Chore: Move methods from sqlstore to user store (#56305)

* Copy sqlstore methods to suer store

* Adjust ProvideService signatures in test

* Add xorm tags and tests for search

* Remove methods from sqlstore

* fix lint in tests

pkg/services/user/userimpl/store.go

@@ -9,11 +9,13 @@ import (
 
 	"github.com/grafana/grafana/pkg/events"
 	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/services/sqlstore/db"
 	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/util"
 )
 
 type store interface {
@@ -33,6 +35,9 @@ type store interface {
 	GetProfile(context.Context, *user.GetUserProfileQuery) (*user.UserProfileDTO, error)
 	SetHelpFlag(context.Context, *user.SetUserHelpFlagCommand) error
 	UpdatePermissions(context.Context, int64, bool) error
+	BatchDisableUsers(context.Context, *user.BatchDisableUsersCommand) error
+	Disable(context.Context, *user.DisableUserCommand) error
+	Search(context.Context, *user.SearchUsersQuery) (*user.SearchUserQueryResult, error)
 }
 
 type sqlStore struct {
@@ -469,3 +474,158 @@ func validateOneAdminLeft(ctx context.Context, sess *sqlstore.DBSession) error {
 
 	return nil
 }
+
+func (ss *sqlStore) BatchDisableUsers(ctx context.Context, cmd *user.BatchDisableUsersCommand) error {
+	return ss.db.WithTransactionalDbSession(ctx, func(sess *sqlstore.DBSession) error {
+		userIds := cmd.UserIDs
+
+		if len(userIds) == 0 {
+			return nil
+		}
+
+		user_id_params := strings.Repeat(",?", len(userIds)-1)
+		disableSQL := "UPDATE " + ss.dialect.Quote("user") + " SET is_disabled=? WHERE Id IN (?" + user_id_params + ")"
+
+		disableParams := []interface{}{disableSQL, cmd.IsDisabled}
+		for _, v := range userIds {
+			disableParams = append(disableParams, v)
+		}
+
+		_, err := sess.Where(ss.notServiceAccountFilter()).Exec(disableParams...)
+		return err
+	})
+}
+
+func (ss *sqlStore) Disable(ctx context.Context, cmd *user.DisableUserCommand) error {
+	return ss.db.WithDbSession(ctx, func(dbSess *sqlstore.DBSession) error {
+		usr := user.User{}
+		sess := dbSess.Table("user")
+
+		if has, err := sess.ID(cmd.UserID).Where(ss.notServiceAccountFilter()).Get(&usr); err != nil {
+			return err
+		} else if !has {
+			return user.ErrUserNotFound
+		}
+
+		usr.IsDisabled = cmd.IsDisabled
+		sess.UseBool("is_disabled")
+
+		_, err := sess.ID(cmd.UserID).Update(&usr)
+		return err
+	})
+}
+
+func (ss *sqlStore) Search(ctx context.Context, query *user.SearchUsersQuery) (*user.SearchUserQueryResult, error) {
+	result := user.SearchUserQueryResult{
+		Users: make([]*user.UserSearchHitDTO, 0),
+	}
+	err := ss.db.WithDbSession(ctx, func(dbSess *sqlstore.DBSession) error {
+		queryWithWildcards := "%" + query.Query + "%"
+
+		whereConditions := make([]string, 0)
+		whereParams := make([]interface{}, 0)
+		sess := dbSess.Table("user").Alias("u")
+
+		whereConditions = append(whereConditions, "u.is_service_account = ?")
+		whereParams = append(whereParams, ss.dialect.BooleanStr(false))
+
+		// Join with only most recent auth module
+		joinCondition := `(
+		SELECT id from user_auth
+			WHERE user_auth.user_id = u.id
+			ORDER BY user_auth.created DESC `
+		joinCondition = "user_auth.id=" + joinCondition + ss.dialect.Limit(1) + ")"
+		sess.Join("LEFT", "user_auth", joinCondition)
+		if query.OrgID > 0 {
+			whereConditions = append(whereConditions, "org_id = ?")
+			whereParams = append(whereParams, query.OrgID)
+		}
+
+		// user only sees the users for which it has read permissions
+		if !accesscontrol.IsDisabled(ss.cfg) {
+			acFilter, err := accesscontrol.Filter(query.SignedInUser, "u.id", "global.users:id:", accesscontrol.ActionUsersRead)
+			if err != nil {
+				return err
+			}
+			whereConditions = append(whereConditions, acFilter.Where)
+			whereParams = append(whereParams, acFilter.Args...)
+		}
+
+		if query.Query != "" {
+			whereConditions = append(whereConditions, "(email "+ss.dialect.LikeStr()+" ? OR name "+ss.dialect.LikeStr()+" ? OR login "+ss.dialect.LikeStr()+" ?)")
+			whereParams = append(whereParams, queryWithWildcards, queryWithWildcards, queryWithWildcards)
+		}
+
+		if query.IsDisabled != nil {
+			whereConditions = append(whereConditions, "is_disabled = ?")
+			whereParams = append(whereParams, query.IsDisabled)
+		}
+
+		if query.AuthModule != "" {
+			whereConditions = append(whereConditions, `auth_module=?`)
+			whereParams = append(whereParams, query.AuthModule)
+		}
+
+		if len(whereConditions) > 0 {
+			sess.Where(strings.Join(whereConditions, " AND "), whereParams...)
+		}
+
+		for _, filter := range query.Filters {
+			if jc := filter.JoinCondition(); jc != nil {
+				sess.Join(jc.Operator, jc.Table, jc.Params)
+			}
+			if ic := filter.InCondition(); ic != nil {
+				sess.In(ic.Condition, ic.Params)
+			}
+			if wc := filter.WhereCondition(); wc != nil {
+				sess.Where(wc.Condition, wc.Params)
+			}
+		}
+
+		if query.Limit > 0 {
+			offset := query.Limit * (query.Page - 1)
+			sess.Limit(query.Limit, offset)
+		}
+
+		sess.Cols("u.id", "u.email", "u.name", "u.login", "u.is_admin", "u.is_disabled", "u.last_seen_at", "user_auth.auth_module")
+		sess.Asc("u.login", "u.email")
+		if err := sess.Find(&result.Users); err != nil {
+			return err
+		}
+
+		// get total
+		user := user.User{}
+		countSess := dbSess.Table("user").Alias("u")
+
+		// Join with user_auth table if users filtered by auth_module
+		if query.AuthModule != "" {
+			countSess.Join("LEFT", "user_auth", joinCondition)
+		}
+
+		if len(whereConditions) > 0 {
+			countSess.Where(strings.Join(whereConditions, " AND "), whereParams...)
+		}
+
+		for _, filter := range query.Filters {
+			if jc := filter.JoinCondition(); jc != nil {
+				countSess.Join(jc.Operator, jc.Table, jc.Params)
+			}
+			if ic := filter.InCondition(); ic != nil {
+				countSess.In(ic.Condition, ic.Params)
+			}
+			if wc := filter.WhereCondition(); wc != nil {
+				countSess.Where(wc.Condition, wc.Params)
+			}
+		}
+
+		count, err := countSess.Count(&user)
+		result.TotalCount = count
+
+		for _, user := range result.Users {
+			user.LastSeenAtAge = util.GetAgeString(user.LastSeenAt)
+		}
+
+		return err
+	})
+	return &result, err
+}

pkg/services/user/userimpl/store_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
@@ -24,6 +25,10 @@ func TestIntegrationUserDataAccess(t *testing.T) {
 
 	ss := sqlstore.InitTestDB(t)
 	userStore := ProvideStore(ss, setting.NewCfg())
+	usr := &user.SignedInUser{
+		OrgID:       1,
+		Permissions: map[int64]map[string][]string{1: {"users:read": {"global.users:*"}}},
+	}
 
 	t.Run("user not found", func(t *testing.T) {
 		_, err := userStore.Get(context.Background(),
@@ -311,6 +316,373 @@ func TestIntegrationUserDataAccess(t *testing.T) {
 		err := userStore.SetHelpFlag(context.Background(), &user.SetUserHelpFlagCommand{UserID: 1, HelpFlags1: user.HelpFlags1(1)})
 		require.NoError(t, err)
 	})
+
+	t.Run("Testing DB - return list users based on their is_disabled flag", func(t *testing.T) {
+		ss = sqlstore.InitTestDB(t)
+		createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email:      fmt.Sprint("user", i, "@test.com"),
+				Name:       fmt.Sprint("user", i),
+				Login:      fmt.Sprint("loginuser", i),
+				IsDisabled: i%2 == 0,
+			}
+		})
+
+		isDisabled := false
+		query := user.SearchUsersQuery{IsDisabled: &isDisabled, SignedInUser: usr}
+		result, err := userStore.Search(context.Background(), &query)
+		require.Nil(t, err)
+
+		require.Len(t, result.Users, 2)
+
+		first, third := false, false
+		for _, user := range result.Users {
+			if user.Name == "user1" {
+				first = true
+			}
+
+			if user.Name == "user3" {
+				third = true
+			}
+		}
+
+		require.True(t, first)
+		require.True(t, third)
+
+		// Re-init DB
+		ss = sqlstore.InitTestDB(t)
+		users := createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email:      fmt.Sprint("user", i, "@test.com"),
+				Name:       fmt.Sprint("user", i),
+				Login:      fmt.Sprint("loginuser", i),
+				IsDisabled: false,
+			}
+		})
+
+		err = ss.AddOrgUser(context.Background(), &models.AddOrgUserCommand{
+			LoginOrEmail: users[1].Login, Role: org.RoleViewer,
+			OrgId: users[0].OrgID, UserId: users[1].ID,
+		})
+		require.Nil(t, err)
+
+		err = updateDashboardACL(t, ss, 1, &models.DashboardACL{
+			DashboardID: 1, OrgID: users[0].OrgID, UserID: users[1].ID,
+			Permission: models.PERMISSION_EDIT,
+		})
+		require.Nil(t, err)
+
+		// When the user is deleted
+		err = ss.DeleteUser(context.Background(), &models.DeleteUserCommand{UserId: users[1].ID})
+		require.Nil(t, err)
+
+		query1 := &org.GetOrgUsersQuery{OrgID: users[0].OrgID, User: usr}
+		query1Result, err := userStore.getOrgUsersForTest(context.Background(), query1)
+		require.Nil(t, err)
+
+		require.Len(t, query1Result, 1)
+
+		permQuery := &models.GetDashboardACLInfoListQuery{DashboardID: 1, OrgID: users[0].OrgID}
+		err = userStore.getDashboardACLInfoList(permQuery)
+		require.Nil(t, err)
+
+		require.Len(t, permQuery.Result, 0)
+
+		// A user is an org member and has been assigned permissions
+		// Re-init DB
+		ss = sqlstore.InitTestDB(t)
+		users = createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email:      fmt.Sprint("user", i, "@test.com"),
+				Name:       fmt.Sprint("user", i),
+				Login:      fmt.Sprint("loginuser", i),
+				IsDisabled: false,
+			}
+		})
+		err = ss.AddOrgUser(context.Background(), &models.AddOrgUserCommand{
+			LoginOrEmail: users[1].Login, Role: org.RoleViewer,
+			OrgId: users[0].OrgID, UserId: users[1].ID,
+		})
+		require.Nil(t, err)
+
+		err = updateDashboardACL(t, ss, 1, &models.DashboardACL{
+			DashboardID: 1, OrgID: users[0].OrgID, UserID: users[1].ID,
+			Permission: models.PERMISSION_EDIT,
+		})
+		require.Nil(t, err)
+
+		ss.CacheService.Flush()
+
+		query3 := &models.GetSignedInUserQuery{OrgId: users[1].OrgID, UserId: users[1].ID}
+		err = ss.GetSignedInUserWithCacheCtx(context.Background(), query3)
+		require.Nil(t, err)
+		require.NotNil(t, query3.Result)
+		require.Equal(t, query3.OrgId, users[1].OrgID)
+		err = ss.SetUsingOrg(context.Background(), &models.SetUsingOrgCommand{UserId: users[1].ID, OrgId: users[0].OrgID})
+		require.Nil(t, err)
+		query4 := &models.GetSignedInUserQuery{OrgId: 0, UserId: users[1].ID}
+		err = ss.GetSignedInUserWithCacheCtx(context.Background(), query4)
+		require.Nil(t, err)
+		require.NotNil(t, query4.Result)
+		require.Equal(t, query4.Result.OrgID, users[0].OrgID)
+
+		cacheKey := newSignedInUserCacheKey(query4.Result.OrgID, query4.UserId)
+		_, found := ss.CacheService.Get(cacheKey)
+		require.True(t, found)
+
+		disableCmd := user.BatchDisableUsersCommand{
+			UserIDs:    []int64{users[0].ID, users[1].ID, users[2].ID, users[3].ID, users[4].ID},
+			IsDisabled: true,
+		}
+
+		err = userStore.BatchDisableUsers(context.Background(), &disableCmd)
+		require.Nil(t, err)
+
+		isDisabled = true
+		query5 := &user.SearchUsersQuery{IsDisabled: &isDisabled, SignedInUser: usr}
+		query5Result, err := userStore.Search(context.Background(), query5)
+		require.Nil(t, err)
+		require.EqualValues(t, query5Result.TotalCount, 5)
+
+		// the user is deleted
+		err = ss.DeleteUser(context.Background(), &models.DeleteUserCommand{UserId: users[1].ID})
+		require.Nil(t, err)
+
+		// delete connected org users and permissions
+		query2 := &org.GetOrgUsersQuery{OrgID: users[0].OrgID}
+		query2Result, err := userStore.getOrgUsersForTest(context.Background(), query2)
+		require.Nil(t, err)
+
+		require.Len(t, query2Result, 1)
+
+		permQuery = &models.GetDashboardACLInfoListQuery{DashboardID: 1, OrgID: users[0].OrgID}
+		err = userStore.getDashboardACLInfoList(permQuery)
+		require.Nil(t, err)
+
+		require.Len(t, permQuery.Result, 0)
+	})
+
+	t.Run("Testing DB - return list of users that the SignedInUser has permission to read", func(t *testing.T) {
+		ss := sqlstore.InitTestDB(t)
+		createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email: fmt.Sprint("user", i, "@test.com"),
+				Name:  fmt.Sprint("user", i),
+				Login: fmt.Sprint("loginuser", i),
+			}
+		})
+
+		testUser := &user.SignedInUser{
+			OrgID:       1,
+			Permissions: map[int64]map[string][]string{1: {"users:read": {"global.users:id:1", "global.users:id:3"}}},
+		}
+		query := user.SearchUsersQuery{SignedInUser: testUser}
+		queryResult, err := userStore.Search(context.Background(), &query)
+		assert.Nil(t, err)
+		assert.Len(t, queryResult.Users, 2)
+	})
+
+	ss = sqlstore.InitTestDB(t)
+
+	t.Run("Testing DB - enable all users", func(t *testing.T) {
+		users := createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email:      fmt.Sprint("user", i, "@test.com"),
+				Name:       fmt.Sprint("user", i),
+				Login:      fmt.Sprint("loginuser", i),
+				IsDisabled: true,
+			}
+		})
+
+		disableCmd := user.BatchDisableUsersCommand{
+			UserIDs:    []int64{users[0].ID, users[1].ID, users[2].ID, users[3].ID, users[4].ID},
+			IsDisabled: false,
+		}
+
+		err := userStore.BatchDisableUsers(context.Background(), &disableCmd)
+		require.Nil(t, err)
+
+		isDisabled := false
+		query := &user.SearchUsersQuery{IsDisabled: &isDisabled, SignedInUser: usr}
+		queryResult, err := userStore.Search(context.Background(), query)
+
+		require.Nil(t, err)
+		require.EqualValues(t, queryResult.TotalCount, 5)
+	})
+
+	t.Run("Can search users", func(t *testing.T) {
+		ss = sqlstore.InitTestDB(t)
+		userStore.cfg.AutoAssignOrg = false
+
+		ac1cmd := user.CreateUserCommand{Login: "ac1", Email: "ac1@test.com", Name: "ac1 name"}
+		ac2cmd := user.CreateUserCommand{Login: "ac2", Email: "ac2@test.com", Name: "ac2 name", IsAdmin: true}
+		serviceaccountcmd := user.CreateUserCommand{Login: "serviceaccount", Email: "service@test.com", Name: "serviceaccount name", IsAdmin: true, IsServiceAccount: true}
+
+		_, err := ss.CreateUser(context.Background(), ac1cmd)
+		require.NoError(t, err)
+		_, err = ss.CreateUser(context.Background(), ac2cmd)
+		require.NoError(t, err)
+		// user only used for making sure we filter out the service accounts
+		_, err = ss.CreateUser(context.Background(), serviceaccountcmd)
+		require.NoError(t, err)
+		query := user.SearchUsersQuery{Query: "", SignedInUser: &user.SignedInUser{
+			OrgID: 1,
+			Permissions: map[int64]map[string][]string{
+				1: {accesscontrol.ActionUsersRead: {accesscontrol.ScopeGlobalUsersAll}},
+			},
+		}}
+		queryResult, err := userStore.Search(context.Background(), &query)
+		require.NoError(t, err)
+		require.Len(t, queryResult.Users, 2)
+		require.Equal(t, queryResult.Users[0].Email, "ac1@test.com")
+		require.Equal(t, queryResult.Users[1].Email, "ac2@test.com")
+	})
+
+	ss = sqlstore.InitTestDB(t)
+
+	t.Run("Testing DB - disable only specific users", func(t *testing.T) {
+		users := createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email:      fmt.Sprint("user", i, "@test.com"),
+				Name:       fmt.Sprint("user", i),
+				Login:      fmt.Sprint("loginuser", i),
+				IsDisabled: false,
+			}
+		})
+
+		userIdsToDisable := []int64{}
+		for i := 0; i < 3; i++ {
+			userIdsToDisable = append(userIdsToDisable, users[i].ID)
+		}
+		disableCmd := user.BatchDisableUsersCommand{
+			UserIDs:    userIdsToDisable,
+			IsDisabled: true,
+		}
+
+		err := userStore.BatchDisableUsers(context.Background(), &disableCmd)
+		require.Nil(t, err)
+
+		query := user.SearchUsersQuery{SignedInUser: usr}
+		queryResult, err := userStore.Search(context.Background(), &query)
+		require.Nil(t, err)
+		require.EqualValues(t, queryResult.TotalCount, 5)
+		for _, user := range queryResult.Users {
+			shouldBeDisabled := false
+
+			// Check if user id is in the userIdsToDisable list
+			for _, disabledUserId := range userIdsToDisable {
+				fmt.Println(user.ID, disabledUserId)
+				if user.ID == disabledUserId {
+					require.True(t, user.IsDisabled)
+					shouldBeDisabled = true
+				}
+			}
+
+			// Otherwise user shouldn't be disabled
+			if !shouldBeDisabled {
+				require.False(t, user.IsDisabled)
+			}
+		}
+	})
+
+	ss = sqlstore.InitTestDB(t)
+
+	t.Run("Testing DB - search users", func(t *testing.T) {
+		// Since previous tests were destructive
+		createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email:      fmt.Sprint("user", i, "@test.com"),
+				Name:       fmt.Sprint("user", i),
+				Login:      fmt.Sprint("loginuser", i),
+				IsDisabled: false,
+			}
+		})
+	})
+
+	t.Run("Disable user", func(t *testing.T) {
+		id, err := userStore.Insert(context.Background(), &user.User{
+			Name:    "user111",
+			Created: time.Now(),
+			Updated: time.Now(),
+		})
+		require.NoError(t, err)
+		err = userStore.Disable(context.Background(), &user.DisableUserCommand{UserID: id})
+		require.NoError(t, err)
+	})
+
+	t.Run("Testing DB - multiple users", func(t *testing.T) {
+		ss = sqlstore.InitTestDB(t)
+
+		createFiveTestUsers(t, ss, func(i int) *user.CreateUserCommand {
+			return &user.CreateUserCommand{
+				Email:      fmt.Sprint("user", i, "@test.com"),
+				Name:       fmt.Sprint("user", i),
+				Login:      fmt.Sprint("loginuser", i),
+				IsDisabled: false,
+			}
+		})
+
+		// Return the first page of users and a total count
+		query := user.SearchUsersQuery{Query: "", Page: 1, Limit: 3, SignedInUser: usr}
+		queryResult, err := userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 3)
+		require.EqualValues(t, queryResult.TotalCount, 5)
+
+		// Return the second page of users and a total count
+		query = user.SearchUsersQuery{Query: "", Page: 2, Limit: 3, SignedInUser: usr}
+		queryResult, err = userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 2)
+		require.EqualValues(t, queryResult.TotalCount, 5)
+
+		// Return list of users matching query on user name
+		query = user.SearchUsersQuery{Query: "use", Page: 1, Limit: 3, SignedInUser: usr}
+		queryResult, err = userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 3)
+		require.EqualValues(t, queryResult.TotalCount, 5)
+
+		query = user.SearchUsersQuery{Query: "ser1", Page: 1, Limit: 3, SignedInUser: usr}
+		queryResult, err = userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 1)
+		require.EqualValues(t, queryResult.TotalCount, 1)
+
+		query = user.SearchUsersQuery{Query: "USER1", Page: 1, Limit: 3, SignedInUser: usr}
+		queryResult, err = userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 1)
+		require.EqualValues(t, queryResult.TotalCount, 1)
+
+		query = user.SearchUsersQuery{Query: "idontexist", Page: 1, Limit: 3, SignedInUser: usr}
+		queryResult, err = userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 0)
+		require.EqualValues(t, queryResult.TotalCount, 0)
+
+		// Return list of users matching query on email
+		query = user.SearchUsersQuery{Query: "ser1@test.com", Page: 1, Limit: 3, SignedInUser: usr}
+		queryResult, err = userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 1)
+		require.EqualValues(t, queryResult.TotalCount, 1)
+
+		// Return list of users matching query on login name
+		query = user.SearchUsersQuery{Query: "loginuser1", Page: 1, Limit: 3, SignedInUser: usr}
+		queryResult, err = userStore.Search(context.Background(), &query)
+
+		require.Nil(t, err)
+		require.Len(t, queryResult.Users, 1)
+		require.EqualValues(t, queryResult.TotalCount, 1)
+	})
 }
 
 func TestIntegrationUserUpdate(t *testing.T) {
@@ -430,3 +802,102 @@ func updateDashboardACL(t *testing.T, sqlStore *sqlstore.SQLStore, dashboardID i
 	})
 	return err
 }
+
+func (ss *sqlStore) getOrgUsersForTest(ctx context.Context, query *org.GetOrgUsersQuery) ([]*org.OrgUserDTO, error) {
+	result := make([]*org.OrgUserDTO, 0)
+	err := ss.db.WithDbSession(ctx, func(dbSess *sqlstore.DBSession) error {
+		sess := dbSess.Table("org_user")
+		sess.Join("LEFT ", ss.dialect.Quote("user"), fmt.Sprintf("org_user.user_id=%s.id", ss.dialect.Quote("user")))
+		sess.Where("org_user.org_id=?", query.OrgID)
+		sess.Cols("org_user.org_id", "org_user.user_id", "user.email", "user.login", "org_user.role")
+
+		err := sess.Find(&result)
+		return err
+	})
+	return result, err
+}
+
+// This function was copied from pkg/services/dashboards/database to circumvent
+// import cycles. When this org-related code is refactored into a service the
+// tests can the real GetDashboardACLInfoList functions
+func (ss *sqlStore) getDashboardACLInfoList(query *models.GetDashboardACLInfoListQuery) error {
+	outerErr := ss.db.WithDbSession(context.Background(), func(dbSession *sqlstore.DBSession) error {
+		query.Result = make([]*models.DashboardACLInfoDTO, 0)
+		falseStr := ss.dialect.BooleanStr(false)
+
+		if query.DashboardID == 0 {
+			sql := `SELECT
+		da.id,
+		da.org_id,
+		da.dashboard_id,
+		da.user_id,
+		da.team_id,
+		da.permission,
+		da.role,
+		da.created,
+		da.updated,
+		'' as user_login,
+		'' as user_email,
+		'' as team,
+		'' as title,
+		'' as slug,
+		'' as uid,` +
+				falseStr + ` AS is_folder,` +
+				falseStr + ` AS inherited
+		FROM dashboard_acl as da
+		WHERE da.dashboard_id = -1`
+			return dbSession.SQL(sql).Find(&query.Result)
+		}
+
+		rawSQL := `
+			-- get permissions for the dashboard and its parent folder
+			SELECT
+				da.id,
+				da.org_id,
+				da.dashboard_id,
+				da.user_id,
+				da.team_id,
+				da.permission,
+				da.role,
+				da.created,
+				da.updated,
+				u.login AS user_login,
+				u.email AS user_email,
+				ug.name AS team,
+				ug.email AS team_email,
+				d.title,
+				d.slug,
+				d.uid,
+				d.is_folder,
+				CASE WHEN (da.dashboard_id = -1 AND d.folder_id > 0) OR da.dashboard_id = d.folder_id THEN ` + ss.dialect.BooleanStr(true) + ` ELSE ` + falseStr + ` END AS inherited
+			FROM dashboard as d
+				LEFT JOIN dashboard folder on folder.id = d.folder_id
+				LEFT JOIN dashboard_acl AS da ON
+				da.dashboard_id = d.id OR
+				da.dashboard_id = d.folder_id OR
+				(
+					-- include default permissions -->
+					da.org_id = -1 AND (
+					  (folder.id IS NOT NULL AND folder.has_acl = ` + falseStr + `) OR
+					  (folder.id IS NULL AND d.has_acl = ` + falseStr + `)
+					)
+				)
+				LEFT JOIN ` + ss.dialect.Quote("user") + ` AS u ON u.id = da.user_id
+				LEFT JOIN team ug on ug.id = da.team_id
+			WHERE d.org_id = ? AND d.id = ? AND da.id IS NOT NULL
+			ORDER BY da.id ASC
+			`
+
+		return dbSession.SQL(rawSQL, query.OrgID, query.DashboardID).Find(&query.Result)
+	})
+
+	if outerErr != nil {
+		return outerErr
+	}
+
+	for _, p := range query.Result {
+		p.PermissionName = p.Permission.String()
+	}
+
+	return nil
+}

pkg/services/user/userimpl/user.go

@@ -10,7 +10,6 @@ import (
 	"github.com/grafana/grafana/pkg/models"
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/org"
-	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/services/sqlstore/db"
 	"github.com/grafana/grafana/pkg/services/team"
 	"github.com/grafana/grafana/pkg/services/user"
@@ -23,16 +22,13 @@ type Service struct {
 	orgService   org.Service
 	teamService  team.Service
 	cacheService *localcache.CacheService
-	// TODO remove sqlstore
-	sqlStore *sqlstore.SQLStore
-	cfg      *setting.Cfg
+	cfg          *setting.Cfg
 }
 
 func ProvideService(
 	db db.DB,
 	orgService org.Service,
 	cfg *setting.Cfg,
-	ss *sqlstore.SQLStore,
 	teamService team.Service,
 	cacheService *localcache.CacheService,
 ) user.Service {
@@ -41,7 +37,6 @@ func ProvideService(
 		store:        &store,
 		orgService:   orgService,
 		cfg:          cfg,
-		sqlStore:     ss,
 		teamService:  teamService,
 		cacheService: cacheService,
 	}
@@ -259,64 +254,16 @@ func (s *Service) GetSignedInUser(ctx context.Context, query *user.GetSignedInUs
 	return signedInUser, err
 }
 
-// TODO: remove wrapper around sqlstore
 func (s *Service) Search(ctx context.Context, query *user.SearchUsersQuery) (*user.SearchUserQueryResult, error) {
-	var usrSeschHitDTOs []*user.UserSearchHitDTO
-	q := &models.SearchUsersQuery{
-		SignedInUser: query.SignedInUser,
-		Query:        query.Query,
-		OrgId:        query.OrgID,
-		Page:         query.Page,
-		Limit:        query.Limit,
-		AuthModule:   query.AuthModule,
-		Filters:      query.Filters,
-		IsDisabled:   query.IsDisabled,
-	}
-	err := s.sqlStore.SearchUsers(ctx, q)
-	if err != nil {
-		return nil, err
-	}
-	for _, usrSearch := range q.Result.Users {
-		usrSeschHitDTOs = append(usrSeschHitDTOs, &user.UserSearchHitDTO{
-			ID:            usrSearch.Id,
-			Login:         usrSearch.Login,
-			Email:         usrSearch.Email,
-			Name:          usrSearch.Name,
-			AvatarUrl:     usrSearch.AvatarUrl,
-			IsDisabled:    usrSearch.IsDisabled,
-			IsAdmin:       usrSearch.IsAdmin,
-			LastSeenAt:    usrSearch.LastSeenAt,
-			LastSeenAtAge: usrSearch.LastSeenAtAge,
-			AuthLabels:    usrSearch.AuthLabels,
-			AuthModule:    user.AuthModuleConversion(usrSearch.AuthModule),
-		})
-	}
-
-	res := &user.SearchUserQueryResult{
-		Users:      usrSeschHitDTOs,
-		TotalCount: q.Result.TotalCount,
-		Page:       q.Result.Page,
-		PerPage:    q.Result.PerPage,
-	}
-	return res, nil
+	return s.store.Search(ctx, query)
 }
 
-// TODO: remove wrapper around sqlstore
 func (s *Service) Disable(ctx context.Context, cmd *user.DisableUserCommand) error {
-	q := &models.DisableUserCommand{
-		UserId:     cmd.UserID,
-		IsDisabled: cmd.IsDisabled,
-	}
-	return s.sqlStore.DisableUser(ctx, q)
+	return s.store.Disable(ctx, cmd)
 }
 
-// TODO: remove wrapper around sqlstore
 func (s *Service) BatchDisableUsers(ctx context.Context, cmd *user.BatchDisableUsersCommand) error {
-	c := &models.BatchDisableUsersCommand{
-		UserIds:    cmd.UserIDs,
-		IsDisabled: cmd.IsDisabled,
-	}
-	return s.sqlStore.BatchDisableUsers(ctx, c)
+	return s.store.BatchDisableUsers(ctx, cmd)
 }
 
 func (s *Service) UpdatePermissions(ctx context.Context, userID int64, isAdmin bool) error {

pkg/services/user/userimpl/user_test.go

@@ -129,11 +129,12 @@ func TestUserService(t *testing.T) {
 }
 
 type FakeUserStore struct {
-	ExpectedUser            *user.User
-	ExpectedSignedInUser    *user.SignedInUser
-	ExpectedUserProfile     *user.UserProfileDTO
-	ExpectedError           error
-	ExpectedDeleteUserError error
+	ExpectedUser                  *user.User
+	ExpectedSignedInUser          *user.SignedInUser
+	ExpectedUserProfile           *user.UserProfileDTO
+	ExpectedSearchUserQueryResult *user.SearchUserQueryResult
+	ExpectedError                 error
+	ExpectedDeleteUserError       error
 }
 
 func newUserStoreFake() *FakeUserStore {
@@ -203,3 +204,15 @@ func (f *FakeUserStore) SetHelpFlag(ctx context.Context, cmd *user.SetUserHelpFl
 func (f *FakeUserStore) UpdatePermissions(ctx context.Context, userID int64, isAdmin bool) error {
 	return f.ExpectedError
 }
+
+func (f *FakeUserStore) BatchDisableUsers(ctx context.Context, cmd *user.BatchDisableUsersCommand) error {
+	return f.ExpectedError
+}
+
+func (f *FakeUserStore) Disable(ctx context.Context, cmd *user.DisableUserCommand) error {
+	return f.ExpectedError
+}
+
+func (f *FakeUserStore) Search(ctx context.Context, query *user.SearchUsersQuery) (*user.SearchUserQueryResult, error) {
+	return f.ExpectedSearchUserQueryResult, f.ExpectedError
+}