2bcbac8454
Related to https://github.com/grafana/oncall-private/issues/2826 Continuing work started in https://github.com/grafana/oncall/pull/5211, this adds support for Grafana service accounts tokens for API authentication (except alert group actions which will still require a user behind). Next steps would be updating the go client and the terraform provider to allow service account token auth for OnCall resources. Following proposal 1.1 from [doc](https://docs.google.com/document/d/1I3nFbsUEkiNPphBXT-kWefIeramTY71qqZ1OA06Kmls/edit?usp=sharing).
43 lines
1.6 KiB
Python
43 lines
1.6 KiB
Python
from rest_framework.permissions import IsAuthenticated
|
|
from rest_framework.settings import api_settings
|
|
from rest_framework.viewsets import ReadOnlyModelViewSet
|
|
|
|
from apps.api.permissions import RBACPermission
|
|
from apps.auth_token.auth import ApiTokenAuthentication, GrafanaServiceAccountAuthentication
|
|
from apps.public_api.serializers import OrganizationSerializer
|
|
from apps.public_api.throttlers.user_throttle import UserThrottle
|
|
from apps.user_management.models import Organization
|
|
from common.api_helpers.mixins import RateLimitHeadersMixin
|
|
from common.api_helpers.paginators import TwentyFivePageSizePaginator
|
|
|
|
|
|
class OrganizationView(
|
|
RateLimitHeadersMixin,
|
|
ReadOnlyModelViewSet,
|
|
):
|
|
authentication_classes = (GrafanaServiceAccountAuthentication, ApiTokenAuthentication)
|
|
permission_classes = (IsAuthenticated, RBACPermission)
|
|
|
|
rbac_permissions = {
|
|
"retrieve": [RBACPermission.Permissions.OTHER_SETTINGS_READ],
|
|
}
|
|
|
|
throttle_classes = [UserThrottle]
|
|
|
|
model = Organization
|
|
serializer_class = OrganizationSerializer
|
|
|
|
pagination_class = TwentyFivePageSizePaginator
|
|
|
|
def get_queryset(self):
|
|
# It's a dirty hack to get queryset from the object. Just in case we'll return multiple teams in the future.
|
|
return Organization.objects.filter(pk=self.request.auth.organization.pk)
|
|
|
|
def get_object(self):
|
|
return self.request.auth.organization
|
|
|
|
def get_success_headers(self, data):
|
|
try:
|
|
return {"Location": str(data[api_settings.URL_FIELD_NAME])}
|
|
except (TypeError, KeyError):
|
|
return {}
|