refactor: move Check and ListObjects to AccessControl implementation

pkg/services/accesscontrol/accesscontrol.go

@@ -28,11 +28,13 @@ type AccessControl interface {
 	// RegisterScopeAttributeResolver allows the caller to register a scope resolver for a
 	// specific scope prefix (ex: datasources:name:)
 	RegisterScopeAttributeResolver(prefix string, resolver ScopeAttributeResolver)
+
+	Check(ctx context.Context, in *openfgav1.CheckRequest) (*openfgav1.CheckResponse, error)
+	ListObjects(ctx context.Context, in *openfgav1.ListObjectsRequest) (*openfgav1.ListObjectsResponse, error)
 }
 
 type Service interface {
 	registry.ProvidesUsageStats
-	ZanzanaChecker
 	// GetRoleByName returns a role by name
 	GetRoleByName(ctx context.Context, orgID int64, roleName string) (*RoleDTO, error)
 	// GetUserPermissions returns user permissions with only action and scope fields set.
@@ -61,8 +63,6 @@ type Service interface {
 }
 
 type ZanzanaChecker interface {
-	Check(ctx context.Context, in *openfgav1.CheckRequest) (*openfgav1.CheckResponse, error)
-	ListObjects(ctx context.Context, in *openfgav1.ListObjectsRequest) (*openfgav1.ListObjectsResponse, error)
 }
 
 //go:generate  mockery --name Store --structname MockStore --outpkg actest --filename store_mock.go --output ./actest/

pkg/services/accesscontrol/acimpl/accesscontrol.go

@@ -211,3 +211,11 @@ func (a *AccessControl) debug(ctx context.Context, ident identity.Requester, msg
 
 	a.log.FromContext(ctx).Debug(msg, "id", ident.GetID(), "orgID", ident.GetOrgID(), "permissions", eval.GoString())
 }
+
+func (a *AccessControl) Check(ctx context.Context, in *openfgav1.CheckRequest) (*openfgav1.CheckResponse, error) {
+	return a.zclient.Check(ctx, in)
+}
+
+func (a *AccessControl) ListObjects(ctx context.Context, in *openfgav1.ListObjectsRequest) (*openfgav1.ListObjectsResponse, error) {
+	return a.zclient.ListObjects(ctx, in)
+}

pkg/services/accesscontrol/acimpl/service.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/grafana/authlib/claims"
-	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel/attribute"
 
@@ -792,11 +791,3 @@ func (s *Service) GetRoleByName(ctx context.Context, orgID int64, roleName strin
 	})
 	return role, err
 }
-
-func (s *Service) Check(ctx context.Context, in *openfgav1.CheckRequest) (*openfgav1.CheckResponse, error) {
-	return s.zclient.Check(ctx, in)
-}
-
-func (s *Service) ListObjects(ctx context.Context, in *openfgav1.ListObjectsRequest) (*openfgav1.ListObjectsResponse, error) {
-	return s.zclient.ListObjects(ctx, in)
-}

pkg/services/accesscontrol/actest/fake.go

@@ -3,6 +3,8 @@ package actest
 import (
 	"context"
 
+	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 )
@@ -75,6 +77,14 @@ func (f FakeAccessControl) Evaluate(ctx context.Context, user identity.Requester
 func (f FakeAccessControl) RegisterScopeAttributeResolver(prefix string, resolver accesscontrol.ScopeAttributeResolver) {
 }
 
+func (f FakeAccessControl) Check(ctx context.Context, in *openfgav1.CheckRequest) (*openfgav1.CheckResponse, error) {
+	return nil, nil
+}
+
+func (f FakeAccessControl) ListObjects(ctx context.Context, in *openfgav1.ListObjectsRequest) (*openfgav1.ListObjectsResponse, error) {
+	return nil, nil
+}
+
 type FakeStore struct {
 	ExpectedUserPermissions       []accesscontrol.Permission
 	ExpectedBasicRolesPermissions []accesscontrol.Permission

pkg/services/dashboards/service/dashboard_service.go

@@ -58,7 +58,6 @@ type DashboardServiceImpl struct {
 	folderPermissions    accesscontrol.FolderPermissionsService
 	dashboardPermissions accesscontrol.DashboardPermissionsService
 	ac                   accesscontrol.AccessControl
-	acService            accesscontrol.Service
 	metrics              *dashboardsMetrics
 }
 
@@ -67,7 +66,7 @@ func ProvideDashboardServiceImpl(
 	cfg *setting.Cfg, dashboardStore dashboards.Store, folderStore folder.FolderStore,
 	features featuremgmt.FeatureToggles, folderPermissionsService accesscontrol.FolderPermissionsService,
 	dashboardPermissionsService accesscontrol.DashboardPermissionsService, ac accesscontrol.AccessControl,
-	folderSvc folder.Service, r prometheus.Registerer, acService accesscontrol.Service,
+	folderSvc folder.Service, r prometheus.Registerer,
 ) (*DashboardServiceImpl, error) {
 	dashSvc := &DashboardServiceImpl{
 		cfg:                  cfg,
@@ -77,7 +76,6 @@ func ProvideDashboardServiceImpl(
 		folderPermissions:    folderPermissionsService,
 		dashboardPermissions: dashboardPermissionsService,
 		ac:                   ac,
-		acService:            acService,
 		folderStore:          folderStore,
 		folderService:        folderSvc,
 		metrics:              newDashboardsMetrics(r),

pkg/services/dashboards/service/zanzana.go

@@ -170,7 +170,7 @@ func (dr *DashboardServiceImpl) findDashboardsZanzanaList(ctx context.Context, q
 }
 
 func (dr *DashboardServiceImpl) listResources(ctx context.Context, query *dashboards.FindPersistedDashboardsQuery, resourceType string) ([]string, error) {
-	res, err := dr.acService.ListObjects(ctx, &openfgav1.ListObjectsRequest{
+	res, err := dr.ac.ListObjects(ctx, &openfgav1.ListObjectsRequest{
 		User:     query.SignedInUser.GetUID(),
 		Type:     resourceType,
 		Relation: "read",
@@ -240,7 +240,7 @@ func (dr *DashboardServiceImpl) checkDashboards(ctx context.Context, query *dash
 					Object:   object,
 				}
 
-				checkRes, err := dr.acService.Check(ctx, &openfgav1.CheckRequest{
+				checkRes, err := dr.ac.Check(ctx, &openfgav1.CheckRequest{
 					TupleKey: key,
 				})
 				if err != nil {

pkg/services/ngalert/accesscontrol/testing.go

@@ -3,6 +3,8 @@ package accesscontrol
 import (
 	"context"
 
+	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 )
@@ -36,4 +38,12 @@ func (a *recordingAccessControlFake) IsDisabled() bool {
 	return a.Disabled
 }
 
+func (a *recordingAccessControlFake) Check(ctx context.Context, in *openfgav1.CheckRequest) (*openfgav1.CheckResponse, error) {
+	return nil, nil
+}
+
+func (a *recordingAccessControlFake) ListObjects(ctx context.Context, in *openfgav1.ListObjectsRequest) (*openfgav1.ListObjectsResponse, error) {
+	return nil, nil
+}
+
 var _ accesscontrol.AccessControl = &recordingAccessControlFake{}

pkg/services/ngalert/api/testing.go

@@ -7,8 +7,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/grafana/grafana-plugin-sdk-go/data"
+	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 
+	"github.com/grafana/grafana-plugin-sdk-go/data"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/ngalert/eval"
@@ -133,6 +134,14 @@ func (a *recordingAccessControlFake) IsDisabled() bool {
 	return a.Disabled
 }
 
+func (a *recordingAccessControlFake) Check(ctx context.Context, in *openfgav1.CheckRequest) (*openfgav1.CheckResponse, error) {
+	return nil, nil
+}
+
+func (a *recordingAccessControlFake) ListObjects(ctx context.Context, in *openfgav1.ListObjectsRequest) (*openfgav1.ListObjectsResponse, error) {
+	return nil, nil
+}
+
 var _ ac.AccessControl = &recordingAccessControlFake{}
 
 type fakeRuleAccessControlService struct {