From 35b8a6d5a702bacb71e9a34211b343be18f86ce5 Mon Sep 17 00:00:00 2001
From: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Date: Tue, 22 Oct 2024 09:56:03 +0100
Subject: [PATCH] Grant service account admin permissions upon creating a
 datasource

---
 pkg/api/datasources.go                                   | 1 +
 pkg/services/accesscontrol/ossaccesscontrol/receivers.go | 2 +-
 pkg/services/datasources/models.go                       | 4 ++++
 pkg/services/datasources/service/datasource.go           | 3 ++-
 4 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkg/api/datasources.go b/pkg/api/datasources.go
index 4a29dfa6c19..e3f7639eeac 100644
--- a/pkg/api/datasources.go
+++ b/pkg/api/datasources.go
@@ -447,6 +447,7 @@ func (hs *HTTPServer) AddDataSource(c *contextmodel.ReqContext) response.Respons
 	datasourcesLogger.Debug("Received command to add data source", "url", cmd.URL)
 	cmd.OrgID = c.SignedInUser.GetOrgID()
 	cmd.UserID = userID
+	cmd.UserRequester = c.SignedInUser
 	if cmd.URL != "" {
 		if resp := validateURL(cmd.Type, cmd.URL); resp != nil {
 			return resp
diff --git a/pkg/services/accesscontrol/ossaccesscontrol/receivers.go b/pkg/services/accesscontrol/ossaccesscontrol/receivers.go
index a818d8b3e84..1ba9ebcbed0 100644
--- a/pkg/services/accesscontrol/ossaccesscontrol/receivers.go
+++ b/pkg/services/accesscontrol/ossaccesscontrol/receivers.go
@@ -78,7 +78,7 @@ func (r ReceiverPermissionsService) SetDefaultPermissions(ctx context.Context, o
 	r.log.Debug("Setting default permissions for receiver", "receiver_uid", uid)
 	permissions := defaultPermissions()
 	clearCache := false
-	if user != nil && user.IsIdentityType(claims.TypeUser) {
+	if user != nil && user.IsIdentityType(claims.TypeUser, claims.TypeServiceAccount) {
 		userID, err := user.GetInternalID()
 		if err != nil {
 			r.log.Error("Could not make user admin", "receiver_uid", uid, "id", user.GetID(), "error", err)
diff --git a/pkg/services/datasources/models.go b/pkg/services/datasources/models.go
index c9697c2b161..db9bf3f9d42 100644
--- a/pkg/services/datasources/models.go
+++ b/pkg/services/datasources/models.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"time"
 
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/grafana/grafana/pkg/services/quota"
 	"github.com/grafana/grafana/pkg/services/user"
@@ -176,6 +177,9 @@ type AddDataSourceCommand struct {
 	ReadOnly                bool              `json:"-"`
 	EncryptedSecureJsonData map[string][]byte `json:"-"`
 	UpdateSecretFn          UpdateSecretFn    `json:"-"`
+
+	// Refactor to use User field instead of UserRequester
+	UserRequester identity.Requester
 }
 
 // Also acts as api DTO
diff --git a/pkg/services/datasources/service/datasource.go b/pkg/services/datasources/service/datasource.go
index c553bd2cd08..766d2ec0296 100644
--- a/pkg/services/datasources/service/datasource.go
+++ b/pkg/services/datasources/service/datasource.go
@@ -11,6 +11,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/grafana/authlib/claims"
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
 	sdkproxy "github.com/grafana/grafana-plugin-sdk-go/backend/proxy"
@@ -290,7 +291,7 @@ func (s *Service) AddDataSource(ctx context.Context, cmd *datasources.AddDataSou
 				{BuiltinRole: "Viewer", Permission: "Query"},
 				{BuiltinRole: "Editor", Permission: "Query"},
 			}
-			if cmd.UserID != 0 {
+			if cmd.UserID != 0 || (cmd.UserRequester.IsIdentityType(claims.TypeUser, claims.TypeServiceAccount)) {
 				permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{UserID: cmd.UserID, Permission: "Admin"})
 			}
 			if _, err = s.permissionsService.SetPermissions(ctx, cmd.OrgID, dataSource.UID, permissions...); err != nil {