Plugins: Migrate licensing and access control to pkg/services/pluginsintegration package (#65258)

* migrate licensing + access control

* update package name

pkg/services/pluginsintegration/licensing/licensing.go

@@ -0,0 +1,44 @@
+package licensing
+
+import (
+	"fmt"
+
+	"github.com/grafana/grafana/pkg/services/licensing"
+	"github.com/grafana/grafana/pkg/setting"
+)
+
+type Service struct {
+	licensePath string
+	appURL      string
+	license     licensing.Licensing
+}
+
+func ProvideLicensing(cfg *setting.Cfg, l licensing.Licensing) *Service {
+	return &Service{
+		licensePath: cfg.EnterpriseLicensePath,
+		appURL:      cfg.AppURL,
+		license:     l,
+	}
+}
+
+func (l Service) Environment() []string {
+	var env []string
+	if envProvider, ok := l.license.(licensing.LicenseEnvironment); ok {
+		for k, v := range envProvider.Environment() {
+			env = append(env, fmt.Sprintf("%s=%s", k, v))
+		}
+	}
+	return env
+}
+
+func (l Service) Edition() string {
+	return l.license.Edition()
+}
+
+func (l Service) Path() string {
+	return l.licensePath
+}
+
+func (l Service) AppURL() string {
+	return l.appURL
+}

pkg/services/pluginsintegration/pluginaccesscontrol/accesscontrol.go

@@ -0,0 +1,75 @@
+package pluginaccesscontrol
+
+import (
+	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
+	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
+	"github.com/grafana/grafana/pkg/services/org"
+	"github.com/grafana/grafana/pkg/setting"
+)
+
+const (
+	// Plugins actions
+	ActionInstall = "plugins:install"
+	ActionWrite   = "plugins:write"
+
+	// App Plugins actions
+	ActionAppAccess = "plugins.app:access"
+)
+
+var (
+	ScopeProvider = ac.NewScopeProvider("plugins")
+	// Protects access to the Configuration > Plugins page
+	AdminAccessEvaluator = ac.EvalAny(ac.EvalPermission(ActionWrite), ac.EvalPermission(ActionInstall))
+)
+
+func ReqCanAdminPlugins(cfg *setting.Cfg) func(rc *contextmodel.ReqContext) bool {
+	// Legacy handler that protects access to the Configuration > Plugins page
+	return func(rc *contextmodel.ReqContext) bool {
+		return rc.OrgRole == org.RoleAdmin || cfg.PluginAdminEnabled && rc.IsGrafanaAdmin
+	}
+}
+
+func DeclareRBACRoles(service ac.Service, cfg *setting.Cfg) error {
+	AppPluginsReader := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Name:        ac.FixedRolePrefix + "plugins.app:reader",
+			DisplayName: "Application Plugins Access",
+			Description: "Access application plugins (still enforcing the organization role)",
+			Group:       "Plugins",
+			Permissions: []ac.Permission{
+				{Action: ActionAppAccess, Scope: ScopeProvider.GetResourceAllScope()},
+			},
+		},
+		Grants: []string{string(org.RoleViewer)},
+	}
+	PluginsWriter := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Name:        ac.FixedRolePrefix + "plugins:writer",
+			DisplayName: "Plugin Writer",
+			Description: "Enable and disable plugins and edit plugins' settings",
+			Group:       "Plugins",
+			Permissions: []ac.Permission{
+				{Action: ActionWrite, Scope: ScopeProvider.GetResourceAllScope()},
+			},
+		},
+		Grants: []string{string(org.RoleAdmin)},
+	}
+	PluginsMaintainer := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Name:        ac.FixedRolePrefix + "plugins:maintainer",
+			DisplayName: "Plugin Maintainer",
+			Description: "Install, uninstall plugins",
+			Group:       "Plugins",
+			Permissions: []ac.Permission{
+				{Action: ActionInstall},
+			},
+		},
+		Grants: []string{ac.RoleGrafanaAdmin},
+	}
+
+	if !cfg.PluginAdminEnabled || cfg.PluginAdminExternalManageEnabled {
+		PluginsMaintainer.Grants = []string{}
+	}
+
+	return service.DeclareFixedRoles(AppPluginsReader, PluginsWriter, PluginsMaintainer)
+}

pkg/services/pluginsintegration/pluginsintegration.go

@@ -7,7 +7,6 @@ import (
 	"github.com/grafana/grafana/pkg/plugins/backendplugin/coreplugin"
 	"github.com/grafana/grafana/pkg/plugins/backendplugin/provider"
 	"github.com/grafana/grafana/pkg/plugins/config"
-	"github.com/grafana/grafana/pkg/plugins/licensing"
 	"github.com/grafana/grafana/pkg/plugins/manager"
 	"github.com/grafana/grafana/pkg/plugins/manager/client"
 	"github.com/grafana/grafana/pkg/plugins/manager/loader"
@@ -22,6 +21,7 @@ import (
 	"github.com/grafana/grafana/pkg/plugins/repo"
 	"github.com/grafana/grafana/pkg/services/oauthtoken"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/clientmiddleware"
+	"github.com/grafana/grafana/pkg/services/pluginsintegration/licensing"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/plugincontext"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginsettings"
 	pluginSettings "github.com/grafana/grafana/pkg/services/pluginsintegration/pluginsettings/service"