AuthN: Add auth hook that can sync grafana cloud role to rbac cloud role (#80416)

* AuthnSync: Rename files and structures

* AuthnSync: register rbac cloud role sync if feature toggle is enabled

* RBAC: Add new sync function to service interface

* RBAC: add common prefix and role names for cloud fixed roles

* AuthnSync+RBAC: implement rbac cloud role sync

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

pkg/services/accesscontrol/accesscontrol.go

@@ -40,6 +40,8 @@ type Service interface {
 	SaveExternalServiceRole(ctx context.Context, cmd SaveExternalServiceRoleCommand) error
 	// DeleteExternalServiceRole removes an external service's role and its assignment.
 	DeleteExternalServiceRole(ctx context.Context, externalServiceID string) error
+	// SyncUserRoles adds provided roles to user
+	SyncUserRoles(ctx context.Context, orgID int64, cmd SyncUserRolesCommand) error
 }
 
 type RoleRegistry interface {
@@ -58,6 +60,14 @@ type SearchOptions struct {
 	UserID       int64 // ID for the user for which to return information, if none is specified information is returned for all users.
 }
 
+type SyncUserRolesCommand struct {
+	UserID int64
+	// name of roles the user should have
+	RolesToAdd []string
+	// name of roles the user should not have
+	RolesToRemove []string
+}
+
 type TeamPermissionsService interface {
 	GetPermissions(ctx context.Context, user identity.Requester, resourceID string) ([]ResourcePermission, error)
 	SetUserPermission(ctx context.Context, orgID int64, user User, resourceID, permission string) (*ResourcePermission, error)

pkg/services/accesscontrol/acimpl/service.go

@@ -425,3 +425,7 @@ func (s *Service) DeleteExternalServiceRole(ctx context.Context, externalService
 
 	return s.store.DeleteExternalServiceRole(ctx, slug)
 }
+
+func (*Service) SyncUserRoles(ctx context.Context, orgID int64, cmd accesscontrol.SyncUserRolesCommand) error {
+	return nil
+}

pkg/services/accesscontrol/actest/fake.go

@@ -11,6 +11,7 @@ var _ accesscontrol.Service = new(FakeService)
 var _ accesscontrol.RoleRegistry = new(FakeService)
 
 type FakeService struct {
+	accesscontrol.Service
 	ExpectedErr                     error
 	ExpectedCachedPermissions       bool
 	ExpectedPermissions             []accesscontrol.Permission

pkg/services/accesscontrol/mock/mock.go

@@ -57,6 +57,7 @@ type Mock struct {
 	SearchUserPermissionsFunc          func(ctx context.Context, orgID int64, searchOptions accesscontrol.SearchOptions) ([]accesscontrol.Permission, error)
 	SaveExternalServiceRoleFunc        func(ctx context.Context, cmd accesscontrol.SaveExternalServiceRoleCommand) error
 	DeleteExternalServiceRoleFunc      func(ctx context.Context, externalServiceID string) error
+	SyncUserRolesFunc                  func(ctx context.Context, orgID int64, cmd accesscontrol.SyncUserRolesCommand) error
 
 	scopeResolvers accesscontrol.Resolvers
 }
@@ -235,3 +236,10 @@ func (m *Mock) DeleteExternalServiceRole(ctx context.Context, externalServiceID
 	}
 	return nil
 }
+
+func (m *Mock) SyncUserRoles(ctx context.Context, orgID int64, cmd accesscontrol.SyncUserRolesCommand) error {
+	if m.SyncUserRolesFunc != nil {
+		return m.SyncUserRolesFunc(ctx, orgID, cmd)
+	}
+	return nil
+}

pkg/services/accesscontrol/roles.go

@@ -28,6 +28,11 @@ const (
 
 	BasicRoleNoneUID  = "basic_none"
 	BasicRoleNoneName = "basic:none"
+
+	FixedCloudRolePrefix = "fixed:cloud:"
+	FixedCloudViewerRole = "fixed:cloud:viewer"
+	FixedCloudEditorRole = "fixed:cloud:editor"
+	FixedCloudAdminRole  = "fixed:cloud:admin"
 )
 
 // Roles definition