RBAC: remove some IsDisabled checks (#69272)

* remove some access contorl IsDisabled() checks

* cleaning up tests

* update tests

* linting

pkg/api/accesscontrol.go

@@ -444,7 +444,7 @@ func (hs *HTTPServer) getAccessControlMetadata(c *contextmodel.ReqContext,
 // Context must contain permissions in the given org (see LoadPermissionsMiddleware or AuthorizeInOrgMiddleware)
 func (hs *HTTPServer) getMultiAccessControlMetadata(c *contextmodel.ReqContext,
 	orgID int64, prefix string, resourceIDs map[string]bool) map[string]ac.Metadata {
-	if hs.AccessControl.IsDisabled() || !c.QueryBool("accesscontrol") {
+	if !c.QueryBool("accesscontrol") {
 		return map[string]ac.Metadata{}
 	}
 

pkg/api/admin.go

@@ -68,10 +68,6 @@ func (hs *HTTPServer) AdminGetStats(c *contextmodel.ReqContext) response.Respons
 }
 
 func (hs *HTTPServer) getAuthorizedSettings(ctx context.Context, user *user.SignedInUser, bag setting.SettingsBag) (setting.SettingsBag, error) {
-	if hs.AccessControl.IsDisabled() {
-		return bag, nil
-	}
-
 	eval := func(scope string) (bool, error) {
 		return hs.AccessControl.Evaluate(ctx, user, ac.EvalPermission(ac.ActionSettingsRead, scope))
 	}
@@ -113,10 +109,6 @@ func (hs *HTTPServer) getAuthorizedSettings(ctx context.Context, user *user.Sign
 }
 
 func (hs *HTTPServer) getAuthorizedVerboseSettings(ctx context.Context, user *user.SignedInUser, bag setting.VerboseSettingsBag) (setting.VerboseSettingsBag, error) {
-	if hs.AccessControl.IsDisabled() {
-		return bag, nil
-	}
-
 	eval := func(scope string) (bool, error) {
 		return hs.AccessControl.Evaluate(ctx, user, ac.EvalPermission(ac.ActionSettingsRead, scope))
 	}

pkg/api/annotations.go

@@ -14,7 +14,6 @@ import (
 	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/guardian"
-	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/util"
 	"github.com/grafana/grafana/pkg/web"
@@ -390,41 +389,32 @@ func (hs *HTTPServer) MassDeleteAnnotations(c *contextmodel.ReqContext) response
 
 	// validations only for RBAC. A user can mass delete all annotations in a (dashboard + panel) or a specific annotation
 	// if has access to that dashboard.
-	if !hs.AccessControl.IsDisabled() {
-		var dashboardId int64
+	var dashboardId int64
 
-		if cmd.AnnotationId != 0 {
-			annotation, respErr := findAnnotationByID(c.Req.Context(), hs.annotationsRepo, cmd.AnnotationId, c.SignedInUser)
-			if respErr != nil {
-				return respErr
-			}
-			dashboardId = annotation.DashboardID
-			deleteParams = &annotations.DeleteParams{
-				OrgID: c.OrgID,
-				ID:    cmd.AnnotationId,
-			}
-		} else {
-			dashboardId = cmd.DashboardId
-			deleteParams = &annotations.DeleteParams{
-				OrgID:       c.OrgID,
-				DashboardID: cmd.DashboardId,
-				PanelID:     cmd.PanelId,
-			}
+	if cmd.AnnotationId != 0 {
+		annotation, respErr := findAnnotationByID(c.Req.Context(), hs.annotationsRepo, cmd.AnnotationId, c.SignedInUser)
+		if respErr != nil {
+			return respErr
 		}
-
-		canSave, err := hs.canMassDeleteAnnotations(c, dashboardId)
-		if err != nil || !canSave {
-			return dashboardGuardianResponse(err)
+		dashboardId = annotation.DashboardID
+		deleteParams = &annotations.DeleteParams{
+			OrgID: c.OrgID,
+			ID:    cmd.AnnotationId,
 		}
-	} else { // legacy permissions
+	} else {
+		dashboardId = cmd.DashboardId
 		deleteParams = &annotations.DeleteParams{
 			OrgID:       c.OrgID,
-			ID:          cmd.AnnotationId,
 			DashboardID: cmd.DashboardId,
 			PanelID:     cmd.PanelId,
 		}
 	}
 
+	canSave, err := hs.canMassDeleteAnnotations(c, dashboardId)
+	if err != nil || !canSave {
+		return dashboardGuardianResponse(err)
+	}
+
 	err = hs.annotationsRepo.Delete(c.Req.Context(), deleteParams)
 
 	if err != nil {
@@ -501,9 +491,6 @@ func (hs *HTTPServer) canSaveAnnotation(c *contextmodel.ReqContext, annotation *
 	if annotation.GetType() == annotations.Dashboard {
 		return canEditDashboard(c, annotation.DashboardID)
 	} else {
-		if hs.AccessControl.IsDisabled() {
-			return c.SignedInUser.HasRole(org.RoleEditor), nil
-		}
 		return true, nil
 	}
 }
@@ -609,21 +596,15 @@ func AnnotationTypeScopeResolver(annotationsRepo annotations.Repository) (string
 
 func (hs *HTTPServer) canCreateAnnotation(c *contextmodel.ReqContext, dashboardId int64) (bool, error) {
 	if dashboardId != 0 {
-		if !hs.AccessControl.IsDisabled() {
-			evaluator := accesscontrol.EvalPermission(accesscontrol.ActionAnnotationsCreate, accesscontrol.ScopeAnnotationsTypeDashboard)
-			if canSave, err := hs.AccessControl.Evaluate(c.Req.Context(), c.SignedInUser, evaluator); err != nil || !canSave {
-				return canSave, err
-			}
+		evaluator := accesscontrol.EvalPermission(accesscontrol.ActionAnnotationsCreate, accesscontrol.ScopeAnnotationsTypeDashboard)
+		if canSave, err := hs.AccessControl.Evaluate(c.Req.Context(), c.SignedInUser, evaluator); err != nil || !canSave {
+			return canSave, err
 		}
 
 		return canEditDashboard(c, dashboardId)
 	} else { // organization annotations
-		if !hs.AccessControl.IsDisabled() {
-			evaluator := accesscontrol.EvalPermission(accesscontrol.ActionAnnotationsCreate, accesscontrol.ScopeAnnotationsTypeOrganization)
-			return hs.AccessControl.Evaluate(c.Req.Context(), c.SignedInUser, evaluator)
-		} else {
-			return c.SignedInUser.HasRole(org.RoleEditor), nil
-		}
+		evaluator := accesscontrol.EvalPermission(accesscontrol.ActionAnnotationsCreate, accesscontrol.ScopeAnnotationsTypeOrganization)
+		return hs.AccessControl.Evaluate(c.Req.Context(), c.SignedInUser, evaluator)
 	}
 }
 

pkg/api/annotations_test.go

@@ -2,392 +2,24 @@ package api
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"net/http"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/grafana/pkg/api/dtos"
-	"github.com/grafana/grafana/pkg/api/response"
-	"github.com/grafana/grafana/pkg/api/routing"
-	"github.com/grafana/grafana/pkg/infra/db"
-	"github.com/grafana/grafana/pkg/infra/db/dbtest"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
 	"github.com/grafana/grafana/pkg/services/annotations"
 	"github.com/grafana/grafana/pkg/services/annotations/annotationstest"
-	contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
-	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/guardian"
-	"github.com/grafana/grafana/pkg/services/org"
-	"github.com/grafana/grafana/pkg/services/team/teamtest"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/web/webtest"
 )
 
-func TestAnnotationsAPIEndpoint(t *testing.T) {
-	hs := setupSimpleHTTPServer(nil)
-	store := db.InitTestDB(t)
-	store.Cfg = hs.Cfg
-	hs.SQLStore = store
-
-	t.Run("Given an annotation without a dashboard ID", func(t *testing.T) {
-		cmd := dtos.PostAnnotationsCmd{
-			Time: 1000,
-			Text: "annotation text",
-			Tags: []string{"tag1", "tag2"},
-		}
-
-		updateCmd := dtos.UpdateAnnotationsCmd{
-			Time: 1000,
-			Text: "annotation text",
-			Tags: []string{"tag1", "tag2"},
-		}
-
-		patchCmd := dtos.PatchAnnotationsCmd{
-			Time: 1000,
-			Text: "annotation text",
-			Tags: []string{"tag1", "tag2"},
-		}
-
-		t.Run("When user is an Org Viewer", func(t *testing.T) {
-			role := org.RoleViewer
-			t.Run("Should not be allowed to save an annotation", func(t *testing.T) {
-				postAnnotationScenario(t, "When calling POST on", "/api/annotations", "/api/annotations", role,
-					cmd, store, nil, func(sc *scenarioContext) {
-						sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 403, sc.resp.Code)
-					})
-
-				putAnnotationScenario(t, "When calling PUT on", "/api/annotations/1", "/api/annotations/:annotationId",
-					role, updateCmd, func(sc *scenarioContext) {
-						sc.fakeReqWithParams("PUT", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 403, sc.resp.Code)
-					})
-
-				patchAnnotationScenario(t, "When calling PATCH on", "/api/annotations/1",
-					"/api/annotations/:annotationId", role, patchCmd, func(sc *scenarioContext) {
-						sc.fakeReqWithParams("PATCH", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 403, sc.resp.Code)
-					})
-
-				mock := dbtest.NewFakeDB()
-				loggedInUserScenarioWithRole(t, "When calling DELETE on", "DELETE", "/api/annotations/1",
-					"/api/annotations/:annotationId", role, func(sc *scenarioContext) {
-						sc.handlerFunc = hs.DeleteAnnotationByID
-						sc.fakeReqWithParams("DELETE", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 403, sc.resp.Code)
-					}, mock)
-			})
-		})
-
-		t.Run("When user is an Org Editor", func(t *testing.T) {
-			role := org.RoleEditor
-			t.Run("Should be able to save an annotation", func(t *testing.T) {
-				postAnnotationScenario(t, "When calling POST on", "/api/annotations", "/api/annotations", role,
-					cmd, store, nil, func(sc *scenarioContext) {
-						sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 200, sc.resp.Code)
-					})
-
-				putAnnotationScenario(t, "When calling PUT on", "/api/annotations/1", "/api/annotations/:annotationId", role, updateCmd, func(sc *scenarioContext) {
-					sc.fakeReqWithParams("PUT", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-
-				patchAnnotationScenario(t, "When calling PATCH on", "/api/annotations/1", "/api/annotations/:annotationId", role, patchCmd, func(sc *scenarioContext) {
-					sc.fakeReqWithParams("PATCH", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-				mock := dbtest.NewFakeDB()
-				loggedInUserScenarioWithRole(t, "When calling DELETE on", "DELETE", "/api/annotations/1",
-					"/api/annotations/:annotationId", role, func(sc *scenarioContext) {
-						sc.handlerFunc = hs.DeleteAnnotationByID
-						sc.fakeReqWithParams("DELETE", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 200, sc.resp.Code)
-					}, mock)
-			})
-		})
-	})
-
-	t.Run("Given an annotation with a dashboard ID and the dashboard does not have an ACL", func(t *testing.T) {
-		cmd := dtos.PostAnnotationsCmd{
-			Time:        1000,
-			Text:        "annotation text",
-			Tags:        []string{"tag1", "tag2"},
-			DashboardId: 1,
-			PanelId:     1,
-		}
-
-		dashboardUIDCmd := dtos.PostAnnotationsCmd{
-			Time:         1000,
-			Text:         "annotation text",
-			Tags:         []string{"tag1", "tag2"},
-			DashboardUID: "home",
-			PanelId:      1,
-		}
-
-		updateCmd := dtos.UpdateAnnotationsCmd{
-			Time: 1000,
-			Text: "annotation text",
-			Tags: []string{"tag1", "tag2"},
-			Id:   1,
-		}
-
-		patchCmd := dtos.PatchAnnotationsCmd{
-			Time: 8000,
-			Text: "annotation text 50",
-			Tags: []string{"foo", "bar"},
-			Id:   1,
-		}
-
-		deleteCmd := dtos.MassDeleteAnnotationsCmd{
-			DashboardId: 1,
-			PanelId:     1,
-		}
-
-		deleteWithDashboardUIDCmd := dtos.MassDeleteAnnotationsCmd{
-			DashboardUID: "home",
-			PanelId:      1,
-		}
-
-		t.Run("When user is an Org Viewer", func(t *testing.T) {
-			role := org.RoleViewer
-			dashSvc := dashboards.NewFakeDashboardService(t)
-			t.Run("Should not be allowed to save an annotation", func(t *testing.T) {
-				postAnnotationScenario(t, "When calling POST on", "/api/annotations", "/api/annotations", role, cmd, store, dashSvc, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 403, sc.resp.Code)
-				})
-
-				putAnnotationScenario(t, "When calling PUT on", "/api/annotations/1", "/api/annotations/:annotationId", role, updateCmd, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("PUT", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 403, sc.resp.Code)
-				})
-
-				patchAnnotationScenario(t, "When calling PATCH on", "/api/annotations/1", "/api/annotations/:annotationId", role, patchCmd, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("PATCH", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 403, sc.resp.Code)
-				})
-				mock := dbtest.NewFakeDB()
-				loggedInUserScenarioWithRole(t, "When calling DELETE on", "DELETE", "/api/annotations/1",
-					"/api/annotations/:annotationId", role, func(sc *scenarioContext) {
-						setUpACL()
-						sc.handlerFunc = hs.DeleteAnnotationByID
-						sc.fakeReqWithParams("DELETE", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 403, sc.resp.Code)
-					}, mock)
-			})
-		})
-
-		t.Run("When user is an Org Editor", func(t *testing.T) {
-			role := org.RoleEditor
-			t.Run("Should be able to save an annotation", func(t *testing.T) {
-				dashSvc := dashboards.NewFakeDashboardService(t)
-				postAnnotationScenario(t, "When calling POST on", "/api/annotations", "/api/annotations", role, cmd, store, dashSvc, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-
-				putAnnotationScenario(t, "When calling PUT on", "/api/annotations/1", "/api/annotations/:annotationId", role, updateCmd, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("PUT", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-
-				patchAnnotationScenario(t, "When calling PATCH on", "/api/annotations/1", "/api/annotations/:annotationId", role, patchCmd, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("PATCH", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-				mock := dbtest.NewFakeDB()
-				loggedInUserScenarioWithRole(t, "When calling DELETE on", "DELETE", "/api/annotations/1",
-					"/api/annotations/:annotationId", role, func(sc *scenarioContext) {
-						setUpACL()
-						sc.handlerFunc = hs.DeleteAnnotationByID
-						sc.fakeReqWithParams("DELETE", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 200, sc.resp.Code)
-					}, mock)
-			})
-		})
-
-		t.Run("When user is an Admin", func(t *testing.T) {
-			role := org.RoleAdmin
-
-			mockStore := dbtest.NewFakeDB()
-
-			t.Run("Should be able to do anything", func(t *testing.T) {
-				dashSvc := dashboards.NewFakeDashboardService(t)
-				result := &dashboards.Dashboard{}
-				dashSvc.On("GetDashboard", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardQuery")).Return(result, nil)
-				postAnnotationScenario(t, "When calling POST on", "/api/annotations", "/api/annotations", role, cmd, store, dashSvc, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-
-				postAnnotationScenario(t, "When calling POST on", "/api/annotations", "/api/annotations", role, dashboardUIDCmd, mockStore, dashSvc, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-
-					dashSvc.AssertCalled(t, "GetDashboard", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardQuery"))
-				})
-
-				putAnnotationScenario(t, "When calling PUT on", "/api/annotations/1", "/api/annotations/:annotationId", role, updateCmd, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("PUT", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-
-				patchAnnotationScenario(t, "When calling PATCH on", "/api/annotations/1", "/api/annotations/:annotationId", role, patchCmd, func(sc *scenarioContext) {
-					setUpACL()
-					sc.fakeReqWithParams("PATCH", sc.url, map[string]string{}).exec()
-					assert.Equal(t, 200, sc.resp.Code)
-				})
-
-				deleteAnnotationsScenario(t, "When calling POST on", "/api/annotations/mass-delete",
-					"/api/annotations/mass-delete", role, deleteCmd, store, nil, func(sc *scenarioContext) {
-						setUpACL()
-						sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 200, sc.resp.Code)
-					})
-
-				dashSvc = dashboards.NewFakeDashboardService(t)
-				result = &dashboards.Dashboard{
-					ID:  1,
-					UID: deleteWithDashboardUIDCmd.DashboardUID,
-				}
-				dashSvc.On("GetDashboard", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardQuery")).Run(func(args mock.Arguments) {
-					q := args.Get(1).(*dashboards.GetDashboardQuery)
-					result = &dashboards.Dashboard{
-						ID:  q.ID,
-						UID: deleteWithDashboardUIDCmd.DashboardUID,
-					}
-				}).Return(result, nil)
-				deleteAnnotationsScenario(t, "When calling POST with dashboardUID on", "/api/annotations/mass-delete",
-					"/api/annotations/mass-delete", role, deleteWithDashboardUIDCmd, mockStore, dashSvc, func(sc *scenarioContext) {
-						setUpACL()
-						sc.fakeReqWithParams("POST", sc.url, map[string]string{}).exec()
-						assert.Equal(t, 200, sc.resp.Code)
-						dashSvc.AssertCalled(t, "GetDashboard", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardQuery"))
-					})
-			})
-		})
-	})
-}
-
-func postAnnotationScenario(t *testing.T, desc string, url string, routePattern string, role org.RoleType,
-	cmd dtos.PostAnnotationsCmd, store db.DB, dashSvc *dashboards.FakeDashboardService, fn scenarioFunc) {
-	t.Run(fmt.Sprintf("%s %s", desc, url), func(t *testing.T) {
-		hs := setupSimpleHTTPServer(nil)
-		hs.SQLStore = store
-		hs.DashboardService = dashSvc
-
-		sc := setupScenarioContext(t, url)
-		sc.dashboardService = dashSvc
-
-		sc.defaultHandler = routing.Wrap(func(c *contextmodel.ReqContext) response.Response {
-			c.Req.Body = mockRequestBody(cmd)
-			c.Req.Header.Add("Content-Type", "application/json")
-			sc.context = c
-			sc.context.UserID = testUserID
-			sc.context.OrgID = testOrgID
-			sc.context.OrgRole = role
-			return hs.PostAnnotation(c)
-		})
-
-		sc.m.Post(routePattern, sc.defaultHandler)
-		fn(sc)
-	})
-}
-
-func putAnnotationScenario(t *testing.T, desc string, url string, routePattern string, role org.RoleType,
-	cmd dtos.UpdateAnnotationsCmd, fn scenarioFunc) {
-	t.Run(fmt.Sprintf("%s %s", desc, url), func(t *testing.T) {
-		hs := setupSimpleHTTPServer(nil)
-		store := db.InitTestDB(t)
-		store.Cfg = hs.Cfg
-		hs.SQLStore = store
-
-		sc := setupScenarioContext(t, url)
-		sc.defaultHandler = routing.Wrap(func(c *contextmodel.ReqContext) response.Response {
-			c.Req.Body = mockRequestBody(cmd)
-			c.Req.Header.Add("Content-Type", "application/json")
-			sc.context = c
-			sc.context.UserID = testUserID
-			sc.context.OrgID = testOrgID
-			sc.context.OrgRole = role
-
-			return hs.UpdateAnnotation(c)
-		})
-
-		sc.m.Put(routePattern, sc.defaultHandler)
-
-		fn(sc)
-	})
-}
-
-func patchAnnotationScenario(t *testing.T, desc string, url string, routePattern string, role org.RoleType, cmd dtos.PatchAnnotationsCmd, fn scenarioFunc) {
-	t.Run(fmt.Sprintf("%s %s", desc, url), func(t *testing.T) {
-		hs := setupSimpleHTTPServer(nil)
-		store := db.InitTestDB(t)
-		store.Cfg = hs.Cfg
-		hs.SQLStore = store
-
-		sc := setupScenarioContext(t, url)
-		sc.defaultHandler = routing.Wrap(func(c *contextmodel.ReqContext) response.Response {
-			c.Req.Body = mockRequestBody(cmd)
-			c.Req.Header.Add("Content-Type", "application/json")
-			sc.context = c
-			sc.context.UserID = testUserID
-			sc.context.OrgID = testOrgID
-			sc.context.OrgRole = role
-
-			return hs.PatchAnnotation(c)
-		})
-
-		sc.m.Patch(routePattern, sc.defaultHandler)
-
-		fn(sc)
-	})
-}
-
-func deleteAnnotationsScenario(t *testing.T, desc string, url string, routePattern string, role org.RoleType,
-	cmd dtos.MassDeleteAnnotationsCmd, store db.DB, dashSvc dashboards.DashboardService, fn scenarioFunc) {
-	t.Run(fmt.Sprintf("%s %s", desc, url), func(t *testing.T) {
-		hs := setupSimpleHTTPServer(nil)
-		hs.SQLStore = store
-		hs.DashboardService = dashSvc
-
-		sc := setupScenarioContext(t, url)
-		sc.defaultHandler = routing.Wrap(func(c *contextmodel.ReqContext) response.Response {
-			c.Req.Body = mockRequestBody(cmd)
-			c.Req.Header.Add("Content-Type", "application/json")
-			sc.context = c
-			sc.context.UserID = testUserID
-			sc.context.OrgID = testOrgID
-			sc.context.OrgRole = role
-
-			return hs.MassDeleteAnnotations(c)
-		})
-
-		sc.m.Post(routePattern, sc.defaultHandler)
-
-		fn(sc)
-	})
-}
-
-func TestAPI_Annotations_AccessControl(t *testing.T) {
+func TestAPI_Annotations(t *testing.T) {
 	type testCase struct {
 		desc         string
 		path         string
@@ -674,32 +306,6 @@ func TestService_AnnotationTypeScopeResolver(t *testing.T) {
 	}
 }
 
-func setUpACL() {
-	viewerRole := org.RoleViewer
-	editorRole := org.RoleEditor
-	store := dbtest.NewFakeDB()
-	teamSvc := &teamtest.FakeService{}
-	dashSvc := &dashboards.FakeDashboardService{}
-	qResult := []*dashboards.DashboardACLInfoDTO{
-		{Role: &viewerRole, Permission: dashboards.PERMISSION_VIEW},
-		{Role: &editorRole, Permission: dashboards.PERMISSION_EDIT},
-	}
-	dashSvc.On("GetDashboardACLInfoList", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardACLInfoListQuery")).Run(func(args mock.Arguments) {
-		// q := args.Get(1).(*dashboards.GetDashboardACLInfoListQuery)
-
-	}).Return(qResult, nil)
-	var result *dashboards.Dashboard
-	dashSvc.On("GetDashboard", mock.Anything, mock.AnythingOfType("*dashboards.GetDashboardQuery")).Run(func(args mock.Arguments) {
-		q := args.Get(1).(*dashboards.GetDashboardQuery)
-		result = &dashboards.Dashboard{
-			ID:  q.ID,
-			UID: q.UID,
-		}
-	}).Return(result, nil)
-
-	guardian.InitLegacyGuardian(setting.NewCfg(), store, dashSvc, teamSvc)
-}
-
 func setUpRBACGuardian(t *testing.T) {
 	origNewGuardian := guardian.New
 	t.Cleanup(func() {

pkg/api/common_test.go

@@ -177,7 +177,6 @@ type scenarioContext struct {
 	authInfoService         *logintest.AuthInfoServiceFake
 	dashboardVersionService dashver.Service
 	userService             user.Service
-	dashboardService        dashboards.DashboardService
 }
 
 func (sc *scenarioContext) exec() {

pkg/api/index.go

@@ -135,15 +135,13 @@ func (hs *HTTPServer) setIndexViewData(c *contextmodel.ReqContext) (*dtos.IndexV
 		data.CSPContent = middleware.ReplacePolicyVariables(hs.Cfg.CSPTemplate, appURL, c.RequestNonce)
 	}
 
-	if !hs.AccessControl.IsDisabled() {
-		userPermissions, err := hs.accesscontrolService.GetUserPermissions(c.Req.Context(), c.SignedInUser, ac.Options{ReloadCache: false})
-		if err != nil {
-			return nil, err
-		}
-
-		data.User.Permissions = ac.BuildPermissionsMap(userPermissions)
+	userPermissions, err := hs.accesscontrolService.GetUserPermissions(c.Req.Context(), c.SignedInUser, ac.Options{ReloadCache: false})
+	if err != nil {
+		return nil, err
 	}
 
+	data.User.Permissions = ac.BuildPermissionsMap(userPermissions)
+
 	if setting.DisableGravatar {
 		data.User.GravatarUrl = hs.Cfg.AppSubURL + "/public/img/user_profile.png"
 	}