From 59e28f82a16dc2808f0c33211981e4a91f5a2995 Mon Sep 17 00:00:00 2001
From: "grafana-delivery-bot[bot]"
 <132647405+grafana-delivery-bot[bot]@users.noreply.github.com>
Date: Wed, 14 Aug 2024 14:39:05 +0300
Subject: [PATCH] [v11.2.x] RBAC: Hide root level folder creation button if the
 user doesn't have the right permissions (#91887)

RBAC: Hide root level folder creation button if the user doesn't have the right permissions (#91502)

* hide root level folder creation button if the user doesn't have the right permissions

* linting

(cherry picked from commit 134b9f731f4eaafaab5ce19c7348ca57f70cae96)

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
---
 .../BrowseDashboardsPage.tsx                  |  4 +++-
 .../features/browse-dashboards/permissions.ts | 24 ++++++++++++++-----
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/public/app/features/browse-dashboards/BrowseDashboardsPage.tsx b/public/app/features/browse-dashboards/BrowseDashboardsPage.tsx
index 93c73f97d01..47c7137b065 100644
--- a/public/app/features/browse-dashboards/BrowseDashboardsPage.tsx
+++ b/public/app/features/browse-dashboards/BrowseDashboardsPage.tsx
@@ -87,7 +87,9 @@ const BrowseDashboardsPage = memo(({ match }: Props) => {
 
   const hasSelection = useHasSelection();
 
-  const { canEditFolders, canEditDashboards, canCreateDashboards, canCreateFolders } = getFolderPermissions(folderDTO);
+  const { data: rootFolder } = useGetFolderQuery('general');
+  let folder = folderDTO ? folderDTO : rootFolder;
+  const { canEditFolders, canEditDashboards, canCreateDashboards, canCreateFolders } = getFolderPermissions(folder);
 
   const showEditTitle = canEditFolders && folderUID;
   const canSelect = canEditFolders || canEditDashboards;
diff --git a/public/app/features/browse-dashboards/permissions.ts b/public/app/features/browse-dashboards/permissions.ts
index f107500de11..c70c9ee25ab 100644
--- a/public/app/features/browse-dashboards/permissions.ts
+++ b/public/app/features/browse-dashboards/permissions.ts
@@ -3,22 +3,34 @@ import { contextSrv } from 'app/core/core';
 import { AccessControlAction, FolderDTO } from 'app/types';
 
 function checkFolderPermission(action: AccessControlAction, folderDTO?: FolderDTO) {
-  return folderDTO ? contextSrv.hasPermissionInMetadata(action, folderDTO) : contextSrv.hasPermission(action);
+  // Only some permissions are assigned in the root folder (aka "general" folder), so we can ignore them in most cases
+  return folderDTO && folderDTO.uid !== 'general'
+    ? contextSrv.hasPermissionInMetadata(action, folderDTO)
+    : contextSrv.hasPermission(action);
 }
 
 function checkCanCreateFolders(folderDTO?: FolderDTO) {
+  // Can only create a folder if we have permissions and either we're at root or nestedFolders is enabled
   if (folderDTO && !config.featureToggles.nestedFolders) {
     return false;
   }
 
-  return config.featureToggles.accessActionSets
-    ? checkFolderPermission(AccessControlAction.FoldersCreate, folderDTO)
-    : checkFolderPermission(AccessControlAction.FoldersCreate) &&
-        checkFolderPermission(AccessControlAction.FoldersWrite, folderDTO);
+  if (!config.featureToggles.accessActionSets) {
+    if (!folderDTO || folderDTO.uid === 'general') {
+      return checkFolderPermission(AccessControlAction.FoldersCreate);
+    }
+    return (
+      checkFolderPermission(AccessControlAction.FoldersCreate) &&
+      checkFolderPermission(AccessControlAction.FoldersWrite, folderDTO)
+    );
+  }
+
+  return folderDTO
+    ? contextSrv.hasPermissionInMetadata(AccessControlAction.FoldersCreate, folderDTO)
+    : contextSrv.hasPermission(AccessControlAction.FoldersCreate);
 }
 
 export function getFolderPermissions(folderDTO?: FolderDTO) {
-  // Can only create a folder if we have permissions and either we're at root or nestedFolders is enabled
   const canCreateDashboards = checkFolderPermission(AccessControlAction.DashboardsCreate, folderDTO);
   const canCreateFolders = checkCanCreateFolders(folderDTO);
   const canDeleteFolders = checkFolderPermission(AccessControlAction.FoldersDelete, folderDTO);