IAM: Add datasources:query support for using the authlib/authzservice (#104107)

* feat(add): datasources:query support for using the authlib/authzservice

* added test for datasources

* refactor to create the translation right away

* Update pkg/services/authz/rbac/mapper.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix tests

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

pkg/apimachinery/identity/context.go

@@ -124,6 +124,7 @@ var serviceIdentityTokenPermissions = getTokenPermissions(
 	"folder.grafana.app",
 	"dashboard.grafana.app",
 	"secret.grafana.app",
+	"query.grafana.app",
 )
 
 var ServiceIdentityClaims = &authn.Claims[authn.AccessTokenClaims]{

pkg/services/authz/rbac/mapper.go

@@ -67,6 +67,16 @@ func newMapper() mapper {
 			"securevalues": newResourceTranslation("secret.securevalues", "uid", false),
 			"keepers":      newResourceTranslation("secret.keepers", "uid", false),
 		},
+		"query.grafana.app": {
+			"query": translation{
+				resource:  "datasources",
+				attribute: "uid",
+				verbMapping: map[string]string{
+					utils.VerbCreate: "datasources:query",
+				},
+				folderSupport: false,
+			},
+		},
 	}
 }
 

pkg/services/authz/rbac/service_test.go

@@ -261,6 +261,26 @@ func TestService_checkPermission(t *testing.T) {
 			},
 			expected: true,
 		},
+		{
+			name: "should return true for datasources if service has permission",
+			permissions: []accesscontrol.Permission{
+				{
+					Action:     "datasources:query",
+					Scope:      "datasources:uid:some_datasource",
+					Kind:       "datasources",
+					Attribute:  "uid",
+					Identifier: "some_datasource",
+				},
+			},
+			check: CheckRequest{
+				Action:   "datasources:query",
+				Group:    "query.grafana.app",
+				Resource: "query",
+				Name:     "some_datasource",
+				Verb:     utils.VerbCreate,
+			},
+			expected: true,
+		},
 	}
 
 	for _, tc := range testCases {