grafana-iam: Add resolver for permissions:type:delegate (#108789)

* `grafana-iam`: Add resolver for `permissions:type:delegate`

* roles create -> write

pkg/services/authz/rbac/mapper.go

@@ -105,7 +105,21 @@ func NewMapperRegistry() MapperRegistry {
 			// Teams is a special case. We translate user permissions from id to uid based.
 			"teams":     newResourceTranslation("teams", "uid", false),
 			"coreroles": newResourceTranslation("roles", "uid", false),
-			"roles":     newResourceTranslation("roles", "uid", false),
+			"roles": translation{
+				resource:  "roles",
+				attribute: "uid",
+				verbMapping: map[string]string{
+					utils.VerbCreate:           "roles:write",
+					utils.VerbGet:              "roles:read",
+					utils.VerbUpdate:           "roles:write",
+					utils.VerbPatch:            "roles:write",
+					utils.VerbDelete:           "roles:delete",
+					utils.VerbDeleteCollection: "roles:delete",
+					utils.VerbList:             "roles:read",
+					utils.VerbWatch:            "roles:read",
+				},
+				folderSupport: false,
+			},
 		},
 		"secret.grafana.app": {
 			"securevalues": newResourceTranslation("secret.securevalues", "uid", false),

pkg/services/authz/rbac/resolver.go

@@ -81,10 +81,22 @@ func (s *Service) newTeamNameResolver(ctx context.Context, ns types.NamespaceInf
 	}, nil
 }
 
+func permissionsDelegateResolverFunc(scope string) (string, error) {
+	if strings.TrimPrefix(scope, "permissions:type:") == "delegate" {
+		// The permissions:type:delegate scope does not have any discriminating value,
+		// so we return a wildcard to indicate that it applies to all roles.
+		return "*", nil
+	}
+	return "", fmt.Errorf("unsupported scope: %s", scope)
+}
+
 func (s *Service) nameResolver(ctx context.Context, ns types.NamespaceInfo, scopePrefix string) (ScopeResolverFunc, error) {
 	if scopePrefix == "teams:id:" {
 		return s.newTeamNameResolver(ctx, ns)
 	}
+	if scopePrefix == "permissions:type:" {
+		return permissionsDelegateResolverFunc, nil
+	}
 	// No resolver found for the given scope prefix.
 	return nil, nil
 }