Access control: Extend GetUserPermissions() to query permissions in org (#83392)

* Access control: Extend GetUserPermissions() to query permissions in specific org

* Use db query to fetch permissions in org

* refactor

* refactor

* use conditional join

* minor refactor

* Add test cases

* Search permissions correctly in OSS vs Enterprise

* Get permissions from memory

* Refactor

* remove unused func

* Add tests for GetUserPermissionsInOrg

* fix linter

pkg/api/org_users.go

@@ -323,12 +323,13 @@ func (hs *HTTPServer) searchOrgUsersHelper(c *contextmodel.ReqContext, query *or
 
 	// Get accesscontrol metadata and IPD labels for users in the target org
 	accessControlMetadata := map[string]accesscontrol.Metadata{}
-	if c.QueryBool("accesscontrol") && c.SignedInUser.Permissions != nil {
-		// TODO https://github.com/grafana/identity-access-team/issues/268 - user access control service for fetching permissions from another organization
-		permissions, ok := c.SignedInUser.Permissions[query.OrgID]
-		if ok {
-			accessControlMetadata = accesscontrol.GetResourcesMetadata(c.Req.Context(), permissions, "users:id:", userIDs)
+	if c.QueryBool("accesscontrol") {
+		permissionsList, err := hs.accesscontrolService.GetUserPermissionsInOrg(c.Req.Context(), c.SignedInUser, query.OrgID)
+		permissions := accesscontrol.GroupScopesByAction(permissionsList)
+		if err != nil {
+			return nil, err
 		}
+		accessControlMetadata = accesscontrol.GetResourcesMetadata(c.Req.Context(), permissions, "users:id:", userIDs)
 	}
 
 	for i := range filteredUsers {

pkg/api/org_users_test.go

@@ -368,6 +368,7 @@ func TestGetOrgUsersAPIEndpoint_AccessControlMetadata(t *testing.T) {
 				}
 				hs.authInfoService = &authinfotest.FakeService{}
 				hs.userService = &usertest.FakeUserService{ExpectedSignedInUser: userWithPermissions(1, tt.permissions)}
+				hs.accesscontrolService = actest.FakeService{ExpectedPermissions: tt.permissions}
 			})
 
 			url := "/api/orgs/1/users"