Access control: Set default permissions for data sources when using access control (#45482)

* Rename interfaces and use then with wire injection

* Set default permissions when creating new data source

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -11,7 +11,6 @@ import (
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/api"
-	"github.com/grafana/grafana/pkg/services/accesscontrol/resourceservices"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/prometheus/client_golang/prometheus"
 )
@@ -116,7 +115,7 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 		OrgID:   user.OrgId,
 		UserID:  user.UserId,
 		Roles:   ac.GetUserBuiltInRoles(user),
-		Actions: resourceservices.TeamAdminActions,
+		Actions: TeamAdminActions,
 	})
 	if err != nil {
 		return nil, err

pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go

@@ -0,0 +1,134 @@
+package ossaccesscontrol
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	"github.com/grafana/grafana/pkg/api/routing"
+	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
+	"github.com/grafana/grafana/pkg/services/sqlstore"
+)
+
+func ProvidePermissionsServices(router routing.RouteRegister, sql *sqlstore.SQLStore, ac accesscontrol.AccessControl, store resourcepermissions.Store) (*PermissionsService, error) {
+	teamPermissions, err := ProvideTeamPermissions(router, sql, ac, store)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PermissionsService{teams: teamPermissions, datasources: provideEmptyPermissionsService()}, nil
+}
+
+type PermissionsService struct {
+	teams       accesscontrol.PermissionsService
+	datasources accesscontrol.PermissionsService
+}
+
+func (s *PermissionsService) GetTeamService() accesscontrol.PermissionsService {
+	return s.teams
+}
+
+func (s *PermissionsService) GetDataSourceService() accesscontrol.PermissionsService {
+	return s.datasources
+}
+
+var (
+	TeamMemberActions = []string{
+		accesscontrol.ActionTeamsRead,
+	}
+
+	TeamAdminActions = []string{
+		accesscontrol.ActionTeamsRead,
+		accesscontrol.ActionTeamsDelete,
+		accesscontrol.ActionTeamsWrite,
+		accesscontrol.ActionTeamsPermissionsRead,
+		accesscontrol.ActionTeamsPermissionsWrite,
+	}
+)
+
+func ProvideTeamPermissions(router routing.RouteRegister, sql *sqlstore.SQLStore, ac accesscontrol.AccessControl, store resourcepermissions.Store) (*resourcepermissions.Service, error) {
+	options := resourcepermissions.Options{
+		Resource:    "teams",
+		OnlyManaged: true,
+		ResourceValidator: func(ctx context.Context, orgID int64, resourceID string) error {
+			id, err := strconv.ParseInt(resourceID, 10, 64)
+			if err != nil {
+				return err
+			}
+
+			err = sql.GetTeamById(context.Background(), &models.GetTeamByIdQuery{
+				OrgId: orgID,
+				Id:    id,
+			})
+			if err != nil {
+				return err
+			}
+
+			return nil
+		},
+		Assignments: resourcepermissions.Assignments{
+			Users:        true,
+			Teams:        false,
+			BuiltInRoles: false,
+		},
+		PermissionsToActions: map[string][]string{
+			"Member": TeamMemberActions,
+			"Admin":  TeamAdminActions,
+		},
+		ReaderRoleName: "Team permission reader",
+		WriterRoleName: "Team permission writer",
+		RoleGroup:      "Teams",
+		OnSetUser: func(session *sqlstore.DBSession, orgID int64, user accesscontrol.User, resourceID, permission string) error {
+			teamId, err := strconv.ParseInt(resourceID, 10, 64)
+			if err != nil {
+				return err
+			}
+			switch permission {
+			case "Member":
+				return sqlstore.AddOrUpdateTeamMemberHook(session, user.ID, orgID, teamId, user.IsExternal, 0)
+			case "Admin":
+				return sqlstore.AddOrUpdateTeamMemberHook(session, user.ID, orgID, teamId, user.IsExternal, models.PERMISSION_ADMIN)
+			case "":
+				return sqlstore.RemoveTeamMemberHook(session, &models.RemoveTeamMemberCommand{
+					OrgId:  orgID,
+					UserId: user.ID,
+					TeamId: teamId,
+				})
+			default:
+				return fmt.Errorf("invalid team permission type %s", permission)
+			}
+		},
+	}
+
+	return resourcepermissions.New(options, router, ac, store, sql)
+}
+
+func provideEmptyPermissionsService() accesscontrol.PermissionsService {
+	return &emptyPermissionsService{}
+}
+
+var _ accesscontrol.PermissionsService = new(emptyPermissionsService)
+
+type emptyPermissionsService struct{}
+
+func (e emptyPermissionsService) GetPermissions(ctx context.Context, orgID int64, resourceID string) ([]accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetUserPermission(ctx context.Context, orgID int64, user accesscontrol.User, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetTeamPermission(ctx context.Context, orgID, teamID int64, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetBuiltInRolePermission(ctx context.Context, orgID int64, builtInRole string, resourceID string, permission string) (*accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...accesscontrol.SetResourcePermissionCommand) ([]accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}