Access control: Display inherited folder permissions in dashboards (#46421)

pkg/services/accesscontrol/resourcepermissions/api.go

@@ -65,7 +65,6 @@ func (a *api) getDescription(c *models.ReqContext) response.Response {
 
 type resourcePermissionDTO struct {
 	ID            int64    `json:"id"`
-	ResourceID    string   `json:"resourceId"`
 	RoleName      string   `json:"roleName"`
 	IsManaged     bool     `json:"isManaged"`
 	UserID        int64    `json:"userId,omitempty"`
@@ -105,9 +104,7 @@ func (a *api) getPermissions(c *models.ReqContext) response.Response {
 
 			dto = append(dto, resourcePermissionDTO{
 				ID:            p.ID,
-				ResourceID:    p.ResourceID,
 				RoleName:      p.RoleName,
-				IsManaged:     p.IsManaged(),
 				UserID:        p.UserId,
 				UserLogin:     p.UserLogin,
 				UserAvatarUrl: dtos.GetGravatarUrl(p.UserEmail),
@@ -117,6 +114,7 @@ func (a *api) getPermissions(c *models.ReqContext) response.Response {
 				BuiltInRole:   p.BuiltInRole,
 				Actions:       p.Actions,
 				Permission:    permission,
+				IsManaged:     p.IsManaged,
 			})
 		}
 	}

pkg/services/accesscontrol/resourcepermissions/api_test.go

@@ -482,7 +482,7 @@ func TestApi_UidSolver(t *testing.T) {
 	}
 }
 
-func withSolver(options Options, solver uidSolver) Options {
+func withSolver(options Options, solver UidSolver) Options {
 	options.UidSolver = solver
 	return options
 }

pkg/services/accesscontrol/resourcepermissions/middleware.go

@@ -1,7 +1,6 @@
 package resourcepermissions
 
 import (
-	"context"
 	"net/http"
 	"strconv"
 
@@ -10,9 +9,7 @@ import (
 	"github.com/grafana/grafana/pkg/web"
 )
 
-type uidSolver func(ctx context.Context, orgID int64, uid string) (int64, error)
-
-func solveUID(solve uidSolver) web.Handler {
+func solveUID(solve UidSolver) web.Handler {
 	return func(c *models.ReqContext) {
 		if solve != nil && util.IsValidShortUID(web.Params(c.Req)[":resourceID"]) {
 			params := web.Params(c.Req)

pkg/services/accesscontrol/resourcepermissions/options.go

@@ -7,7 +7,9 @@ import (
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 )
 
+type UidSolver func(ctx context.Context, orgID int64, uid string) (int64, error)
 type ResourceValidator func(ctx context.Context, orgID int64, resourceID string) error
+type InheritedScopesSolver func(ctx context.Context, orgID int64, resourceID string) ([]string, error)
 
 type Options struct {
 	// Resource is the action and scope prefix that is generated
@@ -35,5 +37,7 @@ type Options struct {
 	// OnSetBuiltInRole if configured will be called each time a permission is set for a built-in role
 	OnSetBuiltInRole func(session *sqlstore.DBSession, orgID int64, builtInRole, resourceID, permission string) error
 	// UidSolver if configured will be used in a middleware to translate an uid to id for each request
-	UidSolver uidSolver
+	UidSolver UidSolver
+	// InheritedScopesSolver if configured can generate additional scopes that will be used when fetching permissions for a resource
+	InheritedScopesSolver InheritedScopesSolver
 }

pkg/services/accesscontrol/resourcepermissions/service.go

@@ -42,8 +42,8 @@ type Store interface {
 		hooks types.ResourceHooks,
 	) ([]accesscontrol.ResourcePermission, error)
 
-	// GetResourcesPermissions will return all permission for all supplied resource ids
-	GetResourcesPermissions(ctx context.Context, orgID int64, query types.GetResourcesPermissionsQuery) ([]accesscontrol.ResourcePermission, error)
+	// GetResourcePermissions will return all permission for supplied resource id
+	GetResourcePermissions(ctx context.Context, orgID int64, query types.GetResourcePermissionsQuery) ([]accesscontrol.ResourcePermission, error)
 }
 
 func New(options Options, cfg *setting.Cfg, router routing.RouteRegister, ac accesscontrol.AccessControl, store Store, sqlStore *sqlstore.SQLStore) (*Service, error) {
@@ -101,12 +101,22 @@ type Service struct {
 }
 
 func (s *Service) GetPermissions(ctx context.Context, user *models.SignedInUser, resourceID string) ([]accesscontrol.ResourcePermission, error) {
-	return s.store.GetResourcesPermissions(ctx, user.OrgId, types.GetResourcesPermissionsQuery{
-		User:        user,
-		Actions:     s.actions,
-		Resource:    s.options.Resource,
-		ResourceIDs: []string{resourceID},
-		OnlyManaged: s.options.OnlyManaged,
+	var inheritedScopes []string
+	if s.options.InheritedScopesSolver != nil {
+		var err error
+		inheritedScopes, err = s.options.InheritedScopesSolver(ctx, user.OrgId, resourceID)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return s.store.GetResourcePermissions(ctx, user.OrgId, types.GetResourcePermissionsQuery{
+		User:            user,
+		Actions:         s.actions,
+		Resource:        s.options.Resource,
+		ResourceID:      resourceID,
+		InheritedScopes: inheritedScopes,
+		OnlyManaged:     s.options.OnlyManaged,
 	})
 }
 

pkg/services/accesscontrol/resourcepermissions/types/models.go

@@ -20,10 +20,11 @@ type SetResourcePermissionsCommand struct {
 	SetResourcePermissionCommand
 }
 
-type GetResourcesPermissionsQuery struct {
-	Actions     []string
-	Resource    string
-	ResourceIDs []string
-	OnlyManaged bool
-	User        *models.SignedInUser
+type GetResourcePermissionsQuery struct {
+	Actions         []string
+	Resource        string
+	ResourceID      string
+	OnlyManaged     bool
+	InheritedScopes []string
+	User            *models.SignedInUser
 }