From 493c7866a27ef36314e0a292b8d34cecf9a965b1 Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Mon, 29 Aug 2022 11:29:37 +0200
Subject: [PATCH] RBAC: Display indicator if a permission is inherited (#54080)
 (#54380)

* RBAC: Add IsInherited property

* PermissionList: Display inherited indicator

(cherry picked from commit cc784865356a81fc829333e6f706fcd18b32c130)

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
---
 pkg/services/accesscontrol/database/resource_permissions.go    | 3 ++-
 pkg/services/accesscontrol/models.go                           | 1 +
 pkg/services/accesscontrol/resourcepermissions/api.go          | 2 ++
 public/app/core/components/AccessControl/PermissionList.tsx    | 1 +
 .../app/core/components/AccessControl/PermissionListItem.tsx   | 3 ++-
 public/app/core/components/AccessControl/types.ts              | 1 +
 6 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkg/services/accesscontrol/database/resource_permissions.go b/pkg/services/accesscontrol/database/resource_permissions.go
index 69034277678..541e87f66a9 100644
--- a/pkg/services/accesscontrol/database/resource_permissions.go
+++ b/pkg/services/accesscontrol/database/resource_permissions.go
@@ -34,7 +34,7 @@ func (p *flatResourcePermission) IsManaged(scope string) bool {
 }
 
 func (p *flatResourcePermission) IsInherited(scope string) bool {
-	return p.Scope != scope
+	return !strings.HasPrefix(p.Scope, strings.Split(strings.ReplaceAll(scope, "*", ""), ":")[0])
 }
 
 func (s *AccessControlStore) SetUserResourcePermission(
@@ -472,6 +472,7 @@ func flatPermissionsToResourcePermission(scope string, permissions []flatResourc
 		Created:     first.Created,
 		Updated:     first.Updated,
 		IsManaged:   first.IsManaged(scope),
+		IsInherited: first.IsInherited(scope),
 	}
 }
 
diff --git a/pkg/services/accesscontrol/models.go b/pkg/services/accesscontrol/models.go
index 0317ea73b52..e171c808d36 100644
--- a/pkg/services/accesscontrol/models.go
+++ b/pkg/services/accesscontrol/models.go
@@ -234,6 +234,7 @@ type ResourcePermission struct {
 	Team        string
 	BuiltInRole string
 	IsManaged   bool
+	IsInherited bool
 	Created     time.Time
 	Updated     time.Time
 }
diff --git a/pkg/services/accesscontrol/resourcepermissions/api.go b/pkg/services/accesscontrol/resourcepermissions/api.go
index a1892130cfd..84639111aa4 100644
--- a/pkg/services/accesscontrol/resourcepermissions/api.go
+++ b/pkg/services/accesscontrol/resourcepermissions/api.go
@@ -74,6 +74,7 @@ type resourcePermissionDTO struct {
 	ID            int64    `json:"id"`
 	RoleName      string   `json:"roleName"`
 	IsManaged     bool     `json:"isManaged"`
+	IsInherited   bool     `json:"isInherited"`
 	UserID        int64    `json:"userId,omitempty"`
 	UserLogin     string   `json:"userLogin,omitempty"`
 	UserAvatarUrl string   `json:"userAvatarUrl,omitempty"`
@@ -122,6 +123,7 @@ func (a *api) getPermissions(c *models.ReqContext) response.Response {
 				Actions:       p.Actions,
 				Permission:    permission,
 				IsManaged:     p.IsManaged,
+				IsInherited:   p.IsInherited,
 			})
 		}
 	}
diff --git a/public/app/core/components/AccessControl/PermissionList.tsx b/public/app/core/components/AccessControl/PermissionList.tsx
index 2deed480de7..a2e59d98480 100644
--- a/public/app/core/components/AccessControl/PermissionList.tsx
+++ b/public/app/core/components/AccessControl/PermissionList.tsx
@@ -24,6 +24,7 @@ export const PermissionList = ({ title, items, permissionLevels, canSet, onRemov
           <tr>
             <th style={{ width: '1%' }} />
             <th>{title}</th>
+            <th style={{ width: '1%' }} />
             <th>Permission</th>
             <th style={{ width: '1%' }} />
             <th style={{ width: '1%' }} />
diff --git a/public/app/core/components/AccessControl/PermissionListItem.tsx b/public/app/core/components/AccessControl/PermissionListItem.tsx
index 93aaeb6ee40..25914988fc4 100644
--- a/public/app/core/components/AccessControl/PermissionListItem.tsx
+++ b/public/app/core/components/AccessControl/PermissionListItem.tsx
@@ -16,6 +16,7 @@ export const PermissionListItem = ({ item, permissionLevels, canSet, onRemove, o
   <tr>
     <td style={{ width: '1%' }}>{getAvatar(item)}</td>
     <td style={{ width: '90%' }}>{getDescription(item)}</td>
+    <td>{item.isInherited && <em className="muted no-wrap">Inherited from folder</em>}</td>
     <td>
       <div className="gf-form">
         <Select
@@ -43,7 +44,7 @@ export const PermissionListItem = ({ item, permissionLevels, canSet, onRemove, o
           aria-label={`Remove permission for ${getName(item)}`}
         />
       ) : (
-        <Tooltip content="Provisioned permission">
+        <Tooltip content={item.isInherited ? 'Inherited Permission' : 'Provisioned Permission'}>
           <Button size="sm" icon="lock" />
         </Tooltip>
       )}
diff --git a/public/app/core/components/AccessControl/types.ts b/public/app/core/components/AccessControl/types.ts
index e08589eefab..edbc3aed5bb 100644
--- a/public/app/core/components/AccessControl/types.ts
+++ b/public/app/core/components/AccessControl/types.ts
@@ -2,6 +2,7 @@ export type ResourcePermission = {
   id: number;
   resourceId: string;
   isManaged: boolean;
+  isInherited: boolean;
   userId?: number;
   userLogin?: string;
   userAvatarUrl?: string;