From 8b12bbcc5542a25b968c9b5d77196f81abdb171f Mon Sep 17 00:00:00 2001
From: Jo <joao.guerreiro@grafana.com>
Date: Fri, 24 Oct 2025 14:04:13 +0200
Subject: [PATCH] AccessControl: Include hidden roles in service account role
 display (#112924)

* AccessControl: Include hidden roles in service account role fetches

Add includeHidden=true parameter to role API calls to ensure service accounts
with hidden roles assigned properly display those roles in the UI.

Previously, service accounts with only hidden roles would appear to have no
roles assigned in the UI, even though the API showed they had roles when
queried with includeHidden=true.

This change affects both:
- Bulk role fetching for the service accounts list
- Individual user role fetching used by the role picker

* format
---
 public/app/core/components/RolePicker/api.ts         | 2 +-
 public/app/features/serviceaccounts/state/actions.ts | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/public/app/core/components/RolePicker/api.ts b/public/app/core/components/RolePicker/api.ts
index 596463b4a9d..027cc48c8c5 100644
--- a/public/app/core/components/RolePicker/api.ts
+++ b/public/app/core/components/RolePicker/api.ts
@@ -16,7 +16,7 @@ export const fetchRoleOptions = async (orgId?: number): Promise<Role[]> => {
 };
 
 export const fetchUserRoles = async (userId: number, orgId?: number): Promise<Role[]> => {
-  let userRolesUrl = `/api/access-control/users/${userId}/roles?includeMapped=true`;
+  let userRolesUrl = `/api/access-control/users/${userId}/roles?includeMapped=true&includeHidden=true`;
   if (orgId) {
     userRolesUrl += `&targetOrgId=${orgId}`;
   }
diff --git a/public/app/features/serviceaccounts/state/actions.ts b/public/app/features/serviceaccounts/state/actions.ts
index 5e75bc5378f..35e404e75e1 100644
--- a/public/app/features/serviceaccounts/state/actions.ts
+++ b/public/app/features/serviceaccounts/state/actions.ts
@@ -63,7 +63,10 @@ export function fetchServiceAccounts(
           dispatch(rolesFetchBegin());
           const orgId = contextSrv.user.orgId;
           const userIds = result?.serviceAccounts.map((u: ServiceAccountDTO) => u.id);
-          const roles = await getBackendSrv().post(`/api/access-control/users/roles/search`, { userIds, orgId });
+          const roles = await getBackendSrv().post(`/api/access-control/users/roles/search?includeHidden=true`, {
+            userIds,
+            orgId,
+          });
           result.serviceAccounts.forEach((u: ServiceAccountDTO) => {
             u.roles = roles ? roles[u.id] || [] : [];
           });