RBAC: Refine validation of external services permissions (#68633)

* RBAC: Refine validation of external services permissions

* Forgot to log the ext-id

pkg/services/accesscontrol/models_test.go

@@ -8,10 +8,11 @@ import (
 
 func TestSaveExternalServiceRoleCommand_Validate(t *testing.T) {
 	tests := []struct {
-		name    string
-		cmd     SaveExternalServiceRoleCommand
-		wantID  string
-		wantErr bool
+		name            string
+		cmd             SaveExternalServiceRoleCommand
+		wantID          string
+		wantPermissions []Permission
+		wantErr         bool
 	}{
 		{
 			name: "invalid global statement",
@@ -64,6 +65,32 @@ func TestSaveExternalServiceRoleCommand_Validate(t *testing.T) {
 			wantErr: false,
 			wantID:  "thisis-a-very-strange-app-name",
 		},
+		{
+			name: "invalid empty Action",
+			cmd: SaveExternalServiceRoleCommand{
+				OrgID:             1,
+				ExternalServiceID: "app 1",
+				ServiceAccountID:  2,
+				Permissions:       []Permission{{Action: "", Scope: "users:id:1"}},
+			},
+			wantID:  "app-1",
+			wantErr: true,
+		},
+		{
+			name: "permission deduplication",
+			cmd: SaveExternalServiceRoleCommand{
+				OrgID:             1,
+				ExternalServiceID: "app 1",
+				ServiceAccountID:  2,
+				Permissions: []Permission{
+					{Action: "users:read", Scope: "users:id:1"},
+					{Action: "users:read", Scope: "users:id:1"},
+				},
+			},
+			wantErr:         false,
+			wantID:          "app-1",
+			wantPermissions: []Permission{{Action: "users:read", Scope: "users:id:1"}},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -75,6 +102,9 @@ func TestSaveExternalServiceRoleCommand_Validate(t *testing.T) {
 			require.NoError(t, err)
 
 			require.Equal(t, tt.wantID, tt.cmd.ExternalServiceID)
+			if tt.wantPermissions != nil {
+				require.ElementsMatch(t, tt.wantPermissions, tt.cmd.Permissions)
+			}
 		})
 	}
 }