NavTree: Refactor out the navtree building from api/index.go and into it's own service (#55552)

pkg/api/accesscontrol.go

@@ -9,7 +9,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/org"
-	"github.com/grafana/grafana/pkg/services/serviceaccounts"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/tsdb/grafanads"
 )
@@ -17,15 +16,6 @@ import (
 // API related actions
 const (
 	ActionProvisioningReload = "provisioning:reload"
-
-	ActionOrgsRead             = "orgs:read"
-	ActionOrgsPreferencesRead  = "orgs.preferences:read"
-	ActionOrgsQuotasRead       = "orgs.quotas:read"
-	ActionOrgsWrite            = "orgs:write"
-	ActionOrgsPreferencesWrite = "orgs.preferences:write"
-	ActionOrgsQuotasWrite      = "orgs.quotas:write"
-	ActionOrgsDelete           = "orgs:delete"
-	ActionOrgsCreate           = "orgs:create"
 )
 
 // API related scopes
@@ -209,8 +199,8 @@ func (hs *HTTPServer) declareFixedRoles() error {
 			Description: "Read an organization, such as its ID, name, address, or quotas.",
 			Group:       "Organizations",
 			Permissions: []ac.Permission{
-				{Action: ActionOrgsRead},
-				{Action: ActionOrgsQuotasRead},
+				{Action: ac.ActionOrgsRead},
+				{Action: ac.ActionOrgsQuotasRead},
 			},
 		},
 		Grants: []string{string(org.RoleViewer), ac.RoleGrafanaAdmin},
@@ -223,9 +213,9 @@ func (hs *HTTPServer) declareFixedRoles() error {
 			Description: "Read an organization, its quotas, or its preferences. Update organization properties, or its preferences.",
 			Group:       "Organizations",
 			Permissions: ac.ConcatPermissions(orgReaderRole.Role.Permissions, []ac.Permission{
-				{Action: ActionOrgsPreferencesRead},
-				{Action: ActionOrgsWrite},
-				{Action: ActionOrgsPreferencesWrite},
+				{Action: ac.ActionOrgsPreferencesRead},
+				{Action: ac.ActionOrgsWrite},
+				{Action: ac.ActionOrgsPreferencesWrite},
 			}),
 		},
 		Grants: []string{string(org.RoleAdmin)},
@@ -238,10 +228,10 @@ func (hs *HTTPServer) declareFixedRoles() error {
 			Description: "Create, read, write, or delete an organization. Read or write an organization's quotas. Needs to be assigned globally.",
 			Group:       "Organizations",
 			Permissions: ac.ConcatPermissions(orgReaderRole.Role.Permissions, []ac.Permission{
-				{Action: ActionOrgsCreate},
-				{Action: ActionOrgsWrite},
-				{Action: ActionOrgsDelete},
-				{Action: ActionOrgsQuotasWrite},
+				{Action: ac.ActionOrgsCreate},
+				{Action: ac.ActionOrgsWrite},
+				{Action: ac.ActionOrgsDelete},
+				{Action: ac.ActionOrgsQuotasWrite},
 			}),
 		},
 		Grants: []string{string(ac.RoleGrafanaAdmin)},
@@ -443,63 +433,6 @@ func (hs *HTTPServer) declareFixedRoles() error {
 	)
 }
 
-// Evaluators
-// here is the list of complex evaluators we use in this package
-
-// orgPreferencesAccessEvaluator is used to protect the "Configure > Preferences" page access
-var orgPreferencesAccessEvaluator = ac.EvalAny(
-	ac.EvalAll(
-		ac.EvalPermission(ActionOrgsRead),
-		ac.EvalPermission(ActionOrgsWrite),
-	),
-	ac.EvalAll(
-		ac.EvalPermission(ActionOrgsPreferencesRead),
-		ac.EvalPermission(ActionOrgsPreferencesWrite),
-	),
-)
-
-// orgsAccessEvaluator is used to protect the "Server Admin > Orgs" page access
-// (you need to have read access to update or delete orgs; read is the minimum)
-var orgsAccessEvaluator = ac.EvalPermission(ActionOrgsRead)
-
-// orgsCreateAccessEvaluator is used to protect the "Server Admin > Orgs > New Org" page access
-var orgsCreateAccessEvaluator = ac.EvalAll(
-	ac.EvalPermission(ActionOrgsRead),
-	ac.EvalPermission(ActionOrgsCreate),
-)
-
-// teamsAccessEvaluator is used to protect the "Configuration > Teams" page access
-// grants access to a user when they can either create teams or can read and update a team
-var teamsAccessEvaluator = ac.EvalAny(
-	ac.EvalPermission(ac.ActionTeamsCreate),
-	ac.EvalAll(
-		ac.EvalPermission(ac.ActionTeamsRead),
-		ac.EvalAny(
-			ac.EvalPermission(ac.ActionTeamsWrite),
-			ac.EvalPermission(ac.ActionTeamsPermissionsWrite),
-		),
-	),
-)
-
-// teamsEditAccessEvaluator is used to protect the "Configuration > Teams > edit" page access
-var teamsEditAccessEvaluator = ac.EvalAll(
-	ac.EvalPermission(ac.ActionTeamsRead),
-	ac.EvalAny(
-		ac.EvalPermission(ac.ActionTeamsCreate),
-		ac.EvalPermission(ac.ActionTeamsWrite),
-		ac.EvalPermission(ac.ActionTeamsPermissionsWrite),
-	),
-)
-
-// apiKeyAccessEvaluator is used to protect the "Configuration > API keys" page access
-var apiKeyAccessEvaluator = ac.EvalPermission(ac.ActionAPIKeyRead)
-
-// serviceAccountAccessEvaluator is used to protect the "Configuration > Service accounts" page access
-var serviceAccountAccessEvaluator = ac.EvalAny(
-	ac.EvalPermission(serviceaccounts.ActionRead),
-	ac.EvalPermission(serviceaccounts.ActionCreate),
-)
-
 // Metadata helpers
 // getAccessControlMetadata returns the accesscontrol metadata associated with a given resource
 func (hs *HTTPServer) getAccessControlMetadata(c *models.ReqContext,