From 40164cb09ef4fc6226ab940661c5f67159e4f317 Mon Sep 17 00:00:00 2001
From: Cory Forseth <cory.forseth@grafana.com>
Date: Tue, 3 Jun 2025 11:21:42 -0500
Subject: [PATCH] Authorization: Fix/provisioned permission display (#106179)

* add isProvisioned flag to permission DTO

* handle provisioned permissions explicitly

* lint

* swagger

* simplify logic to always show non-managed permissions first; remove unnecessary isProvisioned

* fix docs

* oops

* actually just generate the docs
---
 .../accesscontrol/resourcepermissions/store.go         |  1 +
 public/api-enterprise-spec.json                        |  2 +-
 .../core/components/AccessControl/PermissionList.tsx   | 10 +++++++---
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkg/services/accesscontrol/resourcepermissions/store.go b/pkg/services/accesscontrol/resourcepermissions/store.go
index 5c50c90e77f..a2bc9c45557 100644
--- a/pkg/services/accesscontrol/resourcepermissions/store.go
+++ b/pkg/services/accesscontrol/resourcepermissions/store.go
@@ -496,6 +496,7 @@ func flatPermissionsToResourcePermissions(scope string, permissions []flatResour
 		} else if p.IsInherited(scope) {
 			inherited = append(inherited, p)
 		} else {
+			// Permissions which are neither managed nor inherited must have been provisioned
 			provisioned = append(provisioned, p)
 		}
 	}
diff --git a/public/api-enterprise-spec.json b/public/api-enterprise-spec.json
index 08eb4aebd31..d9dc456570f 100644
--- a/public/api-enterprise-spec.json
+++ b/public/api-enterprise-spec.json
@@ -10688,4 +10688,4 @@
       "name": "service_accounts"
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/public/app/core/components/AccessControl/PermissionList.tsx b/public/app/core/components/AccessControl/PermissionList.tsx
index 8fcef15408a..679fb88a4b5 100644
--- a/public/app/core/components/AccessControl/PermissionList.tsx
+++ b/public/app/core/components/AccessControl/PermissionList.tsx
@@ -30,9 +30,13 @@ export const PermissionList = ({ title, items, compareKey, permissionLevels, can
         continue;
       }
 
-      // If the same permission has been inherited and applied directly, keep the one that is applied directly
-      if (item.actions.length === keep[key].actions.length && !item.isInherited) {
-        keep[key] = item;
+      // Determine which permission to keep for display
+      // If the same permission has been applied more than once (i.e. one copy is ready kept)
+      if (item.actions.length === keep[key].actions.length) {
+        // replace the kept permission if it is managed and this item is not (i.e. it is inherited or provisioned)
+        if (keep[key].isManaged && !item.isManaged) {
+          keep[key] = item;
+        }
       }
     }
     return Object.keys(keep).map((k) => keep[k]);