feat(raw): authenticate embedded Grafana with a service account token - #3
Merged
Merged
Conversation
The `raw grafana …` commands target app.groundcover.com/grafana/api/*, an embedded Grafana behind a session-gated proxy that ignores the gcsa bearer token: every call returned the ~980KB Grafana SPA index.html instead of JSON. Route WebApp (grafana) commands through a plain HTTP client that sets Authorization: Bearer <glsa_...> from GROUNDCOVER_GRAFANA_SERVICE_ACCOUNT_TOKEN (or --grafana-token), bypassing the SDK transport that would clobber the header with the gcsa key. Non-grafana raw commands are unchanged (gcsa + X-Backend-Id via SDK transport, plus X-Tenant-UUID when set). Verified live: `raw grafana search` and `folders list` return real JSON.
Running any `raw grafana ...` command without a Grafana service account token now prints an actionable setup guide instead of a one-line error: how to generate a glsa_ token with groundcover's official CLI (install, auth login, auth generate-service-account-token) and hand it to this CLI. The official CLI also ships a `groundcover` binary; its installer puts it in ~/.groundcover/bin and prepends that dir to PATH, shadowing this CLI. The guide calls that out and steers users to invoke the official binary by full path. Removes the now-superseded config.RequireGrafanaToken (terse message) in favor of the raw-layer guide. Tests cover the guide content and the missing-token short-circuit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
raw grafana …commands never worked. They target the embedded Grafana atapp.groundcover.com/grafana/api/*, which is behind a session-gated proxy thatignores the
gcsa_API key. Every call returned the ~980KB Grafana SPAindex.html(HTTP 200,text/html) instead of JSON.Verified: the
gcsa_bearer is valid against the real API(
api.groundcover.com/api/*returns JSON), so the breakage was specific to theGrafana proxy path, not the key. The proxy only accepts a Grafana service
account token (
glsa_…).Fix
raw grafana …(WebApp) commands now authenticate with a Grafana serviceaccount token via a plain HTTP client, bypassing the SDK transport (which
unconditionally overwrites
Authorizationwith the gcsa bearer).GROUNDCOVER_GRAFANA_SERVICE_ACCOUNT_TOKEN/GC_GRAFANA_SERVICE_ACCOUNT_TOKENor--grafana-token.X-Backend-Idvia SDKtransport,
X-Tenant-UUIDwhen set).raw grafana …command without a token prints an actionablesetup guide: install groundcover's official CLI,
auth login,auth generate-service-account-token, then export the token. The guide alsohandles the binary-name collision (the official CLI is also
groundcover; itsinstaller prepends
~/.groundcover/binto PATH, shadowing this one) bysteering users to invoke it by full path.
Verification
raw grafana search/folders listreturn real dashboard/folder JSON;missing-token path prints the guide and makes zero HTTP calls; non-grafana raw
commands still work with just the gcsa key.
TestRunGrafanaWebApp_WithToken,_MissingToken,TestRunNonWebApp_SDKHeaders,TestGrafanaSetupGuideContent. Full suitegreen,
go vetclean.Docs
README +
skills/groundcover-cli/SKILL.mdupdated with the token requirement,generation steps, and the PATH-collision note; corrected a stale
X-Tenant-UUIDclaim.