IAM: Add ExternalGroupMapping kind for TeamSync (#113052)

* wip

* wip

* Add authorizer -> VERIFY it's working correctly

* Update openapi definitions

* Authorizer wip

* regen apis

* Increase timeout of pg int tests to 20m

* Revert "Increase timeout of pg int tests to 20m"

This reverts commit 8c20568217.

* Fix NewTestStore when Truncate is enabled

pkg/services/authz/rbac/mapper.go

@@ -182,6 +182,25 @@ func newFolderTranslation() translation {
 	return folderTranslation
 }
 
+func newExternalGroupMappingTranslation() translation {
+	return translation{
+		resource:  "teams.permissions",
+		attribute: "uid",
+		verbMapping: map[string]string{
+			utils.VerbGet:            "teams.permissions:read",
+			utils.VerbList:           "teams.permissions:read",
+			utils.VerbWatch:          "teams.permissions:read",
+			utils.VerbCreate:         "teams.permissions:write",
+			utils.VerbUpdate:         "teams.permissions:write",
+			utils.VerbPatch:          "teams.permissions:write",
+			utils.VerbDelete:         "teams.permissions:write",
+			utils.VerbGetPermissions: "teams.permissions:write",
+			utils.VerbSetPermissions: "teams.permissions:write",
+		},
+		folderSupport: false,
+	}
+}
+
 func NewMapperRegistry() MapperRegistry {
 	skipScopeOnAllVerbs := map[string]bool{
 		utils.VerbCreate:           true,
@@ -210,6 +229,8 @@ func NewMapperRegistry() MapperRegistry {
 			"serviceaccounts": newResourceTranslation("serviceaccounts", "uid", false, map[string]bool{utils.VerbCreate: true}),
 			// Teams is a special case. We translate user permissions from id to uid based.
 			"teams": newResourceTranslation("teams", "uid", false, map[string]bool{utils.VerbCreate: true}),
+			// ExternalGroupMappings is a special case. We translate team permissions from id to uid based.
+			"externalgroupmappings": newExternalGroupMappingTranslation(),
 			"coreroles": translation{
 				resource:  "roles",
 				attribute: "uid",