Access control: Move data source actions and scopes to datasource package (#46594)

* Add permission actions and id scope

* Remove scope and actions variable prefix

* Move page evaluators and rename them

pkg/services/datasources/accesscontrol.go

@@ -3,17 +3,45 @@ package datasources
 import "github.com/grafana/grafana/pkg/services/accesscontrol"
 
 const (
-	ActionDatasourcesRead   = "datasources:read"
-	ActionDatasourcesQuery  = "datasources:query"
-	ActionDatasourcesCreate = "datasources:create"
-	ActionDatasourcesWrite  = "datasources:write"
-	ActionDatasourcesDelete = "datasources:delete"
-	ActionDatasourcesIDRead = "datasources.id:read"
+	ScopeRoot = "datasources"
 
-	ScopeDatasourcesRoot = "datasources"
+	ActionRead             = "datasources:read"
+	ActionQuery            = "datasources:query"
+	ActionCreate           = "datasources:create"
+	ActionWrite            = "datasources:write"
+	ActionDelete           = "datasources:delete"
+	ActionIDRead           = "datasources.id:read"
+	ActionPermissionsRead  = "datasources.permissions:read"
+	ActionPermissionsWrite = "datasources.permissions:write"
 )
 
 var (
-	ScopeDatasourcesAll      = accesscontrol.GetResourceAllScope(ScopeDatasourcesRoot)
-	ScopeDatasourcesProvider = accesscontrol.NewScopeProvider(ScopeDatasourcesRoot)
+	ScopeID       = accesscontrol.Scope("datasources", "id", accesscontrol.Parameter(":datasourceId"))
+	ScopeAll      = accesscontrol.GetResourceAllScope(ScopeRoot)
+	ScopeProvider = accesscontrol.NewScopeProvider(ScopeRoot)
+)
+
+var (
+	// ConfigurationPageAccess is used to protect the "Configure > Data sources" tab access
+	ConfigurationPageAccess = accesscontrol.EvalAll(
+		accesscontrol.EvalPermission(ActionRead),
+		accesscontrol.EvalAny(
+			accesscontrol.EvalPermission(ActionCreate),
+			accesscontrol.EvalPermission(ActionDelete),
+			accesscontrol.EvalPermission(ActionWrite),
+		),
+	)
+
+	// NewPageAccess is used to protect the "Configure > Data sources > New" page access
+	NewPageAccess = accesscontrol.EvalAll(
+		accesscontrol.EvalPermission(ActionRead),
+		accesscontrol.EvalPermission(ActionCreate),
+		accesscontrol.EvalPermission(ActionWrite),
+	)
+
+	// EditPageAccess is used to protect the "Configure > Data sources > Edit" page access
+	EditPageAccess = accesscontrol.EvalAll(
+		accesscontrol.EvalPermission(ActionRead),
+		accesscontrol.EvalPermission(ActionWrite),
+	)
 )