feat: add service account checks in plugin auth #5305
Conversation
matiasb
added
pr:no public docs
matiasb
force-pushed
the
matiasb/service-account-plugin-auth-check
branch
from
bfcc21c to
6b69970
Compare
| @@ -133,6 +134,14 @@ def _get_user(request: Request, organization: Organization) -> User: | |||
| except KeyError: | |||
| user_id = context["UserID"] | |||
|
|
|||
| if context.get("IsServiceAccount", False): | |||
There was a problem hiding this comment.
This just reminded me we need to clean-up the GrafanaHeadersMixin in mixins.py at some point whenever we remove the old status endpoint. This way of doing it is better in that it is more tolerant of missing/different fields when dealing with plugin rollout difference between objects.
| grafana_url = request.headers.get(X_GRAFANA_URL) | ||
| if grafana_url: | ||
| organization = Organization.objects.filter(grafana_url=grafana_url).first() | ||
| if not organization: | ||
| raise exceptions.AuthenticationFailed("Invalid Grafana URL.") | ||
| success = setup_organization(grafana_url, auth) |
There was a problem hiding this comment.
just out of curiosity, what's the use-case for the new setup_organization call here?
There was a problem hiding this comment.
There is a use case in which you can bootstrap a Grafana stack from scratch (via Terraform), setting up a service account token in the process with which you could hit our API and OnCall may not know about the organization yet, so this should sync the org if the service account token auth passes and we don't have a record for that org yet.
Related to https://github.com/grafana/oncall-private/issues/2826
Related to https://github.com/grafana/irm/pull/459
Allow org sync requests from service account users. Also trigger a sync during public API requests if the org wasn't yet setup.