for contact points * Include access control metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/accessControl` * Include new permissions for contact points navbar * Fix receiver creator fixed role to not give global read * Include in-use metadata in k8s receiver List & Get GET: Always included. LIST: Included by adding a label selector with value `grafana.com/inUse` * Add receiver creator permission to receiver writer * Add receiver creator permission to navbar * Always allow listing receivers, don't return 403 * Remove receiver read precondition from receiver create Otherwise, Creator role will not be able to create their first receiver * Update routes permissions * Add further support for RBAC in contact points * Update routes permissions * Update contact points header logic * Back out test feature toggle refactor Not working atm, not sure why * Tidy up imports * Update mock permissions * Revert more test changes * Update i18n * Sync inuse metadata pr * Add back canAdmin permissions after main merge * Split out check for policies navtree item * Tidy up utils and imports and fix rules in use * Fix contact point tests and act warnings * Add missing ReceiverPermissionAdmin after merge conflict * Move contact points permissions * Only show contact points filter when permissions are correct * Move to constants * Fallback to empty array and remove labelSelectors (not needed) * Allow `toAbility` to take multiple actions * Show builtin alertmanager if contact points permission * Add empty state and hide templates if missing permissions * Translations * Tidy up mock data * Fix tests and templates permission * Update message for unused contact points * Don't return 403 when user lists receivers and has access to none * Fix receiver create not adding empty uid permissions * Move SetDefaultPermissions to ReceiverPermissionService * Have SetDefaultPermissions use uid from string Fixes circular dependency * Add FakeReceiverPermissionsService and fix test wiring * Implement resource permission handling in provisioning API and renames Create: Sets to default permissions Delete: Removes permissions Update: If receiver name is modified and the new name doesn't exist, it copies the permissions from the old receiver to the newly created one. If old receiver is now empty, it removes the old permissions as well. * Split contact point permissions checks for read/modify * Generalise getting annotation values from k8s entities * Proxy RouteDeleteAlertingConfig through MultiOrgAlertmanager * Cleanup permissions on config api reset and restore * Cleanup permissions on config api POST note this is still not available with feature flag enabled * Gate the permission manager behind FF until initial migration is added * Sync changes from config api PR * Switch to named export * Revert unnecessary changes * Revert Filter auth change and implement in k8s api only * Don't allow new scoped permissions to give access without FF Prevents complications around mixed support for the scoped permissions causing oddities in the UI. * Fix integration tests to account for list permission change * Move to `permissions` file * Add additional tests for contact points * Fix redirect for viewer on edit page * Combine alerting test utils and move to new file location * Allow new permissions to access provisioning export paths with FF * Always allow exporting if its grafana flavoured * Fix logic for showing auto generated policies * Fix delete logic for contact point only referenced by a rule * Suppress warning message when renaming a contact point * Clear team and role perm cache on receiver rename Prevents temporarily broken UI permissions after rename when a user's source of elevated permissions comes from a cached team or basic role permission. * Debug log failed cache clear on CopyPermissions --------- Co-authored-by: Matt Jacobson <matthew.jacobson@grafana.com>
2024-09-28 02:56:32 +08:00
}
eval = ac.EvalAny(perms...)
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
case http.MethodGet + "/api/v1/provisioning/alert-rules",
http.MethodGet + "/api/v1/provisioning/alert-rules/export":
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningRead),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningRead),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningReadSecrets),
ac.EvalAll( // scopes are enforced in the handler
ac.EvalPermission(ac.ActionAlertingRuleRead),
ac.EvalPermission(dashboards.ActionFoldersRead),
),
)
case http.MethodGet + "/api/v1/provisioning/alert-rules/{UID}",
http.MethodGet + "/api/v1/provisioning/alert-rules/{UID}/export":
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningRead),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningRead),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningReadSecrets),
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead),
ac.EvalPermission(dashboards.ActionFoldersRead),
),
)
case http.MethodGet + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}",
http.MethodGet + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}/export":
scope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":FolderUID"))
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningRead),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningRead),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningReadSecrets),
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead, scope),
ac.EvalPermission(dashboards.ActionFoldersRead, scope),
),
)
Alerting: Add version segment to all provisioning routes (#49121) Co-authored-by: Jean-Philippe Quémémer <jeanphilippe.quemener@grafana.com>
2022-06-03 22:45:08 +08:00
case http.MethodGet + "/api/v1/provisioning/policies",
http.MethodGet + "/api/v1/provisioning/contact-points",
http.MethodGet + "/api/v1/provisioning/templates",
http.MethodGet + "/api/v1/provisioning/templates/{name}",
http.MethodGet + "/api/v1/provisioning/mute-timings",
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
http.MethodGet + "/api/v1/provisioning/mute-timings/{name}":
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningRead),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingNotificationsProvisioningRead), // organization scope
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningReadSecrets),
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
ac.EvalPermission(ac.ActionAlertingNotificationsRead),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
)
// Grafana-only Provisioning Write Paths
case http.MethodPost + "/api/v1/provisioning/alert-rules":
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningWrite),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningWrite),
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleCreate), // more granular permissions are enforced by the handler via "authorizeRuleChanges"
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
)
case http.MethodPut + "/api/v1/provisioning/alert-rules/{UID}":
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningWrite),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningWrite),
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleUpdate), // more granular permissions are enforced by the handler via "authorizeRuleChanges"
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
)
case http.MethodDelete + "/api/v1/provisioning/alert-rules/{UID}":
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningWrite),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningWrite),
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleDelete), // more granular permissions are enforced by the handler via "authorizeRuleChanges"
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
)
case http.MethodDelete + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}":
scope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":FolderUID"))
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningWrite),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningWrite),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleDelete, scope),
ac.EvalPermission(ac.ActionAlertingRuleRead, scope),
ac.EvalPermission(dashboards.ActionFoldersRead, scope),
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
),
)
case http.MethodPut + "/api/v1/provisioning/folder/{FolderUID}/rule-groups/{Group}":
scope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(ac.Parameter(":FolderUID"))
eval = ac.EvalAny(
ac.EvalPermission(ac.ActionAlertingProvisioningWrite),
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingRulesProvisioningWrite),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingRuleRead, scope),
ac.EvalPermission(dashboards.ActionFoldersRead, scope),
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
ac.EvalAny( // the exact permissions will be checked after the operations are determined
ac.EvalPermission(ac.ActionAlertingRuleUpdate, scope),
ac.EvalPermission(ac.ActionAlertingRuleCreate, scope),
ac.EvalPermission(ac.ActionAlertingRuleDelete, scope),
),
),
)
Alerting: Provisioning API - Notification Policies (#46755) * Base-line API for provisioning notification policies * Wire API up, some simple tests * Return provenance status through API * Fix missing call * Transactions * Clarity in package dependencies * Unify receivers in definitions * Fix issue introduced by receiver change * Drop unused internal test implementation * FGAC hooks for provisioning routes * Polish, swap names * Asserting on number of exposed routes * Don't bubble up updated object * Integrate with new concurrency token feature in store * Back out duplicated changes * Remove redundant tests * Regenerate and create unit tests for API layer * Integration tests for auth * Address linter errors * Put route behind toggle * Use alternative store API and fix feature toggle in tests * Fixes, polish * Fix whitespace * Re-kick drone * Rename services to provisioning
2022-04-06 05:48:51 +08:00
Alerting: Add version segment to all provisioning routes (#49121) Co-authored-by: Jean-Philippe Quémémer <jeanphilippe.quemener@grafana.com>
2022-06-03 22:45:08 +08:00
case http.MethodPut + "/api/v1/provisioning/policies",
Alerting: Add method to reset notification policy tree back to the default (#51934) * Define route and run codegen * Wire up HTTP layer * Update API layer and test fakes * Implement reset of policy tree * Implement service layer test and authorization bindings * API layer testing * Be more specific when injecting settings
2022-07-09 05:23:18 +08:00
http.MethodDelete + "/api/v1/provisioning/policies",
Alerting: Add version segment to all provisioning routes (#49121) Co-authored-by: Jean-Philippe Quémémer <jeanphilippe.quemener@grafana.com>
2022-06-03 22:45:08 +08:00
http.MethodPost + "/api/v1/provisioning/contact-points",
http.MethodPut + "/api/v1/provisioning/contact-points/{UID}",
http.MethodDelete + "/api/v1/provisioning/contact-points/{UID}",
http.MethodPut + "/api/v1/provisioning/templates/{name}",
http.MethodDelete + "/api/v1/provisioning/templates/{name}",
http.MethodPost + "/api/v1/provisioning/mute-timings",
http.MethodPut + "/api/v1/provisioning/mute-timings/{name}",
Alerting: Update provisioning API to support regular permissions (#77007) * allow users with regular actions access provisioning API paths * update methods that read rules skip new authorization logic if user CanReadAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * create deltas for single rul e * update modify methods skip new authorization logic if user CanWriteAllRules to avoid performance impact on file-provisioning update all methods to accept identity.Requester that contains all permissions and is required by access control. * implement RuleAccessControlService in provisioning * update file provisioning user to have all permissions to bypass authz * update provisioning API to return errutil errors correctly --------- Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2024-03-23 03:37:10 +08:00
http.MethodDelete + "/api/v1/provisioning/mute-timings/{name}":
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
eval = ac.EvalAny(
Alerting: Add two sets of provisioning actions for rules and notifications (#87149)
2024-05-10 01:19:07 +08:00
ac.EvalPermission(ac.ActionAlertingProvisioningWrite), // organization scope,
ac.EvalPermission(ac.ActionAlertingNotificationsProvisioningWrite), // organization scope
Alerting: Editor role can access all provisioning API (#85022)
2024-03-23 06:14:15 +08:00
ac.EvalAll(
ac.EvalPermission(ac.ActionAlertingNotificationsWrite),
ac.EvalPermission(ac.ActionAlertingProvisioningSetStatus),
),
)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
}
if eval != nil {
RBAC: Remove legacy ac from authorization middleware (#68898) remove legacy AC fallback from RBAC middleware, and some unused auth logic
2023-05-24 16:49:42 +08:00
return authorize(eval)
Alerting: Add support for fine-grained access to alerting APIs (#46561)
2022-03-16 21:36:58 +08:00
}
panic(fmt.Sprintf("no authorization handler for method [%s] of endpoint [%s]", method, path))
Alerting: Split grafana and lotex routes (#44742) * split Lotex and Grafana routes * update template to use authorize function for every route
2022-02-05 01:42:04 +08:00
}