Commit Graph

548 Commits

Author SHA1 Message Date
Josh Hunt bda895ec03
Metrics: Add http_response_size_bytes metric (#110428)
* Metrics: Add http_response_size_bytes metric

* add better handler names for public asset paths

* fix tests

* comment

* remove debug log

* exemplar
2025-09-03 14:47:38 +01:00
xavi 16b7535dd4
Forbid more redirect patterns (#110337) 2025-09-02 16:12:39 +02:00
Josh Hunt 1bd9541507
FrontendService: Add tracing and logging middleware (#107956)
* FrontendService: Add tracing and logging middleware

* tests!

* middleware tests

* context middleware test

* revert http_server back to previous version

* fix lint

* fix test

* use http.NotFound instead of custom http handler

* use existing tracer for package

* use otel/trace.Tracer in request_tracing middleware

* tidy up tracing in contextMiddleware

* fix 404 test

* remove spans from contextMiddleware

* comment
2025-07-22 18:55:44 +01:00
Misi 4669b586e9
Security: Fixes for CVE-2025-6197 and CVE-2025-6023 (#108330)
apply security patch: main/439-202506251632.patch

(cherry picked from commit 7f3977c54548dc82d9b2c44c125b30b3dbc2069a)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-07-18 09:06:26 -06:00
Josh Hunt 759aa12d2b
Revert "Build swagger ui in seperate webpack build" (#104580)
Revert "Build swagger ui in seperate webpack build (#102046)"

This reverts commit 314e337d76.
2025-04-25 22:07:43 +01:00
Josh Hunt 314e337d76
Build swagger ui in seperate webpack build (#102046)
* Build swagger ui in seperate webpack build

* render grafana and swagger

* include light theme

* merge main

* update webassets usage

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2025-04-25 14:22:57 +01:00
Ryan McKinley 7b492d7e16
FEMT: Add feature toggle and expose the service in regular grafana (#104428) 2025-04-25 12:24:25 +03:00
wuweng 3320dc116e
skip trace for '/api/health' endpoint (#103430)
* skip trace for '/api/health' endpoint

* fix formatting

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
2025-04-15 15:47:58 -04:00
Mariell Hoversholm 757be6365a
CI: Bump golangci-lint to 2.0.2 (#103572) 2025-04-10 14:42:23 +02:00
Ashley Harrison f3fb9592da
Org redirection: Fix linking between orgs (#102021)
* don't trim path

* add unit test
2025-03-13 09:42:12 +00:00
Matheus Macabu 3539764008
Hackaton: Add more unit tests, take 3 (#101525)
* serviceaccounts/secretscan: test Service more thoroughly

* middleware/cookies: add tests for CookieOptions

* anonymous/anonimpl: cover a couple more methods

* components/imguploader: Implement WebDAV integration tests

* components/apikeygen: also check IsValid method

* bus: cover invalid callback signature cases

* cloudmigration/objectstorage: add basic unit tests

* login/social/connectors: add test case for GitHub OAuth fetch emails+orgs

* expr/classic: cover more evaluator types in tests
2025-03-05 08:00:12 +01:00
Gabriel MABILLE f3433fd472
RBAC: Remove accessControlOnCall feature toggle (#101222)
* RBAC: Remove accessControlOnCall feature toggle

* Leave the other one in place

* Tests

* frontend

* Readd empty ft to frontend test

* Remove legacy RBAC check

* Fix test

* no need for context

* Remove unused variable

* Remove unecessary param

* remove unecessary param from tests

* More tests :D
2025-02-25 13:44:40 +01:00
Charandas ea788975e0
K8s: refactor build handler chain func to allow easier injection from enterprise (#100777) 2025-02-15 04:08:00 +02:00
Ryan McKinley 680e6bc1f8
Authlib: Use types package rather than claims (#99243) 2025-01-21 12:06:55 +03:00
jackyin 4477cad1ba
Org: Fix redirection logic to work consistently (#96521)
fix unexpected redirection
2024-12-17 14:20:18 +00:00
Jo 40d3b02648
Auth: Separate anonymous settings to its own struct (#97791)
separate anonymous settings to its own struct
2024-12-13 10:46:27 +01:00
Ezequiel Victorero 5039725da6
Snapshots: Add RBAC roles for creating and deleting (#96126) 2024-11-26 09:13:17 -03:00
Cedric Ziel 89e7e25b60
Backend: Inject server-timing header to match initial loads with client-side telemetry (#94978)
feat: inject server-timing header to match initial loads with client-side telemetry

Faro Web SDK can read the server-timing info and
correlate the initial request with the client side telemetry gather from navigation timings.
2024-11-19 10:01:58 +02:00
Misi 0539ccf10d
Auth: Fix redirection when auto_login is enabled (#94311)
* Fix for SAML auto login

* Fix for OAuth auto login
2024-10-07 14:59:00 +02:00
Misi d411ce2664
Auth: Use sessionStorage instead of cookie for automatic redirection (#92759)
* WIP: working as expected, has to be tested

* Rename query param, small changes

* Remove unused code

* Address feedback

* Cleanup

* Use the feature toggle to control the behaviour

* Use the toggle on the FE too

* Prevent the extra redirect/reload

 Co-authored-by: Josh Hunt <joshhunt@users.noreply.github.com>

* Return to login if user is not authenticated

* Add tracking issue

* Align BE redirect constructor to locationSvc
2024-09-24 18:38:09 +02:00
Syerikjan Kh 715ee35abc
RBAC: Check forceLogin inside CanAdminPlugins (#93449) 2024-09-20 09:35:58 -04:00
Jan-Otto Kröpke e2bce38a79
App Plugins: Allow resource handle to define Cache-Control Header (#92559) 2024-09-17 10:28:38 +02:00
Adela Almasan f64b121ddb
Canvas: Allow API calls to grafana origin (#91822)
* allow post URL
* check for config
* allow relative paths
* add allowed internal pattern; add checks for method
* update defaults.ini
* add custom header
* update config comment
* use globbing, switch to older middleware - deprecated call
* add codeowner
* update to use current api, add test
* update fall through logic

* Update pkg/middleware/validate_action_url.go

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update pkg/middleware/validate_action_url.go

Co-authored-by: Dan Cech <dcech@grafana.com>

* add more tests

* Update pkg/middleware/validate_action_url_test.go

Co-authored-by: Dan Cech <dcech@grafana.com>

* fix request headers

* add additional tests for all verbs

* fix request headers++

* throw error when method is unknown

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
Co-authored-by: Brian Gann <bkgann@gmail.com>
Co-authored-by: Brian Gann <briangann@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
2024-09-10 10:45:27 -04:00
Todd Treece 733ae1f099
Chore: Skip gzip for apiserver routes (#92245) 2024-08-21 23:47:58 +03:00
Karl Persson 8bcd9c2594
Identity: Remove typed id (#91801)
* Refactor identity struct to store type in separate field

* Update ResolveIdentity to take string representation of typedID

* Add IsIdentityType to requester interface

* Use IsIdentityType from interface

* Remove usage of TypedID

* Remote typedID struct

* fix GetInternalID
2024-08-13 10:18:28 +02:00
Kevin Minehart c326d865c5
RBAC: Allow plugins to use scoped actions (#90946)
Co-authored-by: gamab <gabriel.mabille@grafana.com>
2024-07-25 17:22:42 +03:00
Ryan McKinley 9db3bc926e
Identity: Rename "namespace" to "type" in the requester interface (#90567) 2024-07-25 12:52:14 +03:00
Charandas c210617735
K8s: use contexthandler in standalone handler chain (#90102) 2024-07-08 12:22:10 -07:00
Dave Henderson 7ac757afcb
infra(tracing): Fix span naming order-of-operations bug (#90025) 2024-07-04 07:05:14 -04:00
Dave Henderson 4ec4994e89
infra(tracing): Always end started spans (#90016)
Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
2024-07-03 16:25:57 -04:00
Marcus Andersson 04f39457cf
Chore: Remove sensitive information from presigned URLs prior to logging (#87035)
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>
2024-06-24 14:53:42 +02:00
Dave Henderson 3bbc821131
Metrics: Add ability to disable classic histogram for HTTP metric (#88315)
metrics: Add ability to disable classic histogram for HTTP metric

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
2024-06-18 15:37:44 -04:00
Ryan McKinley 99d8025829
Chore: Move identity and errutil to apimachinery module (#89116) 2024-06-13 07:11:35 +03:00
Timur Olzhabayev 4761326568
Fix: Proper plugin logo loading depending on staging (#88247)
* making logos respect the staging

* making it work when served from subfolders

* fixing helper test
2024-05-27 10:26:30 +02:00
Karl Persson c4cfee8d96
User: support setting org and help flags though update function (#86535)
* User: Support setting active org through update function

* User: add support to update help flags through update function
2024-04-29 08:53:05 +02:00
Karl Persson 0fa983ad8e
AuthN: Use typed namespace id inside authn package (#86048)
* authn: Use typed namespace id inside package
2024-04-24 09:57:34 +02:00
Alex Khomenko 44e1bce55a
Feature toggles: Remove dashboardEmbed toggle (#86587) 2024-04-19 12:48:08 +02:00
carrychair 0913324668
Chore: Remove repetitive words (#84132)
remove repetitive words

Signed-off-by: carrychair <linghuchong404@gmail.com>
2024-03-11 08:55:18 -04:00
김은빈 96dfb385ca
Grafana: Replace magic number with a constant variable in response status (#80132)
* Chore: Replace response status with const var

* Apply suggestions from code review

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>

* Add net/http import

---------

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
2024-02-27 18:39:51 +02:00
Torkel Ödegaard 8f36f905ee
SceneSolo: Minor fixes (#82289)
* SceneSolo: Minor fixes

* remove logging
2024-02-12 16:23:12 +01:00
Carl Bergquist c9de794d7f
instrumentation: these features have been enabled for a while (#81617)
Signed-off-by: bergquist <carl.bergquist@gmail.com>
2024-02-06 00:29:41 -08:00
Marcus Efraimsson 6768c6c059
Chore: Remove public vars in setting package (#81018)
Removes the public variable setting.SecretKey plus some other ones. 
Introduces some new functions for creating setting.Cfg.
2024-01-23 12:36:22 +01:00
Torkel Ödegaard e924627659
Frontend: Reload the browser when backend configuration/assets change (#79057)
* Detect frontend asset changes

* Update

* merge main

* Frontend: Detect new assets / versions / config changes (#79258)

* avoid first check

* Updates and add tests

* Update

* Update

* Updated code

* refine

* use context

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2024-01-04 08:00:07 +01:00
Will Browne 0b511aaace
Plugins: Add backend check for app page role access (#78269)
* add backend check for roles

* tidy

* fix tests

* incorporate rbac

* fix linter

* apply PR feedback

* add tests

* fix logic

* add comment

* apply PR feedback
2023-12-18 16:12:46 +01:00
Ezequiel Victorero 864d91ed3e
Export: Remove no-store headers in pdf and image previews (#78844) 2023-12-18 09:21:57 -03:00
Torkel Ödegaard ed128ea964
Frontend: Foundations for multi tenant frontend (#78815)
* Frontend: Foundations for multi tenant frontend

* improve manifest parsing for multi-tenant frontend (#78876)

* add test

* add test

* ??

* Updates

* Added cache

* test cleanup

* lint

* fix test

* fix error templates

* cleanup

* remove copy

* revert changes to list testdata

* comment cleanup

* prepare integration tests

* Remove integrety

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2023-12-05 08:34:22 +01:00
Oscar Kilhed 4c4f11f4b3
Avatar: Allow browser caching of /avatar/ (#78314)
don't set no-store headers to /avatar/
2023-11-22 17:41:54 +01:00
Ryan McKinley f69fd3726b
FeatureToggles: Add context and and an explicit global check (#78081) 2023-11-14 12:50:27 -08:00
Gabriel MABILLE 420fb56fda
RBAC: Fix plugins pages access-control (#76321)
* RBAC: Fix plugins pages access-control

* Better comment

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Add a small comment on connections/datasources routes

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2023-10-12 10:46:43 +02:00
Jo dcd0c6b11e
Identity: Unfurl OrgID in pkg/services to allow using identity.Requester interface (#76113)
Unfurl OrgID in pkg/services to allow using identity.Requester interface
2023-10-09 10:40:19 +02:00