Service accounts: Add service account to teams (#51536)

* Revert "Serviceaccounts: #48995

Do not display service accounts assigned to team (#48995)"

This reverts commit cbf71fbd7f.

* fix: test to not include more actions than necessary

* adding service accounts to teams - backend and frontend changes

* also support SA addition through the old team membership endpoints

* fix tests

* tests

* serviceaccounts permission tests

* serviceaccounts permission service tests run

* added back test that was removed by accident

* lint

* refactor: add testoptionsTeams

* fix a bug

* service account picker change

* explicitly set SA managed permissions to false for dash and folders

* lint

* allow team creator to list service accounts

Co-authored-by: IevaVasiljeva <ieva.vasiljeva@grafana.com>

pkg/services/accesscontrol/database/resource_permissions.go

@@ -9,23 +9,25 @@ import (
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions/types"
+	"github.com/grafana/grafana/pkg/services/serviceaccounts"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 )
 
 type flatResourcePermission struct {
-	ID          int64 `xorm:"id"`
-	RoleName    string
-	Action      string
-	Scope       string
-	UserId      int64
-	UserLogin   string
-	UserEmail   string
-	TeamId      int64
-	TeamEmail   string
-	Team        string
-	BuiltInRole string
-	Created     time.Time
-	Updated     time.Time
+	ID                   int64 `xorm:"id"`
+	RoleName             string
+	Action               string
+	Scope                string
+	UserId               int64
+	UserLogin            string
+	UserEmail            string
+	UserIsServiceAccount bool
+	TeamId               int64
+	TeamEmail            string
+	Team                 string
+	BuiltInRole          string
+	Created              time.Time
+	Updated              time.Time
 }
 
 func (p *flatResourcePermission) IsManaged(scope string) bool {
@@ -292,6 +294,7 @@ func (s *AccessControlStore) getResourcePermissions(sess *sqlstore.DBSession, or
 		ur.user_id AS user_id,
 		u.login AS user_login,
 		u.email AS user_email,
+		u.is_service_account AS user_is_service_account,
 		0 AS team_id,
 		'' AS team,
 		'' AS team_email,
@@ -302,6 +305,7 @@ func (s *AccessControlStore) getResourcePermissions(sess *sqlstore.DBSession, or
 		0 AS user_id,
 		'' AS user_login,
 		'' AS user_email,
+		false AS user_is_service_account,
 		tr.team_id AS team_id,
 		t.name AS team,
 		t.email AS team_email,
@@ -312,6 +316,7 @@ func (s *AccessControlStore) getResourcePermissions(sess *sqlstore.DBSession, or
 		0 AS user_id,
 		'' AS user_login,
 		'' AS user_email,
+		false AS user_is_service_account,
 		0 as team_id,
 		'' AS team,
 		'' AS team_email,
@@ -370,8 +375,13 @@ func (s *AccessControlStore) getResourcePermissions(sess *sqlstore.DBSession, or
 	if err != nil {
 		return nil, err
 	}
-	user := userSelect + userFrom + where + " AND " + userFilter.Where
+	serviceAccountFilter, err := accesscontrol.Filter(query.User, "u.id", "serviceaccounts:id:", serviceaccounts.ActionRead)
+	if err != nil {
+		return nil, err
+	}
+	user := userSelect + userFrom + where + " AND (" + userFilter.Where + " OR " + serviceAccountFilter.Where + ") "
 	args = append(args, userFilter.Args...)
+	args = append(args, serviceAccountFilter.Args...)
 
 	teamFilter, err := accesscontrol.Filter(query.User, "t.id", "teams:id:", accesscontrol.ActionTeamsRead)
 	if err != nil {
@@ -457,20 +467,21 @@ func flatPermissionsToResourcePermission(scope string, permissions []flatResourc
 
 	first := permissions[0]
 	return &accesscontrol.ResourcePermission{
-		ID:          first.ID,
-		RoleName:    first.RoleName,
-		Actions:     actions,
-		Scope:       first.Scope,
-		UserId:      first.UserId,
-		UserLogin:   first.UserLogin,
-		UserEmail:   first.UserEmail,
-		TeamId:      first.TeamId,
-		TeamEmail:   first.TeamEmail,
-		Team:        first.Team,
-		BuiltInRole: first.BuiltInRole,
-		Created:     first.Created,
-		Updated:     first.Updated,
-		IsManaged:   first.IsManaged(scope),
+		ID:                   first.ID,
+		RoleName:             first.RoleName,
+		Actions:              actions,
+		Scope:                first.Scope,
+		UserId:               first.UserId,
+		UserLogin:            first.UserLogin,
+		UserEmail:            first.UserEmail,
+		UserIsServiceAccount: first.UserIsServiceAccount,
+		TeamId:               first.TeamId,
+		TeamEmail:            first.TeamEmail,
+		Team:                 first.Team,
+		BuiltInRole:          first.BuiltInRole,
+		Created:              first.Created,
+		Updated:              first.Updated,
+		IsManaged:            first.IsManaged(scope),
 	}
 }
 
@@ -581,6 +592,7 @@ func (s *AccessControlStore) getResourcePermissionsByIds(sess *sqlstore.DBSessio
 		ur.user_id AS user_id,
 		u.login AS user_login,
 		u.email AS user_email,
+		u.is_service_account AS user_is_service_account,
 		tr.team_id AS team_id,
 		t.name AS team,
 		t.email AS team_email,