RBAC: Check plugins:install globally (#78438)

* RBAC: Check plugins:install globally

* Add disclamer to the RBACSingleOrganization config option

pkg/services/accesscontrol/middleware.go

@@ -252,6 +252,16 @@ func UseGlobalOrg(c *contextmodel.ReqContext) (int64, error) {
 	return GlobalOrgID, nil
 }
 
+// UseGlobalOrSingleOrg returns the global organization or the current organization in a single organization setup
+func UseGlobalOrSingleOrg(cfg *setting.Cfg) OrgIDGetter {
+	return func(c *contextmodel.ReqContext) (int64, error) {
+		if cfg.RBACSingleOrganization {
+			return c.GetOrgID(), nil
+		}
+		return GlobalOrgID, nil
+	}
+}
+
 // scopeParams holds the parameters used to fill in scope templates
 type scopeParams struct {
 	OrgID     int64

pkg/services/pluginsintegration/pluginaccesscontrol/accesscontrol.go

@@ -59,7 +59,7 @@ func DeclareRBACRoles(service ac.Service, cfg *setting.Cfg) error {
 		Role: ac.RoleDTO{
 			Name:        ac.FixedRolePrefix + "plugins:maintainer",
 			DisplayName: "Plugin Maintainer",
-			Description: "Install, uninstall plugins",
+			Description: "Install, uninstall plugins. Needs to be assigned globally.",
 			Group:       "Plugins",
 			Permissions: []ac.Permission{
 				{Action: ActionInstall},