Access control: Add access control based permissions to admins/users (#32409)

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>

pkg/services/accesscontrol/ossaccesscontrol/builtin_roles.go

@@ -1,44 +0,0 @@
-package ossaccesscontrol
-
-import (
-	"github.com/grafana/grafana/pkg/services/accesscontrol"
-)
-
-const roleGrafanaAdmin = "Grafana Admin"
-
-var builtInRolesMap = map[string]accesscontrol.RoleDTO{
-	"grafana:builtin:users:read:self": {
-		Name:    "grafana:builtin:users:read:self",
-		Version: 1,
-		Permissions: []accesscontrol.Permission{
-			{
-				Action: "users:read",
-				Scope:  "users:self",
-			},
-			{
-				Action: "users.tokens:list",
-				Scope:  "users:self",
-			},
-			{
-				Action: "users.teams:read",
-				Scope:  "users:self",
-			},
-		},
-	},
-}
-
-var builtInRoleGrants = map[string][]string{
-	"Viewer": {
-		"grafana:builtin:users:read:self",
-	},
-}
-
-func getBuiltInRole(role string) *accesscontrol.RoleDTO {
-	var builtInRole accesscontrol.RoleDTO
-	if r, ok := builtInRolesMap[role]; ok {
-		// Do not modify builtInRoles
-		builtInRole = r
-		return &builtInRole
-	}
-	return nil
-}

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -39,16 +39,16 @@ func (ac *OSSAccessControlService) Evaluate(ctx context.Context, user *models.Si
 
 // GetUserPermissions returns user permissions based on built-in roles
 func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user *models.SignedInUser) ([]*accesscontrol.Permission, error) {
-	roles := ac.GetUserBuiltInRoles(user)
+	builtinRoles := ac.GetUserBuiltInRoles(user)
 	permissions := make([]*accesscontrol.Permission, 0)
-	for _, legacyRole := range roles {
-		if builtInRoleNames, ok := builtInRoleGrants[legacyRole]; ok {
-			for _, builtInRoleName := range builtInRoleNames {
-				builtInRole := getBuiltInRole(builtInRoleName)
-				if builtInRole == nil {
+	for _, builtin := range builtinRoles {
+		if roleNames, ok := accesscontrol.PredefinedRoleGrants[builtin]; ok {
+			for _, name := range roleNames {
+				r, exists := accesscontrol.PredefinedRoles[name]
+				if !exists {
 					continue
 				}
-				for _, p := range builtInRole.Permissions {
+				for _, p := range r.Permissions {
 					permission := p
 					permissions = append(permissions, &permission)
 				}
@@ -65,7 +65,7 @@ func (ac *OSSAccessControlService) GetUserBuiltInRoles(user *models.SignedInUser
 		roles = append(roles, string(role))
 	}
 	if user.IsGrafanaAdmin {
-		roles = append(roles, roleGrafanaAdmin)
+		roles = append(roles, accesscontrol.RoleGrafanaAdmin)
 	}
 
 	return roles

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/registry"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/setting"
 )
 
@@ -53,12 +54,12 @@ func TestEvaluatingPermissions(t *testing.T) {
 			desc: "should successfully evaluate access to the endpoint",
 			user: userTestCase{
 				name:           "testuser",
-				orgRole:        models.ROLE_EDITOR,
+				orgRole:        "Grafana Admin",
 				isGrafanaAdmin: false,
 			},
 			endpoints: []endpointTestCase{
-				{permission: "users.teams:read", scope: []string{"users:self"}},
-				{permission: "users:read", scope: []string{"users:self"}},
+				{permission: accesscontrol.ActionUsersDisable, scope: []string{accesscontrol.ScopeUsersAll}},
+				{permission: accesscontrol.ActionUsersEnable, scope: []string{accesscontrol.ScopeUsersAll}},
 			},
 			evalResult: true,
 		},
@@ -70,7 +71,7 @@ func TestEvaluatingPermissions(t *testing.T) {
 				isGrafanaAdmin: false,
 			},
 			endpoints: []endpointTestCase{
-				{permission: "users:create", scope: []string{"users"}},
+				{permission: accesscontrol.ActionUsersCreate, scope: []string{accesscontrol.ScopeUsersAll}},
 			},
 			evalResult: false,
 		},