Configuration: Add an option to hide certain users in the UI

conf/defaults.ini

@@ -296,6 +296,9 @@ editors_can_admin = false
 # The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).
 user_invite_max_lifetime_duration = 24h
 
+# Enter a comma-separated list of usernames to hide them in the Grafana UI. These users are shown to Grafana admins and to themselves.
+hidden_users = 
+
 [auth]
 # Login cookie name
 login_cookie_name = grafana_session

conf/sample.ini

@@ -295,6 +295,9 @@
 # The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).
 ;user_invite_max_lifetime_duration = 24h
 
+# Enter a comma-separated list of users login to hide them in the Grafana UI. These users are shown to Grafana admins and themselves.
+; hidden_users = 
+
 [auth]
 # Login cookie name
 ;login_cookie_name = grafana_session

pkg/api/api.go

@@ -167,7 +167,7 @@ func (hs *HTTPServer) registerRoutes() {
 
 		// team without requirement of user to be org admin
 		apiRoute.Group("/teams", func(teamsRoute routing.RouteRegister) {
-			teamsRoute.Get("/:teamId", Wrap(GetTeamByID))
+			teamsRoute.Get("/:teamId", Wrap(hs.GetTeamByID))
 			teamsRoute.Get("/search", Wrap(hs.SearchTeams))
 		})
 
@@ -181,7 +181,7 @@ func (hs *HTTPServer) registerRoutes() {
 		apiRoute.Group("/org", func(orgRoute routing.RouteRegister) {
 			orgRoute.Put("/", bind(dtos.UpdateOrgForm{}), Wrap(UpdateOrgCurrent))
 			orgRoute.Put("/address", bind(dtos.UpdateOrgAddressForm{}), Wrap(UpdateOrgAddressCurrent))
-			orgRoute.Get("/users", Wrap(GetOrgUsersForCurrentOrg))
+			orgRoute.Get("/users", Wrap(hs.GetOrgUsersForCurrentOrg))
 			orgRoute.Post("/users", quota("user"), bind(models.AddOrgUserCommand{}), Wrap(AddOrgUserToCurrentOrg))
 			orgRoute.Patch("/users/:userId", bind(models.UpdateOrgUserCommand{}), Wrap(UpdateOrgUserForCurrentOrg))
 			orgRoute.Delete("/users/:userId", Wrap(RemoveOrgUserForCurrentOrg))
@@ -198,7 +198,7 @@ func (hs *HTTPServer) registerRoutes() {
 
 		// current org without requirement of user to be org admin
 		apiRoute.Group("/org", func(orgRoute routing.RouteRegister) {
-			orgRoute.Get("/users/lookup", Wrap(GetOrgUsersForCurrentOrgLookup))
+			orgRoute.Get("/users/lookup", Wrap(hs.GetOrgUsersForCurrentOrgLookup))
 		})
 
 		// create new org
@@ -213,7 +213,7 @@ func (hs *HTTPServer) registerRoutes() {
 			orgsRoute.Put("/", bind(dtos.UpdateOrgForm{}), Wrap(UpdateOrg))
 			orgsRoute.Put("/address", bind(dtos.UpdateOrgAddressForm{}), Wrap(UpdateOrgAddress))
 			orgsRoute.Delete("/", Wrap(DeleteOrgByID))
-			orgsRoute.Get("/users", Wrap(GetOrgUsers))
+			orgsRoute.Get("/users", Wrap(hs.GetOrgUsers))
 			orgsRoute.Post("/users", bind(models.AddOrgUserCommand{}), Wrap(AddOrgUser))
 			orgsRoute.Patch("/users/:userId", bind(models.UpdateOrgUserCommand{}), Wrap(UpdateOrgUser))
 			orgsRoute.Delete("/users/:userId", Wrap(RemoveOrgUser))
@@ -284,7 +284,7 @@ func (hs *HTTPServer) registerRoutes() {
 				folderUidRoute.Delete("/", Wrap(DeleteFolder))
 
 				folderUidRoute.Group("/permissions", func(folderPermissionRoute routing.RouteRegister) {
-					folderPermissionRoute.Get("/", Wrap(GetFolderPermissionList))
+					folderPermissionRoute.Get("/", Wrap(hs.GetFolderPermissionList))
 					folderPermissionRoute.Post("/", bind(dtos.UpdateDashboardAclCommand{}), Wrap(UpdateFolderPermissions))
 				})
 			})
@@ -311,7 +311,7 @@ func (hs *HTTPServer) registerRoutes() {
 				dashIdRoute.Post("/restore", bind(dtos.RestoreDashboardVersionCommand{}), Wrap(hs.RestoreDashboardVersion))
 
 				dashIdRoute.Group("/permissions", func(dashboardPermissionRoute routing.RouteRegister) {
-					dashboardPermissionRoute.Get("/", Wrap(GetDashboardPermissionList))
+					dashboardPermissionRoute.Get("/", Wrap(hs.GetDashboardPermissionList))
 					dashboardPermissionRoute.Post("/", bind(dtos.UpdateDashboardAclCommand{}), Wrap(UpdateDashboardPermissions))
 				})
 			})

pkg/api/dashboard_permission.go

@@ -9,7 +9,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/guardian"
 )
 
-func GetDashboardPermissionList(c *models.ReqContext) Response {
+func (hs *HTTPServer) GetDashboardPermissionList(c *models.ReqContext) Response {
 	dashID := c.ParamsInt64(":dashboardId")
 
 	_, rsp := getDashboardHelper(c.OrgId, "", dashID, "")
@@ -28,7 +28,12 @@ func GetDashboardPermissionList(c *models.ReqContext) Response {
 		return Error(500, "Failed to get dashboard permissions", err)
 	}
 
+	filteredAcls := make([]*models.DashboardAclInfoDTO, 0, len(acl))
 	for _, perm := range acl {
+		if dtos.IsHiddenUser(perm.UserLogin, c.SignedInUser, hs.Cfg) {
+			continue
+		}
+
 		perm.UserAvatarUrl = dtos.GetGravatarUrl(perm.UserEmail)
 
 		if perm.TeamId > 0 {
@@ -37,9 +42,11 @@ func GetDashboardPermissionList(c *models.ReqContext) Response {
 		if perm.Slug != "" {
 			perm.Url = models.GetDashboardFolderUrl(perm.IsFolder, perm.Uid, perm.Slug)
 		}
+
+		filteredAcls = append(filteredAcls, perm)
 	}
 
-	return JSON(200, acl)
+	return JSON(200, filteredAcls)
 }
 
 func UpdateDashboardPermissions(c *models.ReqContext, apiCmd dtos.UpdateDashboardAclCommand) Response {

pkg/api/dtos/models.go

@@ -79,3 +79,15 @@ func GetGravatarUrlWithDefault(text string, defaultText string) string {
 
 	return GetGravatarUrl(text)
 }
+
+func IsHiddenUser(userLogin string, signedInUser *models.SignedInUser, cfg *setting.Cfg) bool {
+	if signedInUser.IsGrafanaAdmin || userLogin == signedInUser.Login {
+		return false
+	}
+
+	if _, hidden := cfg.HiddenUsers[userLogin]; hidden {
+		return true
+	}
+
+	return false
+}

pkg/api/folder_permission.go

@@ -11,7 +11,7 @@ import (
 	"github.com/grafana/grafana/pkg/util"
 )
 
-func GetFolderPermissionList(c *models.ReqContext) Response {
+func (hs *HTTPServer) GetFolderPermissionList(c *models.ReqContext) Response {
 	s := dashboards.NewFolderService(c.OrgId, c.SignedInUser)
 	folder, err := s.GetFolderByUID(c.Params(":uid"))
 
@@ -30,7 +30,12 @@ func GetFolderPermissionList(c *models.ReqContext) Response {
 		return Error(500, "Failed to get folder permissions", err)
 	}
 
+	filteredAcls := make([]*models.DashboardAclInfoDTO, 0, len(acl))
 	for _, perm := range acl {
+		if dtos.IsHiddenUser(perm.UserLogin, c.SignedInUser, hs.Cfg) {
+			continue
+		}
+
 		perm.FolderId = folder.Id
 		perm.DashboardId = 0
 
@@ -43,9 +48,11 @@ func GetFolderPermissionList(c *models.ReqContext) Response {
 		if perm.Slug != "" {
 			perm.Url = models.GetDashboardFolderUrl(perm.IsFolder, perm.Uid, perm.Slug)
 		}
+
+		filteredAcls = append(filteredAcls, perm)
 	}
 
-	return JSON(200, acl)
+	return JSON(200, filteredAcls)
 }
 
 func UpdateFolderPermissions(c *models.ReqContext, apiCmd dtos.UpdateDashboardAclCommand) Response {

pkg/api/org_users.go

@@ -51,8 +51,13 @@ func addOrgUserHelper(cmd models.AddOrgUserCommand) Response {
 }
 
 // GET /api/org/users
-func GetOrgUsersForCurrentOrg(c *models.ReqContext) Response {
-	result, err := getOrgUsersHelper(c.OrgId, c.Query("query"), c.QueryInt("limit"))
+func (hs *HTTPServer) GetOrgUsersForCurrentOrg(c *models.ReqContext) Response {
+	result, err := hs.getOrgUsersHelper(&models.GetOrgUsersQuery{
+		OrgId: c.OrgId,
+		Query: c.Query("query"),
+		Limit: c.QueryInt("limit"),
+	}, c.SignedInUser)
+
 	if err != nil {
 		return Error(500, "Failed to get users for current organization", err)
 	}
@@ -61,7 +66,7 @@ func GetOrgUsersForCurrentOrg(c *models.ReqContext) Response {
 }
 
 // GET /api/org/users/lookup
-func GetOrgUsersForCurrentOrgLookup(c *models.ReqContext) Response {
+func (hs *HTTPServer) GetOrgUsersForCurrentOrgLookup(c *models.ReqContext) Response {
 	isAdmin, err := isOrgAdminFolderAdminOrTeamAdmin(c)
 	if err != nil {
 		return Error(500, "Failed to get users for current organization", err)
@@ -71,7 +76,12 @@ func GetOrgUsersForCurrentOrgLookup(c *models.ReqContext) Response {
 		return Error(403, "Permission denied", nil)
 	}
 
-	orgUsers, err := getOrgUsersHelper(c.OrgId, c.Query("query"), c.QueryInt("limit"))
+	orgUsers, err := hs.getOrgUsersHelper(&models.GetOrgUsersQuery{
+		OrgId: c.OrgId,
+		Query: c.Query("query"),
+		Limit: c.QueryInt("limit"),
+	}, c.SignedInUser)
+
 	if err != nil {
 		return Error(500, "Failed to get users for current organization", err)
 	}
@@ -112,31 +122,36 @@ func isOrgAdminFolderAdminOrTeamAdmin(c *models.ReqContext) (bool, error) {
 }
 
 // GET /api/orgs/:orgId/users
-func GetOrgUsers(c *models.ReqContext) Response {
-	result, err := getOrgUsersHelper(c.ParamsInt64(":orgId"), "", 0)
+func (hs *HTTPServer) GetOrgUsers(c *models.ReqContext) Response {
+	result, err := hs.getOrgUsersHelper(&models.GetOrgUsersQuery{
+		OrgId: c.ParamsInt64(":orgId"),
+		Query: "",
+		Limit: 0,
+	}, c.SignedInUser)
+
 	if err != nil {
 		return Error(500, "Failed to get users for organization", err)
 	}
 
 	return JSON(200, result)
 }
 
-func getOrgUsersHelper(orgID int64, query string, limit int) ([]*models.OrgUserDTO, error) {
-	q := models.GetOrgUsersQuery{
-		OrgId: orgID,
-		Query: query,
-		Limit: limit,
-	}
-
-	if err := bus.Dispatch(&q); err != nil {
+func (hs *HTTPServer) getOrgUsersHelper(query *models.GetOrgUsersQuery, signedInUser *models.SignedInUser) ([]*models.OrgUserDTO, error) {
+	if err := bus.Dispatch(query); err != nil {
 		return nil, err
 	}
 
-	for _, user := range q.Result {
+	filteredUsers := make([]*models.OrgUserDTO, 0, len(query.Result))
+	for _, user := range query.Result {
+		if dtos.IsHiddenUser(user.Login, signedInUser, hs.Cfg) {
+			continue
+		}
 		user.AvatarUrl = dtos.GetGravatarUrl(user.Email)
+
+		filteredUsers = append(filteredUsers, user)
 	}
 
-	return q.Result, nil
+	return filteredUsers, nil
 }
 
 // PATCH /api/org/users/:userId

pkg/api/team.go

@@ -110,6 +110,8 @@ func (hs *HTTPServer) SearchTeams(c *models.ReqContext) Response {
 		UserIdFilter: userIdFilter,
 		Page:         page,
 		Limit:        perPage,
+		SignedInUser: c.SignedInUser,
+		HiddenUsers:  hs.Cfg.HiddenUsers,
 	}
 
 	if err := bus.Dispatch(&query); err != nil {
@@ -127,8 +129,13 @@ func (hs *HTTPServer) SearchTeams(c *models.ReqContext) Response {
 }
 
 // GET /api/teams/:teamId
-func GetTeamByID(c *models.ReqContext) Response {
-	query := models.GetTeamByIdQuery{OrgId: c.OrgId, Id: c.ParamsInt64(":teamId")}
+func (hs *HTTPServer) GetTeamByID(c *models.ReqContext) Response {
+	query := models.GetTeamByIdQuery{
+		OrgId:        c.OrgId,
+		Id:           c.ParamsInt64(":teamId"),
+		SignedInUser: c.SignedInUser,
+		HiddenUsers:  hs.Cfg.HiddenUsers,
+	}
 
 	if err := bus.Dispatch(&query); err != nil {
 		if err == models.ErrTeamNotFound {

pkg/api/team_members.go

@@ -16,17 +16,24 @@ func (hs *HTTPServer) GetTeamMembers(c *models.ReqContext) Response {
 		return Error(500, "Failed to get Team Members", err)
 	}
 
+	filteredMembers := make([]*models.TeamMemberDTO, 0, len(query.Result))
 	for _, member := range query.Result {
+		if dtos.IsHiddenUser(member.Login, c.SignedInUser, hs.Cfg) {
+			continue
+		}
+
 		member.AvatarUrl = dtos.GetGravatarUrl(member.Email)
 		member.Labels = []string{}
 
 		if hs.License.HasValidLicense() && member.External {
 			authProvider := GetAuthProviderLabel(member.AuthModule)
 			member.Labels = append(member.Labels, authProvider)
 		}
+
+		filteredMembers = append(filteredMembers, member)
 	}
 
-	return JSON(200, query.Result)
+	return JSON(200, filteredMembers)
 }
 
 // POST /api/teams/:teamId/members

pkg/models/team.go

@@ -50,9 +50,11 @@ type DeleteTeamCommand struct {
 }
 
 type GetTeamByIdQuery struct {
-	OrgId  int64
-	Id     int64
-	Result *TeamDTO
+	OrgId        int64
+	Id           int64
+	SignedInUser *SignedInUser
+	HiddenUsers  map[string]struct{}
+	Result       *TeamDTO
 }
 
 type GetTeamsByUserQuery struct {
@@ -68,6 +70,8 @@ type SearchTeamsQuery struct {
 	Page         int
 	OrgId        int64
 	UserIdFilter int64
+	SignedInUser *SignedInUser
+	HiddenUsers  map[string]struct{}
 
 	Result SearchTeamQueryResult
 }