Access control: Add access control based permissions to admins/users (#32409)

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>

pkg/services/accesscontrol/middleware/middleware.go

@@ -18,6 +18,8 @@ func Middleware(ac accesscontrol.AccessControl) func(macaron.Handler, string, ..
 		}
 
 		return func(c *models.ReqContext) {
+			// We need this otherwise templated scopes get initialized only once, during the first call
+			runtimeScope := make([]string, len(scopes))
 			for i, scope := range scopes {
 				var buf bytes.Buffer
 
@@ -31,17 +33,17 @@ func Middleware(ac accesscontrol.AccessControl) func(macaron.Handler, string, ..
 					c.JsonApiErr(http.StatusInternalServerError, "Internal server error", err)
 					return
 				}
-				scopes[i] = buf.String()
+				runtimeScope[i] = buf.String()
 			}
 
-			hasAccess, err := ac.Evaluate(c.Req.Context(), c.SignedInUser, permission, scopes...)
+			hasAccess, err := ac.Evaluate(c.Req.Context(), c.SignedInUser, permission, runtimeScope...)
 			if err != nil {
 				c.Logger.Error("Error from access control system", "error", err)
 				c.JsonApiErr(http.StatusForbidden, "Forbidden", nil)
 				return
 			}
 			if !hasAccess {
-				c.Logger.Info("Access denied", "userID", c.UserId, "permission", permission, "scopes", scopes)
+				c.Logger.Info("Access denied", "userID", c.UserId, "permission", permission, "scopes", runtimeScope)
 				c.JsonApiErr(http.StatusForbidden, "Forbidden", nil)
 				return
 			}