From 2546437e2052025daaf8ee2ab9ea4262b7364e61 Mon Sep 17 00:00:00 2001
From: Ieva <ieva.vasiljeva@grafana.com>
Date: Mon, 31 Oct 2022 11:46:58 +0000
Subject: [PATCH] add an endpoint for updating several managed permissions with
 one call (#57893)

---
 pkg/services/accesscontrol/models.go          |  8 +++----
 .../accesscontrol/resourcepermissions/api.go  | 21 +++++++++++++++++++
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/pkg/services/accesscontrol/models.go b/pkg/services/accesscontrol/models.go
index 40251ab628d..c0eaf07980c 100644
--- a/pkg/services/accesscontrol/models.go
+++ b/pkg/services/accesscontrol/models.go
@@ -262,10 +262,10 @@ func (p *ResourcePermission) Contains(targetActions []string) bool {
 }
 
 type SetResourcePermissionCommand struct {
-	UserID      int64
-	TeamID      int64
-	BuiltinRole string
-	Permission  string
+	UserID      int64  `json:"userID"`
+	TeamID      int64  `json:"teamID"`
+	BuiltinRole string `json:"builtinRole"`
+	Permission  string `json:"permission"`
 }
 
 const (
diff --git a/pkg/services/accesscontrol/resourcepermissions/api.go b/pkg/services/accesscontrol/resourcepermissions/api.go
index 67fc3fc2d1e..2343915203e 100644
--- a/pkg/services/accesscontrol/resourcepermissions/api.go
+++ b/pkg/services/accesscontrol/resourcepermissions/api.go
@@ -40,6 +40,7 @@ func (a *api) registerEndpoints() {
 		scope := accesscontrol.Scope(a.service.options.Resource, a.service.options.ResourceAttribute, accesscontrol.Parameter(":resourceID"))
 		r.Get("/description", auth(disable, accesscontrol.EvalPermission(actionRead)), routing.Wrap(a.getDescription))
 		r.Get("/:resourceID", auth(disable, accesscontrol.EvalPermission(actionRead, scope)), routing.Wrap(a.getPermissions))
+		r.Post("/:resourceID", auth(disable, accesscontrol.EvalPermission(actionWrite, scope)), routing.Wrap(a.setPermissions))
 		if a.service.options.Assignments.Users {
 			r.Post("/:resourceID/users/:userID", auth(disable, accesscontrol.EvalPermission(actionWrite, scope)), routing.Wrap(a.setUserPermission))
 		}
@@ -135,6 +136,10 @@ type setPermissionCommand struct {
 	Permission string `json:"permission"`
 }
 
+type setPermissionsCommand struct {
+	Permissions []accesscontrol.SetResourcePermissionCommand `json:"permissions"`
+}
+
 func (a *api) setUserPermission(c *models.ReqContext) response.Response {
 	userID, err := strconv.ParseInt(web.Params(c.Req)[":userID"], 10, 64)
 	if err != nil {
@@ -192,6 +197,22 @@ func (a *api) setBuiltinRolePermission(c *models.ReqContext) response.Response {
 	return permissionSetResponse(cmd)
 }
 
+func (a *api) setPermissions(c *models.ReqContext) response.Response {
+	resourceID := web.Params(c.Req)[":resourceID"]
+
+	cmd := setPermissionsCommand{}
+	if err := web.Bind(c.Req, &cmd); err != nil {
+		return response.Error(http.StatusBadRequest, "bad request data", err)
+	}
+
+	_, err := a.service.SetPermissions(c.Req.Context(), c.OrgID, resourceID, cmd.Permissions...)
+	if err != nil {
+		return response.Error(http.StatusBadRequest, "failed to set permissions", err)
+	}
+
+	return response.Success("Permissions updated")
+}
+
 func permissionSetResponse(cmd setPermissionCommand) response.Response {
 	message := "Permission updated"
 	if cmd.Permission == "" {