RBAC: search v1 permission filter part 1 - cleanup & updating tests (#71913)

* update tests and remove some AC disabled checks

* remove test for old permission filter builder

pkg/services/accesscontrol/acimpl/service.go

@@ -35,11 +35,9 @@ func ProvideService(cfg *setting.Cfg, store db.DB, routeRegister routing.RouteRe
 	accessControl accesscontrol.AccessControl, features *featuremgmt.FeatureManager) (*Service, error) {
 	service := ProvideOSSService(cfg, database.ProvideService(store), cache, features)
 
-	if !accesscontrol.IsDisabled(cfg) {
-		api.NewAccessControlAPI(routeRegister, accessControl, service, features).RegisterAPIEndpoints()
-		if err := accesscontrol.DeclareFixedRoles(service, cfg); err != nil {
-			return nil, err
-		}
+	api.NewAccessControlAPI(routeRegister, accessControl, service, features).RegisterAPIEndpoints()
+	if err := accesscontrol.DeclareFixedRoles(service, cfg); err != nil {
+		return nil, err
 	}
 
 	return service, nil

pkg/services/accesscontrol/actest/common.go

@@ -1,6 +1,17 @@
 package actest
 
-import "sync"
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/sqlstore"
+	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/stretchr/testify/require"
+)
 
 const Concurrency = 10
 const BatchSize = 1000
@@ -59,3 +70,64 @@ func ConcurrentBatch(workers, count, size int, eachFn func(start, end int) error
 	}
 	return nil
 }
+
+// creates a role, connected it to user and store all permission from the user in database
+func AddUserPermissionToDB(t testing.TB, db db.DB, user *user.SignedInUser) {
+	t.Helper()
+	err := db.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
+		var oldRole accesscontrol.Role
+		hadOldRole, err := sess.SQL("SELECT * FROM role where uid = 'test_role'").Get(&oldRole)
+		if err != nil {
+			return err
+		}
+
+		_, err = sess.Exec("DELETE FROM role WHERE uid = 'test_role'")
+		require.NoError(t, err)
+
+		role := &accesscontrol.Role{
+			OrgID:   user.OrgID,
+			UID:     "test_role",
+			Name:    "test:role",
+			Updated: time.Now(),
+			Created: time.Now(),
+		}
+
+		if _, err := sess.Insert(role); err != nil {
+			return err
+		}
+
+		_, err = sess.Insert(accesscontrol.UserRole{
+			OrgID:   role.OrgID,
+			RoleID:  role.ID,
+			UserID:  user.UserID,
+			Created: time.Now(),
+		})
+		require.NoError(t, err)
+
+		if hadOldRole {
+			if _, err := sess.Exec("DELETE FROM permission WHERE role_id = ?", oldRole.ID); err != nil {
+				return err
+			}
+		}
+
+		var permissions []accesscontrol.Permission
+		for action, scopes := range user.Permissions[user.OrgID] {
+			for _, scope := range scopes {
+				p := accesscontrol.Permission{
+					RoleID: role.ID, Action: action, Scope: scope, Created: time.Now(), Updated: time.Now(),
+				}
+				//p.Kind, p.Attribute, p.Identifier = p.SplitScope()
+
+				permissions = append(permissions, p)
+			}
+		}
+
+		if _, err := sess.InsertMulti(&permissions); err != nil {
+			return err
+		}
+
+		return nil
+	})
+
+	require.NoError(t, err)
+}