Access Control: Make the evaluator prefix match only (#38025)

* Make the evaluator prefix match only

* Handle empty scopes

* Bump version of settings read role

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

pkg/services/accesscontrol/accesscontrol.go

@@ -2,6 +2,7 @@ package accesscontrol
 
 import (
 	"context"
+	"strings"
 
 	"github.com/grafana/grafana/pkg/models"
 )
@@ -53,3 +54,15 @@ func BuildPermissionsMap(permissions []*Permission) map[string]bool {
 
 	return permissionsMap
 }
+
+func ValidateScope(scope string) bool {
+	prefix, last := scope[:len(scope)-1], scope[len(scope)-1]
+	// verify that last char is either ':' or '/' if last character of scope is '*'
+	if len(prefix) > 0 && last == '*' {
+		lastChar := prefix[len(prefix)-1]
+		if lastChar != ':' && lastChar != '/' {
+			return false
+		}
+	}
+	return !strings.ContainsAny(prefix, "*?")
+}