AccessControl: Implement teams resource service (#43951)

* AccessControl: cover team permissions

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Add background service as a consumer to resource_services

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Define actions in roles.go

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Remove action from accesscontrol model

 Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* As suggested by kalle

* move some changes from branch to the skeleton PR

* Add background service as a consumer to resource_services

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* moving resourceservice to the main wire file pt2

* move team related actions so that they can be reused

* PR feedback

* fix

* typo

* Access Control: adding hooks for team member endpoints (#43991)

* AccessControl: cover team permissions

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Add background service as a consumer to resource_services

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Define actions in roles.go

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Remove action from accesscontrol model

 Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* As suggested by kalle

* add access control to list and add team member endpoint, and hooks for adding team members

* member permission type is 0

* add ID scope for team permission checks

* add more team actions, use Member for member permission name

* protect team member update endpoint with FGAC permissions

* update SQL functions for teams and the corresponding tests

* also protect team member removal endpoint with FGAC permissions and add a hook to permission service

* a few small fixes, provide team permission service to test setup

* AccessControl: cover team permissions

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Add background service as a consumer to resource_services

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Define actions in roles.go

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* Remove action from accesscontrol model

 Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

* As suggested by kalle

* move some changes from branch to the skeleton PR

* remove resource services from wireexts

* remove unneeded actions

* linting fix

* remove comments

* feedback fixes

* feedback

* simplifying

* remove team member within the same transaction

* fix a mistake with the error

* call the correct sql fction

* linting

* Access control: tests for team member endpoints (#44177)

* tests for team member endpoints

* clean up and fix the tests

* fixing tests take 2

* don't import enterprise test license

* don't import enterprise test license

* remove unused variable

Co-authored-by: gamab <gabi.mabs@gmail.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

pkg/api/http_server.go

@@ -13,10 +13,6 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/grafana/grafana/pkg/services/query"
-	"github.com/grafana/grafana/pkg/services/serviceaccounts"
-	"github.com/grafana/grafana/pkg/services/thumbs"
-
 	"github.com/grafana/grafana/pkg/api/routing"
 	httpstatic "github.com/grafana/grafana/pkg/api/static"
 	"github.com/grafana/grafana/pkg/bus"
@@ -32,6 +28,8 @@ import (
 	"github.com/grafana/grafana/pkg/plugins/plugincontext"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	acmiddleware "github.com/grafana/grafana/pkg/services/accesscontrol/middleware"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/resourceservices"
 	"github.com/grafana/grafana/pkg/services/alerting"
 	"github.com/grafana/grafana/pkg/services/cleanup"
 	"github.com/grafana/grafana/pkg/services/contexthandler"
@@ -46,15 +44,18 @@ import (
 	"github.com/grafana/grafana/pkg/services/login"
 	"github.com/grafana/grafana/pkg/services/ngalert"
 	"github.com/grafana/grafana/pkg/services/provisioning"
+	"github.com/grafana/grafana/pkg/services/query"
 	"github.com/grafana/grafana/pkg/services/quota"
 	"github.com/grafana/grafana/pkg/services/rendering"
 	"github.com/grafana/grafana/pkg/services/schemaloader"
 	"github.com/grafana/grafana/pkg/services/search"
 	"github.com/grafana/grafana/pkg/services/searchusers"
 	"github.com/grafana/grafana/pkg/services/secrets"
+	"github.com/grafana/grafana/pkg/services/serviceaccounts"
 	"github.com/grafana/grafana/pkg/services/shorturls"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/services/teamguardian"
+	"github.com/grafana/grafana/pkg/services/thumbs"
 	"github.com/grafana/grafana/pkg/services/updatechecker"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/util/errutil"
@@ -118,6 +119,7 @@ type HTTPServer struct {
 	teamGuardian              teamguardian.TeamGuardian
 	queryDataService          *query.Service
 	serviceAccountsService    serviceaccounts.Service
+	TeamPermissionsService    *resourcepermissions.Service
 }
 
 type ServerOptions struct {
@@ -142,7 +144,8 @@ func ProvideHTTPServer(opts ServerOptions, cfg *setting.Cfg, routeRegister routi
 	quotaService *quota.QuotaService, socialService social.Service, tracer tracing.Tracer,
 	encryptionService encryption.Internal, updateChecker *updatechecker.Service, searchUsersService searchusers.Service,
 	dataSourcesService *datasources.Service, secretsService secrets.Service, queryDataService *query.Service,
-	teamGuardian teamguardian.TeamGuardian, serviceaccountsService serviceaccounts.Service) (*HTTPServer, error) {
+	teamGuardian teamguardian.TeamGuardian, serviceaccountsService serviceaccounts.Service,
+	resourcePermissionServices *resourceservices.ResourceServices) (*HTTPServer, error) {
 	web.Env = cfg.Env
 	m := web.New()
 
@@ -196,6 +199,7 @@ func ProvideHTTPServer(opts ServerOptions, cfg *setting.Cfg, routeRegister routi
 		teamGuardian:              teamGuardian,
 		queryDataService:          queryDataService,
 		serviceAccountsService:    serviceaccountsService,
+		TeamPermissionsService:    resourcePermissionServices.GetTeamService(),
 	}
 	if hs.Listener != nil {
 		hs.log.Debug("Using provided listener")