Access Control: Refactor scope resolvers with support to resolve into several scopes (#48202)

* Refactor Scope resolver to support resolving into several scopes

* Change permission evaluator to match at least one of passed scopes

pkg/services/accesscontrol/mock/mock.go

@@ -45,9 +45,9 @@ type Mock struct {
 	DeclareFixedRolesFunc              func(...accesscontrol.RoleRegistration) error
 	GetUserBuiltInRolesFunc            func(user *models.SignedInUser) []string
 	RegisterFixedRolesFunc             func() error
-	RegisterAttributeScopeResolverFunc func(string, accesscontrol.AttributeScopeResolveFunc)
+	RegisterScopeAttributeResolverFunc func(string, accesscontrol.ScopeAttributeResolver)
 
-	scopeResolver accesscontrol.ScopeResolver
+	scopeResolvers accesscontrol.ScopeResolvers
 }
 
 // Ensure the mock stays in line with the interface
@@ -55,11 +55,11 @@ var _ fullAccessControl = New()
 
 func New() *Mock {
 	mock := &Mock{
-		Calls:         Calls{},
-		disabled:      false,
-		permissions:   []*accesscontrol.Permission{},
-		builtInRoles:  []string{},
-		scopeResolver: accesscontrol.NewScopeResolver(),
+		Calls:          Calls{},
+		disabled:       false,
+		permissions:    []*accesscontrol.Permission{},
+		builtInRoles:   []string{},
+		scopeResolvers: accesscontrol.NewScopeResolvers(),
 	}
 
 	return mock
@@ -98,7 +98,7 @@ func (m *Mock) Evaluate(ctx context.Context, user *models.SignedInUser, evaluato
 		return false, err
 	}
 
-	attributeMutator := m.scopeResolver.GetResolveAttributeScopeMutator(user.OrgId)
+	attributeMutator := m.scopeResolvers.GetScopeAttributeMutator(user.OrgId)
 	resolvedEvaluator, err := evaluator.MutateScopes(ctx, attributeMutator)
 	if err != nil {
 		return false, err
@@ -178,13 +178,11 @@ func (m *Mock) RegisterFixedRoles(ctx context.Context) error {
 	return nil
 }
 
-// RegisterAttributeScopeResolver allows the caller to register a scope resolver for a
-// specific scope prefix (ex: datasources:name:)
-func (m *Mock) RegisterAttributeScopeResolver(scopePrefix string, resolver accesscontrol.AttributeScopeResolveFunc) {
-	m.scopeResolver.AddAttributeResolver(scopePrefix, resolver)
+func (m *Mock) RegisterScopeAttributeResolver(scopePrefix string, resolver accesscontrol.ScopeAttributeResolver) {
+	m.scopeResolvers.AddScopeAttributeResolver(scopePrefix, resolver)
 	m.Calls.RegisterAttributeScopeResolver = append(m.Calls.RegisterAttributeScopeResolver, []struct{}{})
 	// Use override if provided
-	if m.RegisterAttributeScopeResolverFunc != nil {
-		m.RegisterAttributeScopeResolverFunc(scopePrefix, resolver)
+	if m.RegisterScopeAttributeResolverFunc != nil {
+		m.RegisterScopeAttributeResolverFunc(scopePrefix, resolver)
 	}
 }