Access Control: Move dashboard actions and create scope provider (#48618)

* Move dashboard actions and create scope provider

pkg/services/sqlstore/annotation_test.go

@@ -15,6 +15,7 @@ import (
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/annotations"
+	"github.com/grafana/grafana/pkg/services/dashboards"
 	dashboardstore "github.com/grafana/grafana/pkg/services/dashboards/database"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
@@ -406,7 +407,7 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
 			description: "Should find all annotations when has permissions to list all annotations and read all dashboards",
 			permissions: map[string][]string{
 				accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsAll},
-				accesscontrol.ActionDashboardsRead:  {accesscontrol.ScopeDashboardsAll},
+				dashboards.ActionDashboardsRead:     {dashboards.ScopeDashboardsAll},
 			},
 			expectedAnnotationIds: []int64{dash1Annotation.Id, dash2Annotation.Id, organizationAnnotation.Id},
 		},
@@ -414,7 +415,7 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
 			description: "Should find all dashboard annotations",
 			permissions: map[string][]string{
 				accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeDashboard},
-				accesscontrol.ActionDashboardsRead:  {accesscontrol.ScopeDashboardsAll},
+				dashboards.ActionDashboardsRead:     {dashboards.ScopeDashboardsAll},
 			},
 			expectedAnnotationIds: []int64{dash1Annotation.Id, dash2Annotation.Id},
 		},
@@ -422,7 +423,7 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
 			description: "Should find only annotations from dashboards that user can read",
 			permissions: map[string][]string{
 				accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeDashboard},
-				accesscontrol.ActionDashboardsRead:  {fmt.Sprintf("dashboards:uid:%s", dash1UID)},
+				dashboards.ActionDashboardsRead:     {fmt.Sprintf("dashboards:uid:%s", dash1UID)},
 			},
 			expectedAnnotationIds: []int64{dash1Annotation.Id},
 		},
@@ -437,14 +438,14 @@ func TestAnnotationListingWithRBAC(t *testing.T) {
 			description: "Should find only organization annotations",
 			permissions: map[string][]string{
 				accesscontrol.ActionAnnotationsRead: {accesscontrol.ScopeAnnotationsTypeOrganization},
-				accesscontrol.ActionDashboardsRead:  {accesscontrol.ScopeDashboardsAll},
+				dashboards.ActionDashboardsRead:     {dashboards.ScopeDashboardsAll},
 			},
 			expectedAnnotationIds: []int64{organizationAnnotation.Id},
 		},
 		{
 			description: "Should error if user doesn't have annotation read permissions",
 			permissions: map[string][]string{
-				accesscontrol.ActionDashboardsRead: {accesscontrol.ScopeDashboardsAll},
+				dashboards.ActionDashboardsRead: {dashboards.ScopeDashboardsAll},
 			},
 			expectedError: true,
 		},

pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go

@@ -16,20 +16,20 @@ import (
 
 var dashboardPermissionTranslation = map[models.PermissionType][]string{
 	models.PERMISSION_VIEW: {
-		ac.ActionDashboardsRead,
+		dashboards.ActionDashboardsRead,
 	},
 	models.PERMISSION_EDIT: {
-		ac.ActionDashboardsRead,
-		ac.ActionDashboardsWrite,
-		ac.ActionDashboardsDelete,
+		dashboards.ActionDashboardsRead,
+		dashboards.ActionDashboardsWrite,
+		dashboards.ActionDashboardsDelete,
 	},
 	models.PERMISSION_ADMIN: {
-		ac.ActionDashboardsRead,
-		ac.ActionDashboardsWrite,
-		ac.ActionDashboardsCreate,
-		ac.ActionDashboardsDelete,
-		ac.ActionDashboardsPermissionsRead,
-		ac.ActionDashboardsPermissionsWrite,
+		dashboards.ActionDashboardsRead,
+		dashboards.ActionDashboardsWrite,
+		dashboards.ActionDashboardsCreate,
+		dashboards.ActionDashboardsDelete,
+		dashboards.ActionDashboardsPermissionsRead,
+		dashboards.ActionDashboardsPermissionsWrite,
 	},
 }
 
@@ -38,7 +38,7 @@ var folderPermissionTranslation = map[models.PermissionType][]string{
 		dashboards.ActionFoldersRead,
 	}...),
 	models.PERMISSION_EDIT: append(dashboardPermissionTranslation[models.PERMISSION_EDIT], []string{
-		ac.ActionDashboardsCreate,
+		dashboards.ActionDashboardsCreate,
 		dashboards.ActionFoldersRead,
 		dashboards.ActionFoldersWrite,
 		dashboards.ActionFoldersCreate,

pkg/services/sqlstore/permissions/dashboard.go

@@ -94,10 +94,10 @@ func NewAccessControlDashboardPermissionFilter(user *models.SignedInUser, permis
 			folderActions = append(folderActions, accesscontrol.ActionAlertingRuleCreate)
 		}
 	} else {
-		dashboardActions = append(dashboardActions, accesscontrol.ActionDashboardsRead)
+		dashboardActions = append(dashboardActions, dashboards.ActionDashboardsRead)
 		if needEdit {
-			folderActions = append(folderActions, accesscontrol.ActionDashboardsCreate)
-			dashboardActions = append(dashboardActions, accesscontrol.ActionDashboardsWrite)
+			folderActions = append(folderActions, dashboards.ActionDashboardsCreate)
+			dashboardActions = append(dashboardActions, dashboards.ActionDashboardsWrite)
 		}
 	}
 	return AccessControlDashboardPermissionFilter{User: user, folderActions: folderActions, dashboardActions: dashboardActions}

pkg/services/sqlstore/permissions/dashboard_test.go

@@ -55,31 +55,31 @@ func TestNewAccessControlDashboardPermissionFilter(t *testing.T) {
 			queryType:  randomType,
 			permission: models.PERMISSION_ADMIN,
 			expectedDashboardActions: []string{
-				accesscontrol.ActionDashboardsRead,
-				accesscontrol.ActionDashboardsWrite,
+				dashboards.ActionDashboardsRead,
+				dashboards.ActionDashboardsWrite,
 			},
 			expectedFolderActions: []string{
 				dashboards.ActionFoldersRead,
-				accesscontrol.ActionDashboardsCreate,
+				dashboards.ActionDashboardsCreate,
 			},
 		},
 		{
 			queryType:  randomType,
 			permission: models.PERMISSION_EDIT,
 			expectedDashboardActions: []string{
-				accesscontrol.ActionDashboardsRead,
-				accesscontrol.ActionDashboardsWrite,
+				dashboards.ActionDashboardsRead,
+				dashboards.ActionDashboardsWrite,
 			},
 			expectedFolderActions: []string{
 				dashboards.ActionFoldersRead,
-				accesscontrol.ActionDashboardsCreate,
+				dashboards.ActionDashboardsCreate,
 			},
 		},
 		{
 			queryType:  randomType,
 			permission: models.PERMISSION_VIEW,
 			expectedDashboardActions: []string{
-				accesscontrol.ActionDashboardsRead,
+				dashboards.ActionDashboardsRead,
 			},
 			expectedFolderActions: []string{
 				dashboards.ActionFoldersRead,