From 8f77a3e0e830dea520fb84c2a7e59fc5fe03a7c0 Mon Sep 17 00:00:00 2001
From: Costa Alexoglou <konsalexee@gmail.com>
Date: Tue, 23 Sep 2025 18:40:10 +0200
Subject: [PATCH] chore: swap access check to folder client (#111490)

---
 pkg/registry/apis/dashboard/register.go | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/pkg/registry/apis/dashboard/register.go b/pkg/registry/apis/dashboard/register.go
index 31c2be5ea89..cfec57b7f41 100644
--- a/pkg/registry/apis/dashboard/register.go
+++ b/pkg/registry/apis/dashboard/register.go
@@ -675,17 +675,21 @@ func (b *DashboardsAPIBuilder) GetAuthorizer() authorizer.Authorizer {
 }
 
 func (b *DashboardsAPIBuilder) verifyFolderAccessPermissions(ctx context.Context, user identity.Requester, folderIds ...string) error {
-	scopes := []string{}
 	for _, folderId := range folderIds {
-		scopes = append(scopes, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderId))
-	}
-	ok, err := b.accessControl.Evaluate(ctx, user, accesscontrol.EvalPermission(dashboards.ActionFoldersWrite, scopes...))
-	if err != nil {
-		return err
-	}
+		resp, err := b.folderClient.Get(ctx, folderId, user.GetOrgID(), metav1.GetOptions{}, "access")
+		if err != nil {
+			return dashboards.ErrFolderAccessDenied
+		}
+		var accessInfo folders.FolderAccessInfo
+		err = runtime.DefaultUnstructuredConverter.FromUnstructured(resp.Object, &accessInfo)
+		if err != nil {
+			b.log.Error("Failed to convert folder access response", "error", err)
+			return dashboards.ErrFolderAccessDenied
+		}
 
-	if !ok {
-		return dashboards.ErrFolderAccessDenied
+		if !accessInfo.CanEdit {
+			return dashboards.ErrFolderAccessDenied
+		}
 	}
 
 	return nil