Access Control: Move database-related models to enterprise (#32907)

* Move database-related models to enterprise

* Chore: use GetUserBuiltInRoles() method

* Rename permission to action

pkg/services/accesscontrol/ossaccesscontrol/builtin_roles.go

@@ -4,22 +4,24 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 )
 
+const roleGrafanaAdmin = "Grafana Admin"
+
 var builtInRolesMap = map[string]accesscontrol.RoleDTO{
 	"grafana:builtin:users:read:self": {
 		Name:    "grafana:builtin:users:read:self",
 		Version: 1,
 		Permissions: []accesscontrol.Permission{
 			{
-				Permission: "users:read",
-				Scope:      "users:self",
+				Action: "users:read",
+				Scope:  "users:self",
 			},
 			{
-				Permission: "users.tokens:list",
-				Scope:      "users:self",
+				Action: "users.tokens:list",
+				Scope:  "users:self",
 			},
 			{
-				Permission: "users.teams:read",
-				Scope:      "users:self",
+				Action: "users.teams:read",
+				Scope:  "users:self",
 			},
 		},
 	},

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -38,7 +38,8 @@ func (ac *OSSAccessControlService) Evaluate(ctx context.Context, user *models.Si
 }
 
 // GetUserPermissions returns user permissions based on built-in roles
-func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user *models.SignedInUser, roles []string) ([]*accesscontrol.Permission, error) {
+func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user *models.SignedInUser) ([]*accesscontrol.Permission, error) {
+	roles := ac.GetUserBuiltInRoles(user)
 	permissions := make([]*accesscontrol.Permission, 0)
 	for _, legacyRole := range roles {
 		if builtInRoleNames, ok := builtInRoleGrants[legacyRole]; ok {
@@ -57,3 +58,15 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 
 	return permissions, nil
 }
+
+func (ac *OSSAccessControlService) GetUserBuiltInRoles(user *models.SignedInUser) []string {
+	roles := []string{string(user.OrgRole)}
+	for _, role := range user.OrgRole.Children() {
+		roles = append(roles, string(role))
+	}
+	if user.IsGrafanaAdmin {
+		roles = append(roles, roleGrafanaAdmin)
+	}
+
+	return roles
+}