Add viewer grant to fixed:datasources:reader if viewers_can_edit is set to true (#44657)

pkg/services/accesscontrol/roles.go

@@ -15,19 +15,6 @@ type RoleRegistry interface {
 
 // Roles definition
 var (
-	datasourcesExplorerRole = RoleDTO{
-		Version:     3,
-		Name:        datasourcesExplorer,
-		DisplayName: "Data source explorer",
-		Description: "Enable the Explore feature. Data source permissions still apply; you can only query data sources for which you have query permissions.",
-		Group:       "Data sources",
-		Permissions: []Permission{
-			{
-				Action: ActionDatasourcesExplore,
-			},
-		},
-	}
-
 	ldapReaderRole = RoleDTO{
 		Name:        ldapReader,
 		DisplayName: "LDAP reader",
@@ -201,15 +188,14 @@ var (
 
 // Role names definitions
 const (
-	datasourcesExplorer = "fixed:datasources:explorer"
-	ldapReader          = "fixed:ldap:reader"
-	ldapWriter          = "fixed:ldap:writer"
-	orgUsersReader      = "fixed:org.users:reader"
-	orgUsersWriter      = "fixed:org.users:writer"
-	settingsReader      = "fixed:settings:reader"
-	statsReader         = "fixed:stats:reader"
-	usersReader         = "fixed:users:reader"
-	usersWriter         = "fixed:users:writer"
+	ldapReader     = "fixed:ldap:reader"
+	ldapWriter     = "fixed:ldap:writer"
+	orgUsersReader = "fixed:org.users:reader"
+	orgUsersWriter = "fixed:org.users:writer"
+	settingsReader = "fixed:settings:reader"
+	statsReader    = "fixed:stats:reader"
+	usersReader    = "fixed:users:reader"
+	usersWriter    = "fixed:users:writer"
 )
 
 var (
@@ -220,15 +206,14 @@ var (
 	// resource. FixedRoleGrants lists which built-in roles are
 	// assigned which fixed roles in this list.
 	FixedRoles = map[string]RoleDTO{
-		datasourcesExplorer: datasourcesExplorerRole,
-		ldapReader:          ldapReaderRole,
-		ldapWriter:          ldapWriterRole,
-		orgUsersReader:      orgUsersReaderRole,
-		orgUsersWriter:      orgUsersWriterRole,
-		settingsReader:      settingsReaderRole,
-		statsReader:         statsReaderRole,
-		usersReader:         usersReaderRole,
-		usersWriter:         usersWriterRole,
+		ldapReader:     ldapReaderRole,
+		ldapWriter:     ldapWriterRole,
+		orgUsersReader: orgUsersReaderRole,
+		orgUsersWriter: orgUsersWriterRole,
+		settingsReader: settingsReaderRole,
+		statsReader:    statsReaderRole,
+		usersReader:    usersReaderRole,
+		usersWriter:    usersWriterRole,
 	}
 
 	// FixedRoleGrants specifies which built-in roles are assigned
@@ -248,9 +233,6 @@ var (
 			orgUsersReader,
 			orgUsersWriter,
 		},
-		string(models.ROLE_EDITOR): {
-			datasourcesExplorer,
-		},
 	}
 )