Access Control: Add fine-grained access control to ldap handlers (#35525)

* Add new accesscontrol action for ldap config reload

* Update ldapAdminEditRole with new ldap config reload permission

* wrap /ldap/reload with accesscontrol authorize middleware

* document new action and update fixed:ldap:admin:edit with said action

* add fake accesscontrol implementation for tests

* Add accesscontrol tests for ldap handlers

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>

pkg/api/common_test.go

@@ -1,12 +1,16 @@
 package api
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
 	"testing"
 
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/evaluator"
+
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"
 	"github.com/grafana/grafana/pkg/bus"
@@ -229,3 +233,40 @@ type fakeRenderService struct {
 func (s *fakeRenderService) Init() error {
 	return nil
 }
+
+var _ accesscontrol.AccessControl = new(fakeAccessControl)
+
+type fakeAccessControl struct {
+	isDisabled  bool
+	permissions []*accesscontrol.Permission
+}
+
+func (f *fakeAccessControl) Evaluate(ctx context.Context, user *models.SignedInUser, permission string, scope ...string) (bool, error) {
+	return evaluator.Evaluate(ctx, f, user, permission, scope...)
+}
+
+func (f *fakeAccessControl) GetUserPermissions(ctx context.Context, user *models.SignedInUser) ([]*accesscontrol.Permission, error) {
+	return f.permissions, nil
+}
+
+func (f *fakeAccessControl) IsDisabled() bool {
+	return f.isDisabled
+}
+
+func setupAccessControlScenarioContext(t *testing.T, cfg *setting.Cfg, url string, permissions []*accesscontrol.Permission) *scenarioContext {
+	cfg.FeatureToggles = make(map[string]bool)
+	cfg.FeatureToggles["accesscontrol"] = true
+
+	hs := &HTTPServer{
+		Cfg:           cfg,
+		RouteRegister: routing.NewRouteRegister(),
+		AccessControl: &fakeAccessControl{permissions: permissions},
+	}
+
+	sc := setupScenarioContext(t, url)
+
+	hs.registerRoutes()
+	hs.RouteRegister.Register(sc.m.Router)
+
+	return sc
+}