From 0437a7495675334eef27578f4ed5f05e1f7969c2 Mon Sep 17 00:00:00 2001
From: Karl Persson <kalle.persson@grafana.com>
Date: Mon, 18 Dec 2023 15:55:02 +0100
Subject: [PATCH] RBAC: Render team, service account and user list when a user
 can see entities but not roles attached to them (#79642)

* Render list even when user cannot list roles assigned for entities
---
 public/app/features/serviceaccounts/state/actions.ts | 5 ++++-
 public/app/features/teams/state/actions.ts           | 5 ++++-
 public/app/features/users/state/actions.ts           | 7 +++++--
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/public/app/features/serviceaccounts/state/actions.ts b/public/app/features/serviceaccounts/state/actions.ts
index 51a31906d35..1668c273359 100644
--- a/public/app/features/serviceaccounts/state/actions.ts
+++ b/public/app/features/serviceaccounts/state/actions.ts
@@ -54,7 +54,10 @@ export function fetchServiceAccounts(
           )}&accesscontrol=true`
         );
 
-        if (contextSrv.licensedAccessControlEnabled()) {
+        if (
+          contextSrv.licensedAccessControlEnabled() &&
+          contextSrv.hasPermission(AccessControlAction.ActionUserRolesList)
+        ) {
           dispatch(rolesFetchBegin());
           const orgId = contextSrv.user.orgId;
           const userIds = result?.serviceAccounts.map((u: ServiceAccountDTO) => u.id);
diff --git a/public/app/features/teams/state/actions.ts b/public/app/features/teams/state/actions.ts
index d4f5ec470aa..caffdba46d3 100644
--- a/public/app/features/teams/state/actions.ts
+++ b/public/app/features/teams/state/actions.ts
@@ -41,7 +41,10 @@ export function loadTeams(initial = false): ThunkResult<void> {
       noTeams = response.teams.length === 0;
     }
 
-    if (contextSrv.licensedAccessControlEnabled()) {
+    if (
+      contextSrv.licensedAccessControlEnabled() &&
+      contextSrv.hasPermission(AccessControlAction.ActionTeamsRolesList)
+    ) {
       dispatch(rolesFetchBegin());
       const teamIds = response?.teams.map((t: Team) => t.id);
       const roles = await getBackendSrv().post(`/api/access-control/teams/roles/search`, { teamIds });
diff --git a/public/app/features/users/state/actions.ts b/public/app/features/users/state/actions.ts
index 25cec0a20f5..a0f52473e1b 100644
--- a/public/app/features/users/state/actions.ts
+++ b/public/app/features/users/state/actions.ts
@@ -6,7 +6,7 @@ import { contextSrv } from 'app/core/core';
 import { accessControlQueryParam } from 'app/core/utils/accessControl';
 import { OrgUser } from 'app/types';
 
-import { ThunkResult } from '../../../types';
+import { AccessControlAction, ThunkResult } from '../../../types';
 
 import {
   usersLoaded,
@@ -29,7 +29,10 @@ export function loadUsers(): ThunkResult<void> {
         accessControlQueryParam({ perpage: perPage, page, query: searchQuery, sort })
       );
 
-      if (contextSrv.licensedAccessControlEnabled()) {
+      if (
+        contextSrv.licensedAccessControlEnabled() &&
+        contextSrv.hasPermission(AccessControlAction.ActionUserRolesList)
+      ) {
         dispatch(rolesFetchBegin());
         const orgId = contextSrv.user.orgId;
         const userIds = users?.orgUsers.map((u: OrgUser) => u.userId);