Alerting: Managed receiver resource permission in receiver_svc (#93556)

* Alerting: Managed receiver resource permission in receiver_svc

pkg/services/accesscontrol/ossaccesscontrol/receivers.go

@@ -1,14 +1,22 @@
 package ossaccesscontrol
 
 import (
+	"context"
+
+	"github.com/grafana/authlib/claims"
+
 	"github.com/grafana/grafana/pkg/api/routing"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/licensing"
 	"github.com/grafana/grafana/pkg/services/ngalert"
 	alertingac "github.com/grafana/grafana/pkg/services/ngalert/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/org"
+	"github.com/grafana/grafana/pkg/services/serviceaccounts"
 	"github.com/grafana/grafana/pkg/services/team"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/setting"
@@ -18,6 +26,14 @@ var ReceiversViewActions = []string{accesscontrol.ActionAlertingReceiversRead}
 var ReceiversEditActions = append(ReceiversViewActions, []string{accesscontrol.ActionAlertingReceiversUpdate, accesscontrol.ActionAlertingReceiversDelete}...)
 var ReceiversAdminActions = append(ReceiversEditActions, []string{accesscontrol.ActionAlertingReceiversReadSecrets, accesscontrol.ActionAlertingReceiversPermissionsRead, accesscontrol.ActionAlertingReceiversPermissionsWrite}...)
 
+// defaultPermissions returns the default permissions for a newly created receiver.
+func defaultPermissions() []accesscontrol.SetResourcePermissionCommand {
+	return []accesscontrol.SetResourcePermissionCommand{
+		{BuiltinRole: string(org.RoleEditor), Permission: string(alertingac.ReceiverPermissionEdit)},
+		{BuiltinRole: string(org.RoleViewer), Permission: string(alertingac.ReceiverPermissionView)},
+	}
+}
+
 func ProvideReceiverPermissionsService(
 	cfg *setting.Cfg, features featuremgmt.FeatureToggles, router routing.RouteRegister, sql db.DB, ac accesscontrol.AccessControl,
 	license licensing.Licensing, service accesscontrol.Service,
@@ -50,11 +66,131 @@ func ProvideReceiverPermissionsService(
 	if err != nil {
 		return nil, err
 	}
-	return &ReceiverPermissionsService{Service: srv}, nil
+	return &ReceiverPermissionsService{srv, service, log.New("resourcepermissions.receivers")}, nil
 }
 
 var _ accesscontrol.ReceiverPermissionsService = new(ReceiverPermissionsService)
 
 type ReceiverPermissionsService struct {
 	*resourcepermissions.Service
+	ac  accesscontrol.Service
+	log log.Logger
+}
+
+// SetDefaultPermissions sets the default permissions for a newly created receiver.
+func (r ReceiverPermissionsService) SetDefaultPermissions(ctx context.Context, orgID int64, user identity.Requester, uid string) {
+	permissions := defaultPermissions()
+	clearCache := false
+	if user != nil && user.IsIdentityType(claims.TypeUser) {
+		userID, err := user.GetInternalID()
+		if err != nil {
+			r.log.Error("Could not make user admin", "receiver_uid", uid, "id", user.GetID(), "error", err)
+		} else {
+			permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{
+				UserID: userID, Permission: string(alertingac.ReceiverPermissionAdmin),
+			})
+			clearCache = true
+		}
+	}
+
+	if _, err := r.SetPermissions(ctx, orgID, uid, permissions...); err != nil {
+		r.log.Error("Could not set default permissions", "receiver_uid", uid, "error", err)
+	}
+
+	if clearCache {
+		// Clear permission cache for the user who created the receiver, so that new permissions are fetched for their next call
+		// Required for cases when caller wants to immediately interact with the newly created object
+		r.ac.ClearUserPermissionCache(user)
+	}
+}
+
+// copyPermissionUser returns a user with permissions to copy permissions from one receiver to another. This must include
+// permissions to read and write permissions for the receiver, as well as read permissions for users, service accounts, and teams.
+func copyPermissionUser(orgID int64) identity.Requester {
+	return accesscontrol.BackgroundUser("receiver_access_service", orgID, org.RoleAdmin, accesscontrol.ConcatPermissions(
+		accesscontrol.PermissionsForActions(ReceiversAdminActions, alertingac.ScopeReceiversAll),
+		[]accesscontrol.Permission{ // Permissions needed for GetPermissions to return user, service account, and team permissions.
+			{Action: accesscontrol.ActionOrgUsersRead, Scope: accesscontrol.ScopeUsersAll},
+			{Action: serviceaccounts.ActionRead, Scope: serviceaccounts.ScopeAll},
+			{Action: accesscontrol.ActionTeamsRead, Scope: accesscontrol.ScopeTeamsAll},
+		},
+	),
+	)
+}
+
+// CopyPermissions copies the resource permissions from one receiver uid to a new uid. This is a temporary
+// method to be used during receiver renaming that is necessitated by receiver uids being generated from the receiver
+// name.
+func (r ReceiverPermissionsService) CopyPermissions(ctx context.Context, orgID int64, user identity.Requester, oldUID, newUID string) (int, error) {
+	currentPermissions, err := r.GetPermissions(ctx, copyPermissionUser(orgID), oldUID)
+	if err != nil {
+		return 0, err
+	}
+
+	setPermissionCommands := r.toSetResourcePermissionCommands(currentPermissions)
+	if _, err := r.SetPermissions(ctx, orgID, newUID, setPermissionCommands...); err != nil {
+		return 0, err
+	}
+
+	// Clear permission cache for the user who updated the receiver, so that new permissions are fetched for their next call
+	// Required for cases when caller wants to immediately interact with the newly updated object
+	if user != nil && user.IsIdentityType(claims.TypeUser) {
+		r.ac.ClearUserPermissionCache(user)
+	}
+
+	return countCustomPermissions(setPermissionCommands), nil
+}
+
+// toSetResourcePermissionCommands converts a list of resource permissions to a list of set resource permission commands.
+// Only includes managed permissions.
+func (r ReceiverPermissionsService) toSetResourcePermissionCommands(permissions []accesscontrol.ResourcePermission) []accesscontrol.SetResourcePermissionCommand {
+	cmds := make([]accesscontrol.SetResourcePermissionCommand, 0, len(permissions))
+	for _, p := range permissions {
+		if !p.IsManaged {
+			continue
+		}
+		permission := r.MapActions(p)
+		if permission == "" {
+			continue
+		}
+		cmds = append(cmds, accesscontrol.SetResourcePermissionCommand{
+			Permission:  permission,
+			BuiltinRole: p.BuiltInRole,
+			TeamID:      p.TeamId,
+			UserID:      p.UserId,
+		})
+	}
+	return cmds
+}
+
+// countCustomPermissions counts the number of custom permissions in a list of set resource permission commands. A
+// custom permission is a permission that is not a default permission for a receiver.
+func countCustomPermissions(permissions []accesscontrol.SetResourcePermissionCommand) int {
+	cacheKey := func(p accesscontrol.SetResourcePermissionCommand) accesscontrol.SetResourcePermissionCommand {
+		return accesscontrol.SetResourcePermissionCommand{
+			Permission:  "",
+			BuiltinRole: p.BuiltinRole,
+			TeamID:      p.TeamID,
+			UserID:      p.UserID,
+		}
+	}
+	missingDefaults := make(map[accesscontrol.SetResourcePermissionCommand]string, 2)
+	for _, p := range defaultPermissions() {
+		missingDefaults[cacheKey(p)] = p.Permission
+	}
+
+	diff := 0
+	for _, p := range permissions {
+		key := cacheKey(p)
+		perm, ok := missingDefaults[key]
+		if perm != p.Permission {
+			diff++
+		}
+		if ok {
+			delete(missingDefaults, key)
+		}
+	}
+
+	// missing + new
+	return len(missingDefaults) + diff
 }