2bcbac8454
Related to https://github.com/grafana/oncall-private/issues/2826 Continuing work started in https://github.com/grafana/oncall/pull/5211, this adds support for Grafana service accounts tokens for API authentication (except alert group actions which will still require a user behind). Next steps would be updating the go client and the terraform provider to allow service account token auth for OnCall resources. Following proposal 1.1 from [doc](https://docs.google.com/document/d/1I3nFbsUEkiNPphBXT-kWefIeramTY71qqZ1OA06Kmls/edit?usp=sharing).
36 lines
1.6 KiB
Python
36 lines
1.6 KiB
Python
from rest_framework import viewsets
|
|
from rest_framework.mixins import ListModelMixin, RetrieveModelMixin
|
|
from rest_framework.permissions import IsAuthenticated
|
|
|
|
from apps.api.permissions import RBACPermission
|
|
from apps.auth_token.auth import ApiTokenAuthentication, GrafanaServiceAccountAuthentication
|
|
from apps.public_api.serializers.teams import TeamSerializer
|
|
from apps.public_api.tf_sync import is_request_from_terraform, sync_teams_on_tf_request
|
|
from apps.public_api.throttlers.user_throttle import UserThrottle
|
|
from apps.user_management.models import Team
|
|
from common.api_helpers.mixins import PublicPrimaryKeyMixin
|
|
from common.api_helpers.paginators import FiftyPageSizePaginator
|
|
|
|
|
|
class TeamView(PublicPrimaryKeyMixin, RetrieveModelMixin, ListModelMixin, viewsets.GenericViewSet):
|
|
serializer_class = TeamSerializer
|
|
authentication_classes = (GrafanaServiceAccountAuthentication, ApiTokenAuthentication)
|
|
permission_classes = (IsAuthenticated, RBACPermission)
|
|
|
|
rbac_permissions = {
|
|
"list": [RBACPermission.Permissions.USER_SETTINGS_READ],
|
|
"retrieve": [RBACPermission.Permissions.USER_SETTINGS_READ],
|
|
}
|
|
|
|
model = Team
|
|
pagination_class = FiftyPageSizePaginator
|
|
throttle_classes = [UserThrottle]
|
|
|
|
def get_queryset(self):
|
|
if is_request_from_terraform(self.request):
|
|
sync_teams_on_tf_request(self.request.auth.organization)
|
|
name = self.request.query_params.get("name", None)
|
|
queryset = self.request.auth.organization.teams.all()
|
|
if name:
|
|
queryset = queryset.filter(name=name)
|
|
return queryset.order_by("id")
|