RBAC: Validate plugin app access permission targets the plugin (#59468)

* RBAC: Validate plugin app access permission targets the plugin

* Fix service test

pkg/services/accesscontrol/pluginutils/utils.go

@@ -17,6 +17,11 @@ func ValidatePluginPermissions(pluginID string, permissions []ac.Permission) err
 			return &ac.ErrorActionPrefixMissing{Action: permissions[i].Action,
 				Prefixes: []string{plugins.ActionAppAccess, pluginID + ":", pluginID + "."}}
 		}
+		if strings.HasPrefix(permissions[i].Action, plugins.ActionAppAccess) &&
+			permissions[i].Scope != plugins.ScopeProvider.GetResourceScope(pluginID) {
+			return &ac.ErrorScopeTarget{Action: permissions[i].Action, Scope: permissions[i].Scope,
+				ExpectedScope: plugins.ScopeProvider.GetResourceScope(pluginID)}
+		}
 	}
 
 	return nil

pkg/services/accesscontrol/pluginutils/utils_test.go

@@ -122,12 +122,23 @@ func TestValidatePluginRole(t *testing.T) {
 			role: ac.RoleDTO{
 				Name: "plugins:test-app:reader",
 				Permissions: []ac.Permission{
-					{Action: "plugins.app:access"},
+					{Action: "plugins.app:access", Scope: "plugins:id:test-app"},
 					{Action: "test-app:read"},
 					{Action: "test-app.resources:read"},
 				},
 			},
 		},
+		{
+			name:     "invalid permission targets other plugin",
+			pluginID: "test-app",
+			role: ac.RoleDTO{
+				Name: "plugins:test-app:reader",
+				Permissions: []ac.Permission{
+					{Action: "plugins.app:access", Scope: "plugins:id:other-app"},
+				},
+			},
+			wantErr: &ac.ErrorInvalidRole{},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {