Auth: Org Invite and Team API SignedInUser interfacing (#73085)

* fix ngalert Evaluate sig change

* interface for teams and org invites

* Update pkg/api/org_invite.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

pkg/services/auth/identity/requester.go

@@ -11,16 +11,42 @@ const (
 )
 
 type Requester interface {
+	// GetDisplayName returns the display name of the active entity.
+	// The display name is the name if it is set, otherwise the login or email.
+	GetDisplayName() string
+	// GetEmail returns the email of the active entity.
+	// Can be empty.
+	GetEmail() string
+	// GetIsGrafanaAdmin returns true if the user is a server admin
 	GetIsGrafanaAdmin() bool
+	// GetLogin returns the login of the active entity
+	// Can be empty.
 	GetLogin() string
-	GetOrgID() int64
-	GetPermissions() map[string][]string
-	GetTeams() []int64
-	GetOrgRole() roletype.RoleType
+	// GetNamespacedID returns the namespace and ID of the active entity.
+	// The namespace is one of the constants defined in pkg/services/auth/identity.
 	GetNamespacedID() (string, string)
+	// GetOrgID returns the ID of the active organization
+	GetOrgID() int64
+	// GetOrgRole returns the role of the active entity in the active organization.
+	GetOrgRole() roletype.RoleType
+	// GetPermissions returns the permissions of the active entity.
+	GetPermissions() map[string][]string
+	// DEPRECATED: GetTeams returns the teams the entity is a member of.
+	// Retrieve the teams from the team service instead of using this method.
+	GetTeams() []int64
+	// DEPRECATED: GetOrgName returns the name of the active organization.
+	// Retrieve the organization name from the organization service instead of using this method.
+	GetOrgName() string
+
+	// IsNil returns true if the identity is nil
+	// FIXME: remove this method once all services are using an interface
 	IsNil() bool
 
 	// Legacy
+
+	// GetCacheKey returns a unique key for the entity.
+	// Add an extra prefix to avoid collisions with other caches
 	GetCacheKey() (string, error)
+	// HasUniqueId returns true if the entity has a unique id
 	HasUniqueId() bool
 }

pkg/services/contexthandler/model/model.go

@@ -155,7 +155,7 @@ func (ctx *ReqContext) writeErrOrFallback(status int, message string, err error)
 }
 
 func (ctx *ReqContext) HasUserRole(role org.RoleType) bool {
-	return ctx.OrgRole.Includes(role)
+	return ctx.SignedInUser.GetOrgRole().Includes(role)
 }
 
 func (ctx *ReqContext) HasHelpFlag(flag user.HelpFlags1) bool {

pkg/services/user/identity.go

@@ -59,7 +59,7 @@ func (u *SignedInUser) HasRole(role roletype.RoleType) bool {
 	return u.OrgRole.Includes(role)
 }
 
-// IsRealUser returns true if the user is a real user and not a service account
+// IsRealUser returns true if the entity is a real user and not a service account
 func (u *SignedInUser) IsRealUser() bool {
 	// backwards compatibility
 	// checking if userId the user is a real user
@@ -72,15 +72,18 @@ func (u *SignedInUser) IsApiKeyUser() bool {
 	return u.ApiKeyID > 0
 }
 
-// IsServiceAccountUser returns true if the user is a service account
+// IsServiceAccountUser returns true if the entity is a service account
 func (u *SignedInUser) IsServiceAccountUser() bool {
 	return u.IsServiceAccount
 }
 
+// HasUniqueId returns true if the entity has a unique id
 func (u *SignedInUser) HasUniqueId() bool {
 	return u.IsRealUser() || u.IsApiKeyUser() || u.IsServiceAccountUser()
 }
 
+// GetCacheKey returns a unique key for the entity.
+// Add an extra prefix to avoid collisions with other caches
 func (u *SignedInUser) GetCacheKey() (string, error) {
 	if u.IsRealUser() {
 		return fmt.Sprintf("%d-user-%d", u.OrgID, u.UserID), nil
@@ -94,18 +97,29 @@ func (u *SignedInUser) GetCacheKey() (string, error) {
 	return "", ErrNoUniqueID
 }
 
+// GetIsGrafanaAdmin returns true if the user is a server admin
 func (u *SignedInUser) GetIsGrafanaAdmin() bool {
 	return u.IsGrafanaAdmin
 }
 
+// GetLogin returns the login of the active entity
+// Can be empty if the user is anonymous
 func (u *SignedInUser) GetLogin() string {
 	return u.Login
 }
 
+// GetOrgID returns the ID of the active organization
 func (u *SignedInUser) GetOrgID() int64 {
 	return u.OrgID
 }
 
+// DEPRECATED: GetOrgName returns the name of the active organization
+// Retrieve the organization name from the organization service instead of using this method.
+func (u *SignedInUser) GetOrgName() string {
+	return u.OrgName
+}
+
+// GetPermissions returns the permissions of the active entity
 func (u *SignedInUser) GetPermissions() map[string][]string {
 	if u.Permissions == nil {
 		return make(map[string][]string)
@@ -118,21 +132,26 @@ func (u *SignedInUser) GetPermissions() map[string][]string {
 	return u.Permissions[u.GetOrgID()]
 }
 
+// DEPRECATED: GetTeams returns the teams the entity is a member of
+// Retrieve the teams from the team service instead of using this method.
 func (u *SignedInUser) GetTeams() []int64 {
 	return u.Teams
 }
 
+// GetOrgRole returns the role of the active entity in the active organization
 func (u *SignedInUser) GetOrgRole() roletype.RoleType {
 	return u.OrgRole
 }
 
+// GetNamespacedID returns the namespace and ID of the active entity
+// The namespace is one of the constants defined in pkg/services/auth/identity
 func (u *SignedInUser) GetNamespacedID() (string, string) {
 	switch {
 	case u.ApiKeyID != 0:
 		return identity.NamespaceAPIKey, fmt.Sprintf("%d", u.ApiKeyID)
 	case u.IsServiceAccount:
 		return identity.NamespaceServiceAccount, fmt.Sprintf("%d", u.UserID)
-	case u.UserID != 0:
+	case u.UserID > 0:
 		return identity.NamespaceUser, fmt.Sprintf("%d", u.UserID)
 	case u.IsAnonymous:
 		return identity.NamespaceAnonymous, ""
@@ -148,3 +167,15 @@ func (u *SignedInUser) GetNamespacedID() (string, string) {
 func (u *SignedInUser) IsNil() bool {
 	return u == nil
 }
+
+// GetEmail returns the email of the active entity
+// Can be empty.
+func (u *SignedInUser) GetEmail() string {
+	return u.Email
+}
+
+// GetDisplayName returns the display name of the active entity
+// The display name is the name if it is set, otherwise the login or email
+func (u *SignedInUser) GetDisplayName() string {
+	return u.NameOrFallback()
+}