Access Control: Add service accounts (#38994)

* Add extra fields to OSS types to support enterprise

* Create a service account at the same time as the API key

* Use service account credentials when accessing API with APIkey

* Add GetRole to service, merge RoleDTO and Role structs

This patch merges the identical OSS and Enterprise data structures, which improves the code for two reasons:

1.  Makes switching between OSS and Enterprise easier
2.  Reduces the chance of incompatibilities developing between the same functions in OSS and Enterprise

* If API key is not linked to a service account, continue login as usual

* Fallback to old auth if no service account linked to key

* Add CloneUserToServiceAccount

* Adding LinkAPIKeyToServiceAccount

* Handle api key link error

* Better error messages for OSS accesscontrol

* Set an invalid user id as default

* Re-arrange field names

* ServiceAccountId is integer

* Better error messages

Co-authored-by: Hugo Häggmark <hugo.haggmark@grafana.com>
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

pkg/services/sqlstore/apikey.go

@@ -76,14 +76,16 @@ func AddAPIKey(ctx context.Context, cmd *models.AddApiKeyCommand) error {
 		} else if cmd.SecondsToLive < 0 {
 			return models.ErrInvalidApiKeyExpiration
 		}
+
 		t := models.ApiKey{
-			OrgId:   cmd.OrgId,
-			Name:    cmd.Name,
-			Role:    cmd.Role,
-			Key:     cmd.Key,
-			Created: updated,
-			Updated: updated,
-			Expires: expires,
+			OrgId:            cmd.OrgId,
+			Name:             cmd.Name,
+			Role:             cmd.Role,
+			Key:              cmd.Key,
+			Created:          updated,
+			Updated:          updated,
+			Expires:          expires,
+			ServiceAccountId: cmd.ServiceAccountId,
 		}
 
 		if _, err := sess.Insert(&t); err != nil {

pkg/services/sqlstore/migrations/apikey_mig.go

@@ -82,4 +82,8 @@ func addApiKeyMigrations(mg *Migrator) {
 	mg.AddMigration("Add expires to api_key table", NewAddColumnMigration(apiKeyV2, &Column{
 		Name: "expires", Type: DB_BigInt, Nullable: true,
 	}))
+
+	mg.AddMigration("Add service account foreign key", NewAddColumnMigration(apiKeyV2, &Column{
+		Name: "service_account_id", Type: DB_BigInt, Nullable: true,
+	}))
 }