From 06d4cb030304cd214554aab5f5a03d8be8a0aa97 Mon Sep 17 00:00:00 2001
From: J Guerreiro <joao.guerreiro@grafana.com>
Date: Thu, 23 Dec 2021 08:08:13 +0000
Subject: [PATCH] AccessControl: Disable user remove and user update roles when
 they do not have the permissions (#43429)

* AccessControl: Disable user remove and update roles when they do not have the appropriate permissions

* AccessControl: Ensure frontend tests pass in CI
---
 public/app/features/users/UsersTable.test.tsx | 1 +
 public/app/features/users/UsersTable.tsx      | 9 +++------
 public/app/features/users/state/actions.ts    | 3 ++-
 public/app/types/user.ts                      | 5 ++---
 4 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/public/app/features/users/UsersTable.test.tsx b/public/app/features/users/UsersTable.test.tsx
index c37d7729b75..b5077170968 100644
--- a/public/app/features/users/UsersTable.test.tsx
+++ b/public/app/features/users/UsersTable.test.tsx
@@ -8,6 +8,7 @@ import { ConfirmModal } from '@grafana/ui';
 jest.mock('app/core/core', () => ({
   contextSrv: {
     hasPermission: () => true,
+    hasPermissionInMetadata: () => true,
     accessControlEnabled: () => false,
   },
 }));
diff --git a/public/app/features/users/UsersTable.tsx b/public/app/features/users/UsersTable.tsx
index 92784d70234..7429a6320e0 100644
--- a/public/app/features/users/UsersTable.tsx
+++ b/public/app/features/users/UsersTable.tsx
@@ -15,9 +15,6 @@ export interface Props {
 
 const UsersTable: FC<Props> = (props) => {
   const { users, orgId, onRoleChange, onRemoveUser } = props;
-  const canUpdateRole = contextSrv.hasPermission(AccessControlAction.OrgUsersRoleUpdate);
-  const canRemoveFromOrg = contextSrv.hasPermission(AccessControlAction.OrgUsersRemove);
-  const rolePickerDisabled = !canUpdateRole;
 
   const [showRemoveModal, setShowRemoveModal] = useState<string | boolean>(false);
   const [roleOptions, setRoleOptions] = useState<Role[]>([]);
@@ -89,19 +86,19 @@ const UsersTable: FC<Props> = (props) => {
                     onBuiltinRoleChange={(newRole) => onRoleChange(newRole, user)}
                     getRoleOptions={getRoleOptions}
                     getBuiltinRoles={getBuiltinRoles}
-                    disabled={rolePickerDisabled}
+                    disabled={!contextSrv.hasPermissionInMetadata(AccessControlAction.OrgUsersRoleUpdate, user)}
                   />
                 ) : (
                   <OrgRolePicker
                     aria-label="Role"
                     value={user.role}
-                    disabled={!canUpdateRole}
+                    disabled={!contextSrv.hasPermissionInMetadata(AccessControlAction.OrgUsersRoleUpdate, user)}
                     onChange={(newRole) => onRoleChange(newRole, user)}
                   />
                 )}
               </td>
 
-              {canRemoveFromOrg && (
+              {contextSrv.hasPermissionInMetadata(AccessControlAction.OrgUsersRemove, user) && (
                 <td>
                   <Button
                     size="sm"
diff --git a/public/app/features/users/state/actions.ts b/public/app/features/users/state/actions.ts
index 75259dfa1cd..b4cfc5d1d71 100644
--- a/public/app/features/users/state/actions.ts
+++ b/public/app/features/users/state/actions.ts
@@ -3,10 +3,11 @@ import { getBackendSrv } from '@grafana/runtime';
 import { OrgUser } from 'app/types';
 import { inviteesLoaded, usersLoaded } from './reducers';
 import { contextSrv } from 'app/core/core';
+import { addAccessControlQueryParam } from 'app/core/utils/accessControl';
 
 export function loadUsers(): ThunkResult<void> {
   return async (dispatch) => {
-    const users = await getBackendSrv().get('/api/org/users');
+    const users = await getBackendSrv().get(addAccessControlQueryParam('/api/org/users'));
     dispatch(usersLoaded(users));
   };
 }
diff --git a/public/app/types/user.ts b/public/app/types/user.ts
index df2dd4129cb..694fe24acd2 100644
--- a/public/app/types/user.ts
+++ b/public/app/types/user.ts
@@ -1,7 +1,6 @@
 import { OrgRole } from '.';
-import { SelectableValue } from '@grafana/data';
-
-export interface OrgUser {
+import { SelectableValue, WithAccessControlMetadata } from '@grafana/data';
+export interface OrgUser extends WithAccessControlMetadata {
   avatarUrl: string;
   email: string;
   lastSeenAt: string;