Revert "AccessControl: Implement a way to register fixed roles (#35641)" (#37397)

This reverts commit 88c11f1cc0.

pkg/services/accesscontrol/roles.go

@@ -1,173 +1,198 @@
 package accesscontrol
 
-import (
-	"fmt"
-	"strings"
-	"sync"
+import "github.com/grafana/grafana/pkg/models"
 
-	"github.com/grafana/grafana/pkg/models"
-)
-
-// Roles definition
-var (
-	datasourcesEditorReadRole = RoleDTO{
-		Version: 1,
-		Name:    datasourcesEditorRead,
-		Permissions: []Permission{
-			{
-				Action: ActionDatasourcesExplore,
-			},
+var datasourcesEditorReadRole = RoleDTO{
+	Version: 1,
+	Name:    datasourcesEditorRead,
+	Permissions: []Permission{
+		{
+			Action: ActionDatasourcesExplore,
 		},
-	}
+	},
+}
 
-	ldapAdminReadRole = RoleDTO{
-		Name:    ldapAdminRead,
-		Version: 1,
-		Permissions: []Permission{
-			{
-				Action: ActionLDAPUsersRead,
-			},
-			{
-				Action: ActionLDAPStatusRead,
-			},
+var ldapAdminReadRole = RoleDTO{
+	Name:    ldapAdminRead,
+	Version: 1,
+	Permissions: []Permission{
+		{
+			Action: ActionLDAPUsersRead,
 		},
-	}
-
-	ldapAdminEditRole = RoleDTO{
-		Name:    ldapAdminEdit,
-		Version: 2,
-		Permissions: ConcatPermissions(ldapAdminReadRole.Permissions, []Permission{
-			{
-				Action: ActionLDAPUsersSync,
-			},
-			{
-				Action: ActionLDAPConfigReload,
-			},
-		}),
-	}
-
-	serverAdminReadRole = RoleDTO{
-		Version: 1,
-		Name:    serverAdminRead,
-		Permissions: []Permission{
-			{
-				Action: ActionServerStatsRead,
-			},
+		{
+			Action: ActionLDAPStatusRead,
 		},
-	}
+	},
+}
 
-	settingsAdminReadRole = RoleDTO{
-		Version: 1,
-		Name:    settingsAdminRead,
-		Permissions: []Permission{
-			{
-				Action: ActionSettingsRead,
-				Scope:  ScopeSettingsAll,
-			},
+var ldapAdminEditRole = RoleDTO{
+	Name:    ldapAdminEdit,
+	Version: 2,
+	Permissions: ConcatPermissions(ldapAdminReadRole.Permissions, []Permission{
+		{
+			Action: ActionLDAPUsersSync,
 		},
-	}
-
-	usersOrgReadRole = RoleDTO{
-		Name:    usersOrgRead,
-		Version: 1,
-		Permissions: []Permission{
-			{
-				Action: ActionOrgUsersRead,
-				Scope:  ScopeUsersAll,
-			},
+		{
+			Action: ActionLDAPConfigReload,
 		},
-	}
+	}),
+}
 
-	usersOrgEditRole = RoleDTO{
-		Name:    usersOrgEdit,
-		Version: 1,
-		Permissions: ConcatPermissions(usersOrgReadRole.Permissions, []Permission{
-			{
-				Action: ActionOrgUsersAdd,
-				Scope:  ScopeUsersAll,
-			},
-			{
-				Action: ActionOrgUsersRoleUpdate,
-				Scope:  ScopeUsersAll,
-			},
-			{
-				Action: ActionOrgUsersRemove,
-				Scope:  ScopeUsersAll,
-			},
-		}),
-	}
-
-	usersAdminReadRole = RoleDTO{
-		Name:    usersAdminRead,
-		Version: 1,
-		Permissions: []Permission{
-			{
-				Action: ActionUsersRead,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersTeamRead,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersAuthTokenList,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersQuotasList,
-				Scope:  ScopeGlobalUsersAll,
-			},
+var serverAdminReadRole = RoleDTO{
+	Version: 1,
+	Name:    serverAdminRead,
+	Permissions: []Permission{
+		{
+			Action: ActionServerStatsRead,
 		},
-	}
+	},
+}
 
-	usersAdminEditRole = RoleDTO{
-		Name:    usersAdminEdit,
-		Version: 1,
-		Permissions: ConcatPermissions(usersAdminReadRole.Permissions, []Permission{
-			{
-				Action: ActionUsersPasswordUpdate,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersCreate,
-			},
-			{
-				Action: ActionUsersWrite,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersDelete,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersEnable,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersDisable,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersPermissionsUpdate,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersLogout,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersAuthTokenUpdate,
-				Scope:  ScopeGlobalUsersAll,
-			},
-			{
-				Action: ActionUsersQuotasUpdate,
-				Scope:  ScopeGlobalUsersAll,
-			},
-		}),
-	}
-)
+var settingsAdminReadRole = RoleDTO{
+	Version: 1,
+	Name:    settingsAdminRead,
+	Permissions: []Permission{
+		{
+			Action: ActionSettingsRead,
+			Scope:  ScopeSettingsAll,
+		},
+	},
+}
+
+var usersOrgReadRole = RoleDTO{
+	Name:    usersOrgRead,
+	Version: 1,
+	Permissions: []Permission{
+		{
+			Action: ActionOrgUsersRead,
+			Scope:  ScopeUsersAll,
+		},
+	},
+}
+
+var usersOrgEditRole = RoleDTO{
+	Name:    usersOrgEdit,
+	Version: 1,
+	Permissions: ConcatPermissions(usersOrgReadRole.Permissions, []Permission{
+		{
+			Action: ActionOrgUsersAdd,
+			Scope:  ScopeUsersAll,
+		},
+		{
+			Action: ActionOrgUsersRoleUpdate,
+			Scope:  ScopeUsersAll,
+		},
+		{
+			Action: ActionOrgUsersRemove,
+			Scope:  ScopeUsersAll,
+		},
+	}),
+}
+
+var usersAdminReadRole = RoleDTO{
+	Name:    usersAdminRead,
+	Version: 1,
+	Permissions: []Permission{
+		{
+			Action: ActionUsersRead,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersTeamRead,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersAuthTokenList,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersQuotasList,
+			Scope:  ScopeGlobalUsersAll,
+		},
+	},
+}
+
+var usersAdminEditRole = RoleDTO{
+	Name:    usersAdminEdit,
+	Version: 1,
+	Permissions: ConcatPermissions(usersAdminReadRole.Permissions, []Permission{
+		{
+			Action: ActionUsersPasswordUpdate,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersCreate,
+		},
+		{
+			Action: ActionUsersWrite,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersDelete,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersEnable,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersDisable,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersPermissionsUpdate,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersLogout,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersAuthTokenUpdate,
+			Scope:  ScopeGlobalUsersAll,
+		},
+		{
+			Action: ActionUsersQuotasUpdate,
+			Scope:  ScopeGlobalUsersAll,
+		},
+	}),
+}
+
+var provisioningAdminRole = RoleDTO{
+	Name:    provisioningAdmin,
+	Version: 1,
+	Permissions: []Permission{
+		{
+			Action: ActionProvisioningReload,
+			Scope:  ScopeServicesAll,
+		},
+	},
+}
+
+// FixedRoles provides a map of permission sets/roles which can be
+// assigned to a set of users. When adding a new resource protected by
+// Grafana access control the default permissions should be added to a
+// new fixed role in this set so that users can access the new
+// resource. FixedRoleGrants lists which built-in roles are
+// assigned which fixed roles in this list.
+var FixedRoles = map[string]RoleDTO{
+	datasourcesEditorRead: datasourcesEditorReadRole,
+	serverAdminRead:       serverAdminReadRole,
+
+	settingsAdminRead: settingsAdminReadRole,
+
+	usersAdminRead: usersAdminReadRole,
+	usersAdminEdit: usersAdminEditRole,
+
+	usersOrgRead: usersOrgReadRole,
+	usersOrgEdit: usersOrgEditRole,
+
+	ldapAdminRead: ldapAdminReadRole,
+	ldapAdminEdit: ldapAdminEditRole,
+
+	provisioningAdmin: provisioningAdminRole,
+}
 
-// Role names definitions
 const (
 	datasourcesEditorRead = "fixed:datasources:editor:read"
 
@@ -183,49 +208,32 @@ const (
 
 	ldapAdminEdit = "fixed:ldap:admin:edit"
 	ldapAdminRead = "fixed:ldap:admin:read"
+
+	provisioningAdmin = "fixed:provisioning:admin"
 )
 
-var (
-	// FixedRoles provides a map of permission sets/roles which can be
-	// assigned to a set of users. When adding a new resource protected by
-	// Grafana access control the default permissions should be added to a
-	// new fixed role in this set so that users can access the new
-	// resource. FixedRoleGrants lists which built-in roles are
-	// assigned which fixed roles in this list.
-	FixedRoles = map[string]RoleDTO{
-		datasourcesEditorRead: datasourcesEditorReadRole,
-		usersAdminEdit:        usersAdminEditRole,
-		usersAdminRead:        usersAdminReadRole,
-		usersOrgEdit:          usersOrgEditRole,
-		usersOrgRead:          usersOrgReadRole,
-		ldapAdminEdit:         ldapAdminEditRole,
-		ldapAdminRead:         ldapAdminReadRole,
-		serverAdminRead:       serverAdminReadRole,
-		settingsAdminRead:     settingsAdminReadRole,
-	}
-
-	// FixedRoleGrants specifies which built-in roles are assigned
-	// to which set of FixedRoles by default. Alphabetically sorted.
-	FixedRoleGrants = map[string][]string{
-		RoleGrafanaAdmin: {
-			ldapAdminEdit,
-			ldapAdminRead,
-			serverAdminRead,
-			settingsAdminRead,
-			usersAdminEdit,
-			usersAdminRead,
-			usersOrgEdit,
-			usersOrgRead,
-		},
-		string(models.ROLE_ADMIN): {
-			usersOrgEdit,
-			usersOrgRead,
-		},
-		string(models.ROLE_EDITOR): {
-			datasourcesEditorRead,
-		},
-	}
-)
+// FixedRoleGrants specifies which built-in roles are assigned
+// to which set of FixedRoles by default. Alphabetically sorted.
+var FixedRoleGrants = map[string][]string{
+	RoleGrafanaAdmin: {
+		ldapAdminEdit,
+		ldapAdminRead,
+		provisioningAdmin,
+		serverAdminRead,
+		settingsAdminRead,
+		usersAdminEdit,
+		usersAdminRead,
+		usersOrgEdit,
+		usersOrgRead,
+	},
+	string(models.ROLE_ADMIN): {
+		usersOrgEdit,
+		usersOrgRead,
+	},
+	string(models.ROLE_EDITOR): {
+		datasourcesEditorRead,
+	},
+}
 
 func ConcatPermissions(permissions ...[]Permission) []Permission {
 	if permissions == nil {
@@ -239,42 +247,3 @@ func ConcatPermissions(permissions ...[]Permission) []Permission {
 	}
 	return perms
 }
-
-// ValidateFixedRole errors when a fixed role does not match expected pattern
-func ValidateFixedRole(role RoleDTO) error {
-	if !strings.HasPrefix(role.Name, FixedRolePrefix) {
-		return ErrFixedRolePrefixMissing
-	}
-	return nil
-}
-
-// ValidateBuiltInRoles errors when a built-in role does not match expected pattern
-func ValidateBuiltInRoles(builtInRoles []string) error {
-	for _, br := range builtInRoles {
-		if !models.RoleType(br).IsValid() && br != RoleGrafanaAdmin {
-			return fmt.Errorf("'%s' %w", br, ErrInvalidBuiltinRole)
-		}
-	}
-	return nil
-}
-
-type RegistrationList struct {
-	mx            sync.RWMutex
-	registrations []RoleRegistration
-}
-
-func (m *RegistrationList) Append(regs ...RoleRegistration) {
-	m.mx.Lock()
-	defer m.mx.Unlock()
-	m.registrations = append(m.registrations, regs...)
-}
-
-func (m *RegistrationList) Range(f func(registration RoleRegistration) bool) {
-	m.mx.RLock()
-	defer m.mx.RUnlock()
-	for _, registration := range m.registrations {
-		if ok := f(registration); !ok {
-			return
-		}
-	}
-}