Access control: Make Admin/Users UI working with the permissions (#33176)

* API: authorize admin/users views

* Render admin/users components based on user's permissions

* Add LDAP permissions (required by admin/user page)

* Extend default admin role by LDAP permissions

* Show/hide LDAP debug views

* Render LDAP debug page if user has access

* Authorize LDAP debug view

* fix permissions definitions

* Add LDAP page permissions

* remove ambiguous permissions check

* Hide logout buttons in sessions table

* Add org/users permissions

* Use org permissions for managing user roles in orgs

* Apply permissions to org/users

* Apply suggestions from review

* Fix tests

* remove scopes from the frontend

* Tweaks according to review

* Handle /invites endpoints

pkg/services/accesscontrol/accesscontrol.go

@@ -37,20 +37,14 @@ var ReqGrafanaAdmin = func(c *models.ReqContext) bool {
 	return c.IsGrafanaAdmin
 }
 
-func BuildPermissionsMap(permissions []*Permission) map[string]map[string]string {
-	permissionsMap := make(map[string]map[string]string)
+var ReqOrgAdmin = func(c *models.ReqContext) bool {
+	return c.OrgRole == models.ROLE_ADMIN
+}
+
+func BuildPermissionsMap(permissions []*Permission) map[string]bool {
+	permissionsMap := make(map[string]bool)
 	for _, p := range permissions {
-		if item, ok := permissionsMap[p.Action]; ok {
-			if _, ok := item[p.Scope]; !ok && p.Scope != "" {
-				permissionsMap[p.Action][p.Scope] = p.Scope
-			}
-		} else {
-			newItem := make(map[string]string)
-			if p.Scope != "" {
-				newItem[p.Scope] = p.Scope
-			}
-			permissionsMap[p.Action] = newItem
-		}
+		permissionsMap[p.Action] = true
 	}
 
 	return permissionsMap

pkg/services/accesscontrol/models.go

@@ -42,6 +42,7 @@ func (p RoleDTO) Role() Role {
 const (
 	// Permission actions
 
+	// Users actions
 	ActionUsersRead     = "users:read"
 	ActionUsersWrite    = "users:write"
 	ActionUsersTeamRead = "users.teams:read"
@@ -63,9 +64,23 @@ const (
 	ActionUsersQuotasList        = "users.quotas:list"
 	ActionUsersQuotasUpdate      = "users.quotas:update"
 
+	// Org actions
+	ActionOrgUsersRead       = "org.users:read"
+	ActionOrgUsersAdd        = "org.users:add"
+	ActionOrgUsersRemove     = "org.users:remove"
+	ActionOrgUsersRoleUpdate = "org.users.role:update"
+
+	// LDAP actions
+	ActionLDAPUsersRead  = "ldap.user:read"
+	ActionLDAPUsersSync  = "ldap.user:sync"
+	ActionLDAPStatusRead = "ldap.status:read"
+
 	// Global Scopes
 	ScopeUsersAll  = "users:*"
 	ScopeUsersSelf = "users:self"
+
+	ScopeOrgAllUsersAll     = "org:*/users:*"
+	ScopeOrgCurrentUsersAll = "org:current/users:*"
 )
 
 const RoleGrafanaAdmin = "Grafana Admin"

pkg/services/accesscontrol/roles.go

@@ -29,6 +29,16 @@ var PredefinedRoles = map[string]RoleDTO{
 				Action: ActionUsersQuotasList,
 				Scope:  ScopeUsersAll,
 			},
+			{
+				Action: ActionOrgUsersRead,
+				Scope:  ScopeOrgAllUsersAll,
+			},
+			{
+				Action: ActionLDAPUsersRead,
+			},
+			{
+				Action: ActionLDAPStatusRead,
+			},
 		},
 	},
 	usersAdminEdit: {
@@ -94,6 +104,26 @@ var PredefinedRoles = map[string]RoleDTO{
 				Action: ActionUsersQuotasUpdate,
 				Scope:  ScopeUsersAll,
 			},
+			{
+				// Inherited from grafana:roles:users:admin:read
+				Action: ActionOrgUsersRead,
+				Scope:  ScopeOrgAllUsersAll,
+			},
+			{
+				Action: ActionOrgUsersAdd,
+				Scope:  ScopeOrgAllUsersAll,
+			},
+			{
+				Action: ActionOrgUsersRemove,
+				Scope:  ScopeOrgAllUsersAll,
+			},
+			{
+				Action: ActionOrgUsersRoleUpdate,
+				Scope:  ScopeOrgAllUsersAll,
+			},
+			{
+				Action: ActionLDAPUsersSync,
+			},
 		},
 	},
 }