Note: This PR has an [accompanying
PR](https://github.com/openobserve/o2-enterprise/pull/331) in the
enterprise repo
This splits the `openfga` and `dex` modules into their own crates,
`o2_openfga` and `o2_dex`.
**Why?**
We want to be able to reference the `o2_enterprise::openfga` module from
within the `infra::table` module so that we can perform OpenFGA data
migrations as part of data transformation migrations in the
`openobserve` app. However, the `o2_enterprise` module references the
`infra::table` module in various places (eg: inside
`o2_enterprise::enterprise::actions::action_manager`). Therefore we
cannot reference `o2_enterprise::enterprise::openfga` from
`infra::table` without introducing a circular dependency.
The solution presented by this PR is to move the `openfga` module into
its own crate, so that `infra::table` can reference the new create
without creating a circular dependency. As part of this PR we also move
the `dex` module into its own crate since the `openfga` module depends
on the `dex` module, and we do not want the new `o2_openfga` crate to
depend on the `o2_enterprise` crate.
for debug the #5398
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
- **Configuration**
- Added new configuration option to disable keep-alive connections
- Adjusted HTTP server connection timeout settings
- **Authentication**
- Enhanced token validation with improved traceability
- Updated authentication methods to support more detailed request
tracking
- **Performance**
- Optimized client lock management in MaxMind database downloader
- Refined request handling in RUM ingestion APIs
- **Logging**
- Improved logging for authentication and request processing
- Added trace ID support for better request tracking
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: domyway <weizhao029@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Enhanced enterprise-level access control for user authentication.
- Added stricter login requirements for non-root users when
`root_only_login` is enabled.
- **Bug Fixes**
- Improved authentication validation process to prevent unauthorized
access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR introduces the service accounts with tokens
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
- **New Features**
- Introduced a new module for managing service accounts, including
functionalities for listing, creating, updating, and deleting service
accounts.
- Added a new tab for "Service Accounts" in the Identity Access
Management interface.
- Enhanced user management interfaces to support service account
operations, including the ability to add and edit service accounts.
- Implemented a new component for managing service accounts within
groups and roles.
- Added new API endpoints for service account management, including
token operations.
- Introduced a comprehensive Vue component for managing service accounts
with enhanced features, including filtering, searching, and token
management.
- Enhanced permission checks and error handling for service accounts
across various functions.
- Added support for external user permissions in service account
operations.
- Enhanced error handling for various components to prevent unnecessary
notifications on permission-related issues.
- Added localization support for service account functionalities,
providing necessary labels for user interface elements.
- **Bug Fixes**
- Improved error handling and validation across user management and
service account functionalities.
- **Documentation**
- Updated localization files to support new service account features and
labels.
- **Style**
- Adjusted styles in various components to enhance usability and
consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: oasisk <ashish.j.kolhe@gmail.com>
Co-authored-by: Subhradeep Chakraborty <chakrabortysubhradeep556@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Introduced a new `RedirectResponse` struct for improved HTTP
redirection handling.
- Enhanced authentication validation with a new redirect mechanism for
`/short/` requests.
- Updated the `retrieve` function to improve logging and response
handling.
- **Bug Fixes**
- Improved error management for authentication failures.
- **Refactor**
- Restructured route configurations to integrate new authentication
middleware and enhance service management.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: oasisk <ashish.j.kolhe@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Enhanced authentication and authorization handling for user requests
with more efficient token validation.
- **Bug Fixes**
- Improved error handling and response based on user permissions and
authorization status.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Support basic-auth header parsing and login for enterprise-GET requests
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved logging for user validation to aid in debugging.
- **New Features**
- Enhanced authentication process with better handling of headers and
tokens.
- Introduced new cookie preparation functionality to streamline cookie
management during authentication.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- [x] Includes the following APIs endpoints in auditing -
- `/auth/login` - If the login is successful, the user email along with
the event data (such as response code, path, method, query params and
the timestamp) and if it is unsuccessful, it still audits the event, but
username will be present only if available.
- `/auth/presigned-url`
- `/auth/login` - `GET` request. Similar to the first `login` endpoint.
- `/config/reload` - Audits this event, but as this is not a protected
route, the username will not be present in the audit record.
- `/config/redirect` - Similar to the first `login` endpoint.
- `/config/logout`
- [x] Audit Cron job is run on all the nodes including the router. The
interval can be set through `O2_AUDIT_PUBLISH_INTERVAL` env (in
seconds).
- [x] In case of remote usage reporing, print the error if response from
remote usage url is unsuccessful
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Introduced enhanced auditing functionalities for user authentication
and authorization in the enterprise version.
- Added asynchronous task for auditing and publishing tasks within job
module.
- **Improvements**
- Refined error handling in usage data ingestion to better manage
success and failure responses.
- **Conditional Compilation**
- Multiple new functionalities and auditing enhancements are now
conditionally compiled based on the "enterprise" feature.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Enhanced user authentication by adding extended password fields and
support for generating presigned login URLs.
- Improved user management with new functions for handling user data and
authentication tokens.
- **Bug Fixes**
- Fixed issues with user data handling by passing references instead of
values in database operations.
- **Refactor**
- Streamlined authentication and user management code for better
maintainability and performance.
- **Tests**
- Added new test cases to validate password hashing and presigned URL
generation functionalities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: oasisk <ashish.j.kolhe@gmail.com>
Co-authored-by: Bhargav <BJP232004@GMAIL.COM>
The new endpoint `/config/reload` will refresh the
environment variables.
There are a bunch of env-vars which will not be reloaded
for e.g. HTTP_PORT etc. these will need a restart.
---------
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
Due to changes in the current architecture the access-token is being
sent as a cookie - `access_token` so this change facilitates accessing
the proxy url via the same mechanism
---------
Co-authored-by: omkark06 <omkar@zinclabs.io>
Hengfei Yang
Subhra264
Patrick Sullivan
Prabhat Sharma
Ankur Srivastava
gaetan-craftandTaiming Liu
