Documentation
¶
Overview ¶
Package grafana provides a verifier for Grafana API keys. It uses the Grafana HTTP API GET /api/user endpoint to check key validity.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks whether a Grafana API key is active by calling the Grafana Cloud API. It NEVER logs or persists raw key values.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify checks if the detected Grafana API key is valid/active. Raw contains the key value.
This calls GET /api/user, matching docs/architecture/05-VERIFIER-ANALYSIS.md and docs/guides/secret-verification.md (the code previously called the nonexistent /api/viewer path). Note the caveat those docs already record: glsa_ tokens are Grafana Cloud service-account tokens scoped to the stack that issued them, so a token minted on a self-hosted or per-stack instance will not authenticate against the central grafana.com host used here — there is currently no per-instance URL captured for this detector to verify against, the same limitation documented for Okta.
Source Files