AccessControl: Remove scopes from orgs endpoints (#41709)

* AccessControl: Check permissions in target org

* Remove org scopes and add an authorizeInOrg middleware

* Use query result org id and perform users permission check globally for GetOrgByName

* Remove scope translation for orgs current

* Suggestion from Ieva

pkg/api/roles.go

@@ -38,12 +38,6 @@ var (
 	ScopeDatasourceID   = accesscontrol.Scope("datasources", "id", accesscontrol.Parameter(":id"))
 	ScopeDatasourceUID  = accesscontrol.Scope("datasources", "uid", accesscontrol.Parameter(":uid"))
 	ScopeDatasourceName = accesscontrol.Scope("datasources", "name", accesscontrol.Parameter(":name"))
-
-	ScopeOrgsAll      = accesscontrol.Scope("orgs", "*")
-	ScopeOrgID        = accesscontrol.Scope("orgs", "id", accesscontrol.Parameter(":orgId"))
-	ScopeOrgCurrentID = accesscontrol.Scope("orgs", "id", accesscontrol.Field("OrgID"))
-	ScopeOrgName      = accesscontrol.Scope("orgs", "name", accesscontrol.Parameter(":name"))
-	ScopeOrgCurrent   = accesscontrol.Scope("orgs", "current")
 )
 
 // declareFixedRoles declares to the AccessControl service fixed roles and their
@@ -121,17 +115,15 @@ func (hs *HTTPServer) declareFixedRoles() error {
 		},
 		{
 			Role: accesscontrol.RoleDTO{
-				Version:     1,
+				Version:     2,
 				Name:        "fixed:current:org:reader",
 				Description: "Read current organization and its quotas.",
 				Permissions: []accesscontrol.Permission{
 					{
 						Action: ActionOrgsRead,
-						Scope:  ScopeOrgCurrent,
 					},
 					{
 						Action: ActionOrgsQuotasRead,
-						Scope:  ScopeOrgCurrent,
 					},
 				},
 			},
@@ -139,29 +131,24 @@ func (hs *HTTPServer) declareFixedRoles() error {
 		},
 		{
 			Role: accesscontrol.RoleDTO{
-				Version:     1,
+				Version:     2,
 				Name:        "fixed:current:org:writer",
 				Description: "Read current organization, its quotas, and its preferences. Write current organization and its preferences.",
 				Permissions: []accesscontrol.Permission{
 					{
 						Action: ActionOrgsRead,
-						Scope:  ScopeOrgCurrent,
 					},
 					{
 						Action: ActionOrgsQuotasRead,
-						Scope:  ScopeOrgCurrent,
 					},
 					{
 						Action: ActionOrgsPreferencesRead,
-						Scope:  ScopeOrgCurrent,
 					},
 					{
 						Action: ActionOrgsWrite,
-						Scope:  ScopeOrgCurrent,
 					},
 					{
 						Action: ActionOrgsPreferencesWrite,
-						Scope:  ScopeOrgCurrent,
 					},
 				},
 			},
@@ -169,34 +156,29 @@ func (hs *HTTPServer) declareFixedRoles() error {
 		},
 		{
 			Role: accesscontrol.RoleDTO{
-				Version:     1,
+				Version:     2,
 				Name:        "fixed:orgs:writer",
 				Description: "Create, read, write, or delete an organization. Read or write an organization's quotas.",
 				Permissions: []accesscontrol.Permission{
 					{Action: ActionOrgsCreate},
 					{
 						Action: ActionOrgsRead,
-						Scope:  ScopeOrgsAll,
 					},
 					{
 						Action: ActionOrgsWrite,
-						Scope:  ScopeOrgsAll,
 					},
 					{
 						Action: ActionOrgsDelete,
-						Scope:  ScopeOrgsAll,
 					},
 					{
 						Action: ActionOrgsQuotasRead,
-						Scope:  ScopeOrgsAll,
 					},
 					{
 						Action: ActionOrgsQuotasWrite,
-						Scope:  ScopeOrgsAll,
 					},
 				},
 			},
-			Grants: []string{string(accesscontrol.RoleGrafanaAdmin)},
+			Grants: []string{accesscontrol.RoleGrafanaAdmin},
 		},
 	}