IAM: Add ExternalGroupMapping kind for TeamSync (#113052)

* wip

* wip

* Add authorizer -> VERIFY it's working correctly

* Update openapi definitions

* Authorizer wip

* regen apis

* Increase timeout of pg int tests to 20m

* Revert "Increase timeout of pg int tests to 20m"

This reverts commit 8c20568217.

* Fix NewTestStore when Truncate is enabled

pkg/services/authz/rbac/mapper.go

@@ -182,6 +182,25 @@ func newFolderTranslation() translation {
 	return folderTranslation
 }
 
+func newExternalGroupMappingTranslation() translation {
+	return translation{
+		resource:  "teams.permissions",
+		attribute: "uid",
+		verbMapping: map[string]string{
+			utils.VerbGet:            "teams.permissions:read",
+			utils.VerbList:           "teams.permissions:read",
+			utils.VerbWatch:          "teams.permissions:read",
+			utils.VerbCreate:         "teams.permissions:write",
+			utils.VerbUpdate:         "teams.permissions:write",
+			utils.VerbPatch:          "teams.permissions:write",
+			utils.VerbDelete:         "teams.permissions:write",
+			utils.VerbGetPermissions: "teams.permissions:write",
+			utils.VerbSetPermissions: "teams.permissions:write",
+		},
+		folderSupport: false,
+	}
+}
+
 func NewMapperRegistry() MapperRegistry {
 	skipScopeOnAllVerbs := map[string]bool{
 		utils.VerbCreate:           true,
@@ -210,6 +229,8 @@ func NewMapperRegistry() MapperRegistry {
 			"serviceaccounts": newResourceTranslation("serviceaccounts", "uid", false, map[string]bool{utils.VerbCreate: true}),
 			// Teams is a special case. We translate user permissions from id to uid based.
 			"teams": newResourceTranslation("teams", "uid", false, map[string]bool{utils.VerbCreate: true}),
+			// ExternalGroupMappings is a special case. We translate team permissions from id to uid based.
+			"externalgroupmappings": newExternalGroupMappingTranslation(),
 			"coreroles": translation{
 				resource:  "roles",
 				attribute: "uid",

pkg/services/authz/rbac/resolver.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/grafana/authlib/types"
+	"github.com/grafana/grafana/pkg/registry/apis/iam/common"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 )
@@ -54,7 +55,7 @@ func (s *Service) newServiceAccountNameResolver(ctx context.Context, ns types.Na
 func (s *Service) fetchTeams(ctx context.Context, ns types.NamespaceInfo) (map[int64]string, error) {
 	key := teamIDsCacheKey(ns.Value)
 	res, err, _ := s.sf.Do(key, func() (any, error) {
-		teams, err := s.identityStore.ListTeams(ctx, ns, legacy.ListTeamQuery{})
+		teams, err := s.identityStore.ListTeams(ctx, ns, legacy.ListTeamQuery{Pagination: common.Pagination{Limit: 100}})
 		if err != nil {
 			return nil, fmt.Errorf("could not fetch teams: %w", err)
 		}
@@ -170,6 +171,7 @@ func (s *Service) nameResolver(ctx context.Context, ns types.NamespaceInfo, scop
 	if scopePrefix == "teams:id:" {
 		return s.newTeamNameResolver(ctx, ns)
 	}
+
 	if scopePrefix == "permissions:type:" {
 		return permissionsDelegateResolverFunc, nil
 	}

pkg/services/sqlstore/sqlstore_testinfra.go

@@ -195,7 +195,7 @@ func NewTestStore(tb TestingTB, opts ...TestOption) *SQLStore {
 			tb.Fatalf("failed to truncate DB tables after migrations: %v", err)
 			panic("unreachable")
 		}
-		testSQLStore.engine.ResetSequenceGenerator()
+		store.engine.ResetSequenceGenerator()
 	}
 
 	return store