Chore: remove tests for legacy AC, update other tests to work with RBAC (#68895)

* remove tests for legacy AC, update other tests to work with RBAC

* update usage stat tests to use RBAC

pkg/api/org_users_test.go

@@ -10,7 +10,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
 	"github.com/grafana/grafana/pkg/api/dtos"
@@ -19,7 +18,6 @@ import (
 	"github.com/grafana/grafana/pkg/models/roletype"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
-	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/login"
 	"github.com/grafana/grafana/pkg/services/login/logintest"
@@ -29,7 +27,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/quota/quotaimpl"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/services/supportbundles/supportbundlestest"
-	"github.com/grafana/grafana/pkg/services/team/teamtest"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/services/user/userimpl"
 	"github.com/grafana/grafana/pkg/services/user/usertest"
@@ -296,72 +293,7 @@ func TestOrgUsersAPIEndpoint_updateOrgRole(t *testing.T) {
 	}
 }
 
-func TestOrgUsersAPIEndpoint_LegacyAccessControl(t *testing.T) {
-	type testCase struct {
-		desc          string
-		isTeamAdmin   bool
-		isFolderAdmin bool
-		role          org.RoleType
-		expectedCode  int
-	}
-
-	tests := []testCase{
-		{
-			desc:          "should be able to search org user when user is folder admin",
-			isFolderAdmin: true,
-			role:          org.RoleViewer,
-			expectedCode:  http.StatusOK,
-		},
-		{
-			desc:          "should be able to search org user when user is team admin",
-			isFolderAdmin: true,
-			role:          org.RoleViewer,
-			expectedCode:  http.StatusOK,
-		},
-		{
-			desc:         "should be able to search org user when user is admin",
-			role:         org.RoleAdmin,
-			expectedCode: http.StatusOK,
-		},
-		{
-			desc:         "should not be able to search org user when user is viewer",
-			role:         org.RoleViewer,
-			expectedCode: http.StatusForbidden,
-		},
-		{
-			desc:         "should not be able to search org user when user is editor",
-			role:         org.RoleEditor,
-			expectedCode: http.StatusForbidden,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.desc, func(t *testing.T) {
-			server := SetupAPITestServer(t, func(hs *HTTPServer) {
-				cfg := setting.NewCfg()
-				cfg.RBACEnabled = false
-				hs.Cfg = cfg
-
-				dashboardService := dashboards.NewFakeDashboardService(t)
-				dashboardService.On("HasAdminPermissionInDashboardsOrFolders", mock.Anything, mock.Anything).Return(tt.isFolderAdmin, nil).Maybe()
-				hs.DashboardService = dashboardService
-
-				teamService := teamtest.NewFakeService()
-				teamService.ExpectedIsAdmin = tt.isTeamAdmin
-				hs.teamService = teamService
-				hs.orgService = &orgtest.FakeOrgService{ExpectedSearchOrgUsersResult: &org.SearchOrgUsersQueryResult{}}
-				hs.authInfoService = &logintest.AuthInfoServiceFake{}
-			})
-
-			res, err := server.Send(webtest.RequestWithSignedInUser(server.NewGetRequest("/api/org/users/lookup"), &user.SignedInUser{OrgID: 1, OrgRole: tt.role}))
-			require.NoError(t, err)
-			assert.Equal(t, tt.expectedCode, res.StatusCode)
-			require.NoError(t, res.Body.Close())
-		})
-	}
-}
-
-func TestOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
+func TestOrgUsersAPIEndpoint(t *testing.T) {
 	type testCase struct {
 		desc         string
 		permissions  []accesscontrol.Permission
@@ -473,46 +405,15 @@ func TestGetOrgUsersAPIEndpoint_AccessControlMetadata(t *testing.T) {
 
 func TestGetOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 	type testCase struct {
-		name                string
-		enableAccessControl bool
-		role                org.RoleType
-		isGrafanaAdmin      bool
-		permissions         []accesscontrol.Permission
-		expectedCode        int
-		targetOrg           int64
+		name         string
+		permissions  []accesscontrol.Permission
+		expectedCode int
+		targetOrg    int64
 	}
 
 	tests := []testCase{
 		{
-			name:                "server admin can get users in his org (legacy)",
-			enableAccessControl: false,
-			role:                org.RoleViewer,
-			isGrafanaAdmin:      true,
-			expectedCode:        http.StatusOK,
-			targetOrg:           1,
-		},
-		{
-			name:                "server admin can get users in another org (legacy)",
-			enableAccessControl: false,
-			isGrafanaAdmin:      true,
-			expectedCode:        http.StatusOK,
-			targetOrg:           2,
-		},
-		{
-			name:                "org admin cannot get users in his org (legacy)",
-			enableAccessControl: false,
-			expectedCode:        http.StatusForbidden,
-			targetOrg:           1,
-		},
-		{
-			name:                "org admin cannot get users in another org (legacy)",
-			enableAccessControl: false,
-			expectedCode:        http.StatusForbidden,
-			targetOrg:           1,
-		},
-		{
-			name:                "user with permissions can get users in org",
-			enableAccessControl: true,
+			name: "user with permissions can get users in org",
 			permissions: []accesscontrol.Permission{
 				{Action: accesscontrol.ActionOrgUsersRead, Scope: "users:*"},
 			},
@@ -520,17 +421,15 @@ func TestGetOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 			targetOrg:    1,
 		},
 		{
-			name:                "user without permissions cannot get users in org",
-			enableAccessControl: true,
-			expectedCode:        http.StatusForbidden,
-			targetOrg:           1,
+			name:         "user without permissions cannot get users in org",
+			expectedCode: http.StatusForbidden,
+			targetOrg:    1,
 		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			server := SetupAPITestServer(t, func(hs *HTTPServer) {
 				hs.Cfg = setting.NewCfg()
-				hs.Cfg.RBACEnabled = tc.enableAccessControl
 				hs.orgService = &orgtest.FakeOrgService{
 					ExpectedSearchOrgUsersResult: &org.SearchOrgUsersQueryResult{},
 				}
@@ -539,8 +438,6 @@ func TestGetOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 			})
 
 			u := userWithPermissions(1, tc.permissions)
-			u.OrgRole = tc.role
-			u.IsGrafanaAdmin = tc.isGrafanaAdmin
 
 			res, err := server.Send(webtest.RequestWithSignedInUser(server.NewGetRequest(fmt.Sprintf("/api/orgs/%d/users/", tc.targetOrg)), u))
 			require.NoError(t, err)
@@ -552,34 +449,15 @@ func TestGetOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 
 func TestPostOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 	type testCase struct {
-		desc                string
-		enableAccessControl bool
-		permissions         []accesscontrol.Permission
-		isGrafanaAdmin      bool
-		role                org.RoleType
-		input               string
-		expectedCode        int
+		desc         string
+		permissions  []accesscontrol.Permission
+		input        string
+		expectedCode int
 	}
 
 	tests := []testCase{
 		{
-			desc:                "server admin can add users to his org (legacy)",
-			enableAccessControl: false,
-			isGrafanaAdmin:      true,
-			input:               `{"loginOrEmail": "user", "role": "Viewer"}`,
-			expectedCode:        http.StatusOK,
-		},
-		{
-			desc:                "org admin cannot add users to his org (legacy)",
-			enableAccessControl: false,
-			role:                org.RoleAdmin,
-			expectedCode:        http.StatusForbidden,
-			input:               `{"loginOrEmail": "user", "role": "Viewer"}`,
-		},
-		{
-			desc:                "user with permissions can add users to org",
-			enableAccessControl: true,
-			role:                org.RoleViewer,
+			desc: "user with permissions can add users to org",
 			permissions: []accesscontrol.Permission{
 				{Action: accesscontrol.ActionOrgUsersAdd, Scope: "users:*"},
 			},
@@ -587,17 +465,15 @@ func TestPostOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 			expectedCode: http.StatusOK,
 		},
 		{
-			desc:                "user without permissions cannot add users to org",
-			enableAccessControl: true,
-			expectedCode:        http.StatusForbidden,
-			input:               `{"loginOrEmail": "user", "role": "Viewer"}`,
+			desc:         "user without permissions cannot add users to org",
+			expectedCode: http.StatusForbidden,
+			input:        `{"loginOrEmail": "user", "role": "Viewer"}`,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			server := SetupAPITestServer(t, func(hs *HTTPServer) {
 				hs.Cfg = setting.NewCfg()
-				hs.Cfg.RBACEnabled = tt.enableAccessControl
 				hs.orgService = &orgtest.FakeOrgService{}
 				hs.authInfoService = &logintest.AuthInfoServiceFake{}
 				hs.userService = &usertest.FakeUserService{
@@ -607,8 +483,6 @@ func TestPostOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 			})
 
 			u := userWithPermissions(1, tt.permissions)
-			u.OrgRole = tt.role
-			u.IsGrafanaAdmin = tt.isGrafanaAdmin
 
 			res, err := server.SendJSON(webtest.RequestWithSignedInUser(server.NewPostRequest("/api/orgs/1/users", strings.NewReader(tt.input)), u))
 			require.NoError(t, err)
@@ -753,59 +627,39 @@ func TestOrgUsersAPIEndpointWithSetPerms_AccessControl(t *testing.T) {
 
 func TestPatchOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 	type testCase struct {
-		name                string
-		enableAccessControl bool
-		isGrafanaAdmin      bool
-		role                org.RoleType
-		permissions         []accesscontrol.Permission
-		input               string
-		expectedCode        int
+		name         string
+		role         org.RoleType
+		permissions  []accesscontrol.Permission
+		input        string
+		expectedCode int
 	}
 
 	tests := []testCase{
 		{
-			name:                "server admin can update users in his org (legacy)",
-			enableAccessControl: false,
-			isGrafanaAdmin:      true,
-			input:               `{"role": "Viewer"}`,
-			expectedCode:        http.StatusOK,
+			name:         "user with permissions can update org role",
+			permissions:  []accesscontrol.Permission{{Action: accesscontrol.ActionOrgUsersWrite, Scope: "users:*"}},
+			role:         org.RoleAdmin,
+			input:        `{"role": "Viewer"}`,
+			expectedCode: http.StatusOK,
 		},
 		{
-			name:                "org admin cannot update users in his org (legacy)",
-			enableAccessControl: false,
-			role:                org.RoleAdmin,
-			input:               `{"role": "Editor"}`,
-			expectedCode:        http.StatusForbidden,
+			name:         "user without permissions cannot update org role",
+			permissions:  []accesscontrol.Permission{},
+			input:        `{"role": "Editor"}`,
+			expectedCode: http.StatusForbidden,
 		},
 		{
-			name:                "user with permissions can update org role",
-			enableAccessControl: true,
-			permissions:         []accesscontrol.Permission{{Action: accesscontrol.ActionOrgUsersWrite, Scope: "users:*"}},
-			role:                org.RoleAdmin,
-			input:               `{"role": "Viewer"}`,
-			expectedCode:        http.StatusOK,
-		},
-		{
-			name:                "user without permissions cannot update org role",
-			enableAccessControl: true,
-			permissions:         []accesscontrol.Permission{},
-			input:               `{"role": "Editor"}`,
-			expectedCode:        http.StatusForbidden,
-		},
-		{
-			name:                "user with permissions cannot update org role with more privileges",
-			enableAccessControl: true,
-			permissions:         []accesscontrol.Permission{{Action: accesscontrol.ActionOrgUsersWrite, Scope: "users:*"}},
-			role:                org.RoleViewer,
-			input:               `{"role": "Admin"}`,
-			expectedCode:        http.StatusForbidden,
+			name:         "user with permissions cannot update org role with more privileges",
+			permissions:  []accesscontrol.Permission{{Action: accesscontrol.ActionOrgUsersWrite, Scope: "users:*"}},
+			role:         org.RoleViewer,
+			input:        `{"role": "Admin"}`,
+			expectedCode: http.StatusForbidden,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			server := SetupAPITestServer(t, func(hs *HTTPServer) {
 				hs.Cfg = setting.NewCfg()
-				hs.Cfg.RBACEnabled = tt.enableAccessControl
 				hs.orgService = &orgtest.FakeOrgService{}
 				hs.authInfoService = &logintest.AuthInfoServiceFake{
 					ExpectedUserAuth: &login.UserAuth{
@@ -820,59 +674,39 @@ func TestPatchOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 			})
 
 			u := userWithPermissions(1, tt.permissions)
-			u.IsGrafanaAdmin = tt.isGrafanaAdmin
 			res, err := server.SendJSON(webtest.RequestWithSignedInUser(server.NewRequest(http.MethodPatch, "/api/orgs/1/users/1", strings.NewReader(tt.input)), u))
 			require.NoError(t, err)
 			assert.Equal(t, tt.expectedCode, res.StatusCode)
 			require.NoError(t, res.Body.Close())
-
-			cfg := setting.NewCfg()
-			cfg.RBACEnabled = tt.enableAccessControl
 		})
 	}
 }
 
 func TestDeleteOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 	type testCase struct {
-		name                string
-		enableAccessControl bool
-		permissions         []accesscontrol.Permission
-		role                org.RoleType
-		isGrafanaAdmin      bool
-		expectedCode        int
+		name           string
+		permissions    []accesscontrol.Permission
+		isGrafanaAdmin bool
+		expectedCode   int
 	}
 
 	tests := []testCase{
 		{
-			name:                "server admin can remove users from org (legacy)",
-			enableAccessControl: false,
-			isGrafanaAdmin:      true,
-			expectedCode:        http.StatusOK,
-		},
-		{
-			name:         "org admin can remove users from org (legacy)",
-			role:         org.RoleAdmin,
-			expectedCode: http.StatusForbidden,
-		},
-		{
-			name:                "user with permissions can remove user from org",
-			enableAccessControl: true,
+			name: "user with permissions can remove user from org",
 			permissions: []accesscontrol.Permission{
 				{Action: accesscontrol.ActionOrgUsersRemove, Scope: "users:*"},
 			},
 			expectedCode: http.StatusOK,
 		},
 		{
-			name:                "user without permissions cannot remove user from org",
-			enableAccessControl: true,
-			expectedCode:        http.StatusForbidden,
+			name:         "user without permissions cannot remove user from org",
+			expectedCode: http.StatusForbidden,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			server := SetupAPITestServer(t, func(hs *HTTPServer) {
 				hs.Cfg = setting.NewCfg()
-				hs.Cfg.RBACEnabled = tt.enableAccessControl
 				hs.accesscontrolService = actest.FakeService{}
 				hs.orgService = &orgtest.FakeOrgService{
 					ExpectedOrgListResponse: orgtest.OrgListResponse{struct {
@@ -893,9 +727,6 @@ func TestDeleteOrgUsersAPIEndpoint_AccessControl(t *testing.T) {
 			require.NoError(t, err)
 			assert.Equal(t, tt.expectedCode, res.StatusCode)
 			require.NoError(t, res.Body.Close())
-
-			cfg := setting.NewCfg()
-			cfg.RBACEnabled = tt.enableAccessControl
 		})
 	}
 }