New OnCall initialization process

.github/CODEOWNERS

@@ -1,5 +1,6 @@
 * @grafana/grafana-oncall-backend
 /grafana-plugin @grafana/grafana-oncall-frontend
+/grafana-plugin/pkg @grafana/grafana-oncall-backend
 /docs @grafana/docs-gops @grafana/grafana-oncall
 
 # `make docs` procedure is owned by @jdbaldry of @grafana/docs-squad.

.github/actions/build-sign-and-package-plugin/action.yml

@@ -27,6 +27,13 @@ runs:
       # yamllint disable rule:line-length
       run: |
         echo filename="grafana-oncall${{ inputs.is_enterprise == 'true' && '-ee' || '' }}-app-${{ inputs.plugin_version_number }}.zip" >> $GITHUB_OUTPUT
+    - name: Install Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: "1.21.5"
+    - name: Install Mage
+      shell: bash
+      run: go install github.com/magefile/[email protected]
     - name: Build, sign, and package plugin
       shell: bash
       working-directory: ${{ inputs.working_directory }}
@@ -35,6 +42,7 @@ runs:
       run: |
         jq --arg v "${{ inputs.plugin_version_number }}" '.version=$v' package.json > package.new && mv package.new package.json && jq '.version' package.json;
         yarn build
+        mage buildAll
         yarn sign
         if [ ! -f dist/MANIFEST.txt ]; then echo "Sign failed, MANIFEST.txt not created, aborting." && exit 1; fi
         mv dist grafana-oncall-app

.github/workflows/e2e-tests.yml

@@ -109,13 +109,11 @@ jobs:
 
       # ---------- Expensive e2e tests steps start -----------
       - name: Install Go
-        if: inputs.run-expensive-tests
         uses: actions/setup-go@v4
         with:
           go-version: "1.21.5"
 
       - name: Install Mage
-        if: inputs.run-expensive-tests
         run: go install github.com/magefile/[email protected]
 
       - name: Get Vault secrets

.github/workflows/linting-and-tests.yml

@@ -12,7 +12,7 @@ env:
 jobs:
   lint-entire-project:
     name: "Lint entire project"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
         uses: actions/checkout@v4
@@ -26,7 +26,7 @@ jobs:
 
   lint-test-and-build-frontend:
     name: "Lint, test, and build frontend"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
         uses: actions/checkout@v4
@@ -38,7 +38,7 @@ jobs:
 
   test-technical-documentation:
     name: "Test technical documentation"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     steps:
       - name: "Check out code"
         uses: "actions/checkout@v4"
@@ -55,7 +55,7 @@ jobs:
 
   lint-migrations-backend-mysql-rabbitmq:
     name: "Lint database migrations"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     services:
       rabbit_test:
         image: rabbitmq:3.12.0
@@ -86,7 +86,7 @@ jobs:
 
   unit-test-helm-chart:
     name: "Helm Chart Unit Tests"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
         uses: actions/checkout@v4
@@ -98,6 +98,16 @@ jobs:
       - name: Run tests
         run: helm unittest ./helm/oncall
 
+  unit-test-backend-plugin:
+    name: "Backend Tests: Plugin"
+    runs-on: ubuntu-latest-16-cores
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: "1.21.5"
+      - run: cd grafana-plugin && go test ./pkg/...
+
   unit-test-backend-mysql-rabbitmq:
     name: "Backend Tests: MySQL + RabbitMQ (RBAC enabled: ${{ matrix.rbac_enabled }})"
     runs-on: ubuntu-latest-16-cores
@@ -201,7 +211,7 @@ jobs:
 
   unit-test-migrators:
     name: "Unit tests - Migrators"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
         uses: actions/checkout@v4
@@ -215,7 +225,7 @@ jobs:
 
   mypy:
     name: "mypy"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     steps:
       - name: Checkout project
         uses: actions/checkout@v4
@@ -227,10 +237,15 @@ jobs:
 
   end-to-end-tests:
     name: Standard e2e tests
+    strategy:
+      matrix:
+        grafana_version:
+          - 10.3.3
+          - 10.1.7
+      fail-fast: false
     uses: ./.github/workflows/e2e-tests.yml
     with:
-      # TODO: fix issues with running e2e tests against Grafana v10.2.x and v10.3.x
-      grafana_version: 10.1.7
-      # grafana_version: 10.3.3
+      grafana_version: ${{ matrix.grafana_version }}
       run-expensive-tests: false
       browsers: "chromium"
+    secrets: inherit

Tiltfile

@@ -20,7 +20,7 @@ if not running_under_parent_tiltfile:
     # Load the custom Grafana extensions
     v1alpha1.extension_repo(
         name="grafana-tilt-extensions",
-        ref="v1.2.0",
+        ref="v1.4.2",
         url="https://github.com/grafana/tilt-extensions",
     )
 v1alpha1.extension(
@@ -63,7 +63,7 @@ docker_build_sub(
 if is_ci:
     local_resource(
         "build-ui",
-        labels=["OnCallUI"],
+        labels=["OnCallPluginUI"],
         dir="grafana-plugin",
         cmd="yarn build",
         allow_parallel=True,
@@ -81,13 +81,30 @@ if not is_ci:
         allow_parallel=True,
     )
 
+local_resource(
+    'build-oncall-plugin-backend',
+    labels=["OnCallPluginBackend"],
+    dir="./grafana-plugin",
+    cmd="mage buildAll",
+    deps=['grafana-plugin/pkg/plugin']
+)
+
+local_resource(
+    'restart-oncall-plugin-backend',
+    labels=["OnCallPluginBackend"],
+    dir="./dev/scripts",
+    cmd="chmod +x ./restart_backend_plugin.sh && ./restart_backend_plugin.sh",
+    resource_deps=["grafana", "build-oncall-plugin-backend"],
+    deps=['grafana-plugin/pkg/plugin']
+)
+
 local_resource(
     "e2e-tests",
     labels=["allTests"],
     cmd=e2e_tests_cmd,
     trigger_mode=TRIGGER_MODE_MANUAL,
     auto_init=is_ci,
-    resource_deps=["build-ui", "grafana", "grafana-oncall-app-provisioning-configmap", "engine", "celery"]
+    resource_deps=["build-ui", "grafana", "grafana-oncall-app-provisioning-configmap", "engine", "celery", "build-oncall-plugin-backend"]
 )
 
 cmd_button(
@@ -183,11 +200,13 @@ if not running_under_parent_tiltfile:
         context="grafana-plugin",
         plugin_files=["grafana-plugin/src/plugin.json"],
         namespace="default",
-        deps=["grafana-oncall-app-provisioning-configmap", "build-ui"],
+        deps=["grafana-oncall-app-provisioning-configmap", "build-ui", "build-oncall-plugin-backend"],
         extra_env={
             "GF_SECURITY_ADMIN_PASSWORD": "oncall",
             "GF_SECURITY_ADMIN_USER": "oncall",
             "GF_AUTH_ANONYMOUS_ENABLED": "false",
+            "GF_FEATURE_TOGGLES_ENABLE": "externalServiceAccounts",
+            "ONCALL_API_URL": "http://oncall-dev-engine:8080"
         },
     )
 

dev/grafana/provisioning/plugins/grafana-oncall-app-provisioning.yaml

@@ -5,4 +5,6 @@ apps:
     jsonData:
       stackId: 5
       orgId: 100
-      onCallApiUrl: http://oncall-dev-engine:8080
+      license: OpenSource
+      onCallApiUrl: $ONCALL_API_URL
+      grafanaUrl: http://grafana:3000

dev/helm-local.yml

@@ -70,7 +70,7 @@ grafana:
         - name: DATABASE_PASSWORD
           value: oncallpassword
   env:
-    GF_FEATURE_TOGGLES_ENABLE: topnav
+    GF_FEATURE_TOGGLES_ENABLE: topnav,externalServiceAccounts
     GF_SECURITY_ADMIN_PASSWORD: oncall
     GF_SECURITY_ADMIN_USER: oncall
     GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS: grafana-oncall-app

dev/scripts/restart_backend_plugin.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# Find a grafana pod
+pod=$(kubectl get pods -l app.kubernetes.io/name=grafana -o=jsonpath='{.items[0].metadata.name}')
+
+if [ -z "$pod" ]; then
+    echo "No pod found with the specified label."
+    exit 1
+fi
+
+# Exec into the pod
+kubectl exec -it "$pod" -- /bin/bash <<'EOF'
+
+# Find and kill the process containing "gpx_grafana" (plugin backend process)
+process_id=$(ps aux | grep gpx_grafana | grep -v grep | awk '{print $1}')
+echo $process_id
+if [ -n "$process_id" ]; then
+    echo "Killing process $process_id"
+    kill $process_id
+else
+    echo "No process containing 'gpx_grafana' in COMMAND found."
+fi
+EOF

docker-compose-developer.yml

@@ -52,8 +52,6 @@ services:
       context: ./grafana-plugin
       dockerfile: Dockerfile.dev
       labels: *oncall-labels
-    environment:
-      ONCALL_API_URL: http://host.docker.internal:8080
     volumes:
       - ./grafana-plugin:/etc/app
       - node_modules_dev:/etc/app/node_modules
@@ -324,6 +322,8 @@ services:
       GF_SECURITY_ADMIN_USER: oncall
       GF_SECURITY_ADMIN_PASSWORD: oncall
       GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS: grafana-oncall-app
+      GF_FEATURE_TOGGLES_ENABLE: externalServiceAccounts
+      ONCALL_API_URL: http://host.docker.internal:8080
     env_file:
       - ./dev/.env.${DB}.dev
     ports:

engine/apps/auth_token/auth.py

@@ -11,9 +11,11 @@
 
 from apps.api.permissions import GrafanaAPIPermission, LegacyAccessControlRole, RBACPermission, user_is_authorized
 from apps.grafana_plugin.helpers.gcom import check_token
+from apps.grafana_plugin.sync_data import SyncUser
 from apps.user_management.exceptions import OrganizationDeletedException, OrganizationMovedException
 from apps.user_management.models import User
 from apps.user_management.models.organization import Organization
+from apps.user_management.sync import get_or_create_user
 from settings.base import SELF_HOSTED_SETTINGS
 
 from .constants import GOOGLE_OAUTH2_AUTH_TOKEN_NAME, SCHEDULE_EXPORT_TOKEN_NAME, SLACK_AUTH_TOKEN_NAME
@@ -149,19 +151,34 @@ def _get_user(request: Request, organization: Organization) -> User:
         except (ValueError, TypeError):
             raise exceptions.AuthenticationFailed("Grafana context must be JSON dict.")
 
-        if "UserId" not in context and "UserID" not in context:
-            raise exceptions.AuthenticationFailed("Invalid Grafana context.")
-
-        try:
-            user_id = context["UserId"]
-        except KeyError:
-            user_id = context["UserID"]
-
         try:
-            return organization.users.get(user_id=user_id)
+            user_id = context.get("UserId", context.get("UserID"))
+            if user_id is not None:
+                return organization.users.get(user_id=user_id)
+            elif "Login" in context:
+                return organization.users.get(username=context["Login"])
+            else:
+                raise exceptions.AuthenticationFailed("Grafana context must specify a User or UserID.")
         except User.DoesNotExist:
-            logger.debug(f"Could not get user from grafana request. Context {context}")
-            raise exceptions.AuthenticationFailed("Non-existent or anonymous user.")
+            try:
+                user_data = dict(json.loads(request.headers.get("X-Oncall-User-Context")))
+            except (ValueError, TypeError):
+                raise exceptions.AuthenticationFailed("User context must be JSON dict.")
+            if user_data:
+                user_sync_data = SyncUser(
+                    id=user_data["id"],
+                    name=user_data["name"],
+                    login=user_data["login"],
+                    email=user_data["email"],
+                    role=user_data["role"],
+                    avatar_url=user_data["avatar_url"],
+                    permissions=user_data["permissions"] or [],
+                    teams=user_data.get("teams", None),
+                )
+                return get_or_create_user(organization, user_sync_data)
+            else:
+                logger.debug("Could not get user from grafana request.")
+                raise exceptions.AuthenticationFailed("Non-existent or anonymous user.")
 
 
 class PluginAuthenticationSchema(OpenApiAuthenticationExtension):