Access Control: Add fgac to datasource query endpoints (#40294)

* Protect datasource tsdb and proxy endpoints with access control

* Add datasource query permissions to fixed admin role

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Mitch Seaman <mjseaman@users.noreply.github.com>

pkg/api/roles.go

@@ -10,6 +10,7 @@ const (
 	ActionProvisioningReload = "provisioning:reload"
 
 	ActionDatasourcesRead   = "datasources:read"
+	ActionDatasourcesQuery  = "datasources:query"
 	ActionDatasourcesCreate = "datasources:create"
 	ActionDatasourcesWrite  = "datasources:write"
 	ActionDatasourcesDelete = "datasources:delete"
@@ -63,11 +64,17 @@ func (hs *HTTPServer) declareFixedRoles() error {
 						Action: ActionDatasourcesWrite,
 						Scope:  ScopeDatasourcesAll,
 					},
-					{Action: ActionDatasourcesCreate},
+					{
+						Action: ActionDatasourcesCreate,
+					},
 					{
 						Action: ActionDatasourcesDelete,
 						Scope:  ScopeDatasourcesAll,
 					},
+					{
+						Action: ActionDatasourcesQuery,
+						Scope:  ScopeDatasourcesAll,
+					},
 				},
 			},
 			Grants: []string{string(models.ROLE_ADMIN)},
@@ -86,6 +93,17 @@ func (hs *HTTPServer) declareFixedRoles() error {
 			},
 			Grants: []string{string(models.ROLE_VIEWER)},
 		},
+		{
+			Role: accesscontrol.RoleDTO{
+				Version:     1,
+				Name:        "fixed:datasources:compatibility:querier",
+				Description: "Query data sources when data source permissions are not in use",
+				Permissions: []accesscontrol.Permission{
+					{Action: ActionDatasourcesQuery},
+				},
+			},
+			Grants: []string{string(models.ROLE_VIEWER)},
+		},
 	}
 
 	return hs.AccessControl.DeclareFixedRoles(registrations...)