RBAC: Remove builtin role code (#53767)

* remove rbacBuiltInRoleAssignmentEnabled from frontendsettings

* RBAC: Remove RBACBuiltInRoleAssignmentEnabled

* RBAC: Remove code for builtin role

* RolePicker: Remove unused prop

* RolePicker: Rename builtinRole to basicRole

* RolePicker: Rename onBuiltinRoleChange to onBasicRoleChange

* RolePicker: Rename properties

pkg/api/frontendsettings.go

@@ -112,7 +112,6 @@ func (hs *HTTPServer) getFrontendSettingsMap(c *models.ReqContext) (map[string]i
 		"sigV4AuthEnabled":                    setting.SigV4AuthEnabled,
 		"azureAuthEnabled":                    setting.AzureAuthEnabled,
 		"rbacEnabled":                         hs.Cfg.RBACEnabled,
-		"rbacBuiltInRoleAssignmentEnabled":    hs.Cfg.RBACBuiltInRoleAssignmentEnabled,
 		"exploreEnabled":                      setting.ExploreEnabled,
 		"helpEnabled":                         setting.HelpEnabled,
 		"profileEnabled":                      setting.ProfileEnabled,

pkg/services/accesscontrol/accesscontrol.go

@@ -272,16 +272,9 @@ func IsDisabled(cfg *setting.Cfg) bool {
 }
 
 // GetOrgRoles returns legacy org roles for a user
-func GetOrgRoles(cfg *setting.Cfg, user *user.SignedInUser) []string {
+func GetOrgRoles(user *user.SignedInUser) []string {
 	roles := []string{string(user.OrgRole)}
 
-	// With built-in role simplifying, inheritance is performed upon role registration.
-	if cfg.RBACBuiltInRoleAssignmentEnabled {
-		for _, br := range user.OrgRole.Children() {
-			roles = append(roles, string(br))
-		}
-	}
-
 	if user.IsGrafanaAdmin {
 		roles = append(roles, RoleGrafanaAdmin)
 	}

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -112,7 +112,7 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 	dbPermissions, err := ac.store.GetUserPermissions(ctx, accesscontrol.GetUserPermissionsQuery{
 		OrgID:   user.OrgID,
 		UserID:  user.UserID,
-		Roles:   accesscontrol.GetOrgRoles(ac.cfg, user),
+		Roles:   accesscontrol.GetOrgRoles(user),
 		TeamIDs: user.Teams,
 		Actions: actionsToFetch,
 	})
@@ -136,7 +136,7 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 func (ac *OSSAccessControlService) getFixedPermissions(ctx context.Context, user *user.SignedInUser) []accesscontrol.Permission {
 	permissions := make([]accesscontrol.Permission, 0)
 
-	for _, builtin := range accesscontrol.GetOrgRoles(ac.cfg, user) {
+	for _, builtin := range accesscontrol.GetOrgRoles(user) {
 		if basicRole, ok := ac.roles[builtin]; ok {
 			permissions = append(permissions, basicRole.Permissions...)
 		}

pkg/setting/setting.go

@@ -451,9 +451,6 @@ type Cfg struct {
 	// Access Control
 	RBACEnabled         bool
 	RBACPermissionCache bool
-	// Undocumented option as a backup in case removing builtin-role assignment
-	// fails
-	RBACBuiltInRoleAssignmentEnabled bool
 }
 
 type CommandLineArgs struct {
@@ -1356,7 +1353,6 @@ func readAccessControlSettings(iniFile *ini.File, cfg *Cfg) {
 	rbac := iniFile.Section("rbac")
 	cfg.RBACEnabled = rbac.Key("enabled").MustBool(true)
 	cfg.RBACPermissionCache = rbac.Key("permission_cache").MustBool(true)
-	cfg.RBACBuiltInRoleAssignmentEnabled = rbac.Key("builtin_role_assignment_enabled").MustBool(false)
 }
 
 func readUserSettings(iniFile *ini.File, cfg *Cfg) error {