From 7f1e8cee2b02d92f1511cac2f57a6f86712ced9e Mon Sep 17 00:00:00 2001
From: J Guerreiro <joao.guerreiro@grafana.com>
Date: Fri, 4 Mar 2022 18:01:03 +0000
Subject: [PATCH] APIKeys: Add AC controls for legacy API keys (#46255)

* APIKeys: Add AC controls for legacy API keys

* pluralize actions
---
 pkg/api/accesscontrol.go             | 26 +++++++++++++++++++++++++-
 pkg/api/api.go                       |  7 ++++---
 pkg/services/accesscontrol/models.go |  7 +++++++
 3 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/pkg/api/accesscontrol.go b/pkg/api/accesscontrol.go
index d6f4bbeb512..9dd4949f01e 100644
--- a/pkg/api/accesscontrol.go
+++ b/pkg/api/accesscontrol.go
@@ -161,6 +161,30 @@ func (hs *HTTPServer) declareFixedRoles() error {
 		Grants: []string{string(models.ROLE_VIEWER)},
 	}
 
+	apikeyWriterRole := ac.RoleRegistration{
+		Role: ac.RoleDTO{
+			Version:     1,
+			Name:        "fixed:apikeys:writer",
+			DisplayName: "APIKeys writer",
+			Description: "Gives access to add and delete api keys.",
+			Group:       "API Keys",
+			Permissions: []ac.Permission{
+				{
+					Action: ac.ActionAPIKeyCreate,
+				},
+				{
+					Action: ac.ActionAPIKeyRead,
+					Scope:  ac.ScopeAPIKeysAll,
+				},
+				{
+					Action: ac.ActionAPIKeyDelete,
+					Scope:  ac.ScopeAPIKeysAll,
+				},
+			},
+		},
+		Grants: []string{"Admin"},
+	}
+
 	orgReaderRole := ac.RoleRegistration{
 		Role: ac.RoleDTO{
 			Version:     5,
@@ -366,7 +390,7 @@ func (hs *HTTPServer) declareFixedRoles() error {
 		datasourcesCompatibilityReaderRole, orgReaderRole, orgWriterRole,
 		orgMaintainerRole, teamsCreatorRole, teamsWriterRole, datasourcesExplorerRole, annotationsReaderRole,
 		dashboardsCreatorRole, dashboardsReaderRole, dashboardsWriterRole,
-		foldersCreatorRole, foldersReaderRole, foldersWriterRole,
+		foldersCreatorRole, foldersReaderRole, foldersWriterRole, apikeyWriterRole,
 	)
 }
 
diff --git a/pkg/api/api.go b/pkg/api/api.go
index 3b4544e9fb3..8c78e917a24 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -260,9 +260,10 @@ func (hs *HTTPServer) registerRoutes() {
 
 		// auth api keys
 		apiRoute.Group("/auth/keys", func(keysRoute routing.RouteRegister) {
-			keysRoute.Get("/", routing.Wrap(hs.GetAPIKeys))
-			keysRoute.Post("/", quota("api_key"), routing.Wrap(hs.AddAPIKey))
-			keysRoute.Delete("/:id", routing.Wrap(hs.DeleteAPIKey))
+			apikeyIDScope := ac.Scope("apikeys", "id", ac.Parameter(":id"))
+			keysRoute.Get("/", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyRead, ac.ScopeAPIKeysAll)), routing.Wrap(hs.GetAPIKeys))
+			keysRoute.Post("/", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyCreate)), quota("api_key"), routing.Wrap(hs.AddAPIKey))
+			keysRoute.Delete("/:id", authorize(reqOrgAdmin, ac.EvalPermission(ac.ActionAPIKeyDelete, apikeyIDScope)), routing.Wrap(hs.DeleteAPIKey))
 		}, reqOrgAdmin)
 
 		// Preferences
diff --git a/pkg/services/accesscontrol/models.go b/pkg/services/accesscontrol/models.go
index 851ad067d0d..b00836ec4e1 100644
--- a/pkg/services/accesscontrol/models.go
+++ b/pkg/services/accesscontrol/models.go
@@ -250,6 +250,10 @@ const (
 	GlobalOrgID = 0
 	// Permission actions
 
+	ActionAPIKeyRead   = "apikeys:read"
+	ActionAPIKeyCreate = "apikeys:create"
+	ActionAPIKeyDelete = "apikeys:delete"
+
 	// Users actions
 	ActionUsersRead     = "users:read"
 	ActionUsersWrite    = "users:write"
@@ -299,6 +303,9 @@ const (
 	// Global Scopes
 	ScopeGlobalUsersAll = "global:users:*"
 
+	// APIKeys scope
+	ScopeAPIKeysAll = "apikeys:*"
+
 	// Users scope
 	ScopeUsersAll = "users:*"