[v8.5.x] RBAC: drop permissions with folder:create action added by migration (#50493)

* add migrator to drop folder create actions that was set fromt he folder (#49878)

(cherry picked from commit f4f25d911b)

* Add missing const

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: gamab <gabi.mabs@gmail.com>

pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go

@@ -41,13 +41,11 @@ var folderPermissionTranslation = map[models.PermissionType][]string{
 		ac.ActionDashboardsCreate,
 		dashboards.ActionFoldersRead,
 		dashboards.ActionFoldersWrite,
-		dashboards.ActionFoldersCreate,
 		dashboards.ActionFoldersDelete,
 	}...),
 	models.PERMISSION_ADMIN: append(dashboardPermissionTranslation[models.PERMISSION_ADMIN], []string{
 		dashboards.ActionFoldersRead,
 		dashboards.ActionFoldersWrite,
-		dashboards.ActionFoldersCreate,
 		dashboards.ActionFoldersDelete,
 		dashboards.ActionFoldersPermissionsRead,
 		dashboards.ActionFoldersPermissionsWrite,
@@ -57,6 +55,7 @@ var folderPermissionTranslation = map[models.PermissionType][]string{
 func AddDashboardPermissionsMigrator(mg *migrator.Migrator) {
 	mg.AddMigration("dashboard permissions", &dashboardPermissionsMigrator{})
 	mg.AddMigration("dashboard permissions uid scopes", &dashboardUidPermissionMigrator{})
+	mg.AddMigration("drop managed folder create actions", &managedFolderCreateAction{})
 }
 
 var _ migrator.CodeMigration = new(dashboardPermissionsMigrator)
@@ -280,3 +279,18 @@ func (d *dashboardUidPermissionMigrator) migrateIdScopes(sess *xorm.Session) err
 	}
 	return nil
 }
+
+type managedFolderCreateAction struct {
+	migrator.MigrationBase
+}
+
+func (m *managedFolderCreateAction) SQL(dialect migrator.Dialect) string {
+	return CodeMigrationSQL
+}
+
+func (m *managedFolderCreateAction) Exec(sess *xorm.Session, migrator *migrator.Migrator) error {
+	if _, err := sess.Exec("DELETE FROM permission WHERE action = 'folders:create' AND scope LIKE 'folders:uid:%'"); err != nil {
+		return err
+	}
+	return nil
+}

pkg/services/sqlstore/migrations/accesscontrol/migrations.go

@@ -2,6 +2,8 @@ package accesscontrol
 
 import "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
 
+const CodeMigrationSQL = "code migration"
+
 func AddMigration(mg *migrator.Migrator) {
 	permissionV1 := migrator.Table{
 		Name: "permission",