RBAC: Remove dashboard guardians pt 2 (#102556)

* remove NewByDashboard guardian

* remove unused authorizer

* more cleanup

* simplify canAdmin evaluation

pkg/services/guardian/guardian.go

@@ -7,7 +7,6 @@ import (
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/metrics"
-	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/folder"
 )
 
@@ -34,12 +33,6 @@ var New = func(ctx context.Context, dashId int64, orgId int64, user identity.Req
 	panic("no guardian factory implementation provided")
 }
 
-// NewByDashboard factory for creating a new dashboard guardian instance
-// When using access control this function is replaced on startup and the AccessControlDashboardGuardian is returned
-var NewByDashboard = func(ctx context.Context, dash *dashboards.Dashboard, orgId int64, user identity.Requester) (DashboardGuardian, error) {
-	panic("no guardian factory implementation provided")
-}
-
 // NewByFolderUID factory for creating a new folder guardian instance
 // When using access control this function is replaced on startup and the AccessControlDashboardGuardian is returned
 var NewByFolderUID = func(ctx context.Context, folderUID string, orgId int64, user identity.Requester) (DashboardGuardian, error) {
@@ -108,13 +101,6 @@ func MockDashboardGuardian(mock *FakeDashboardGuardian) {
 		mock.User = user
 		return mock, nil
 	}
-	NewByDashboard = func(_ context.Context, dash *dashboards.Dashboard, orgId int64, user identity.Requester) (DashboardGuardian, error) {
-		mock.OrgID = orgId
-		mock.DashUID = dash.UID
-		mock.DashID = dash.ID
-		mock.User = user
-		return mock, nil
-	}
 
 	NewByFolderUID = func(_ context.Context, folderUID string, orgId int64, user identity.Requester) (DashboardGuardian, error) {
 		mock.OrgID = orgId

pkg/services/guardian/provider.go

@@ -31,10 +31,6 @@ func InitAccessControlGuardian(
 		return NewAccessControlDashboardGuardian(ctx, cfg, dashId, user, ac, dashboardService, folderService, logger)
 	}
 
-	NewByDashboard = func(ctx context.Context, dash *dashboards.Dashboard, orgId int64, user identity.Requester) (DashboardGuardian, error) {
-		return NewAccessControlDashboardGuardianByDashboard(ctx, cfg, dash, user, ac, dashboardService, folderService, logger)
-	}
-
 	NewByFolderUID = func(ctx context.Context, folderUID string, orgId int64, user identity.Requester) (DashboardGuardian, error) {
 		return NewAccessControlFolderGuardianByUID(ctx, cfg, folderUID, user, ac, dashboardService, folderService)
 	}

pkg/services/live/features/dashboard.go

@@ -10,8 +10,8 @@ import (
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/db"
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/dashboards"
-	"github.com/grafana/grafana/pkg/services/guardian"
 	"github.com/grafana/grafana/pkg/services/live/model"
 )
 
@@ -63,6 +63,7 @@ type DashboardHandler struct {
 	ClientCount      model.ChannelClientCount
 	Store            db.DB
 	DashboardService dashboards.DashboardService
+	AccessControl    accesscontrol.AccessControl
 }
 
 // GetHandlerForPath called on init
@@ -77,20 +78,17 @@ func (h *DashboardHandler) OnSubscribe(ctx context.Context, user identity.Reques
 	// make sure can view this dashboard
 	if len(parts) == 2 && parts[0] == "uid" {
 		query := dashboards.GetDashboardQuery{UID: parts[1], OrgID: user.GetOrgID()}
-		queryResult, err := h.DashboardService.GetDashboard(ctx, &query)
+		_, err := h.DashboardService.GetDashboard(ctx, &query)
 		if err != nil {
 			logger.Error("Error getting dashboard", "query", query, "error", err)
 			return model.SubscribeReply{}, backend.SubscribeStreamStatusNotFound, nil
 		}
 
-		dash := queryResult
-		guard, err := guardian.NewByDashboard(ctx, dash, user.GetOrgID(), user)
-		if err != nil {
+		evaluator := accesscontrol.EvalPermission(dashboards.ActionDashboardsRead, dashboards.ScopeDashboardsProvider.GetResourceScopeUID(parts[1]))
+		canView, err := h.AccessControl.Evaluate(ctx, user, evaluator)
+		if err != nil || !canView {
 			return model.SubscribeReply{}, backend.SubscribeStreamStatusPermissionDenied, err
 		}
-		if canView, err := guard.CanView(); err != nil || !canView {
-			return model.SubscribeReply{}, backend.SubscribeStreamStatusPermissionDenied, nil
-		}
 
 		return model.SubscribeReply{
 			Presence:  true,
@@ -119,19 +117,14 @@ func (h *DashboardHandler) OnPublish(ctx context.Context, requester identity.Req
 			return model.PublishReply{}, backend.PublishStreamStatusNotFound, fmt.Errorf("ignore???")
 		}
 		query := dashboards.GetDashboardQuery{UID: parts[1], OrgID: requester.GetOrgID()}
-		queryResult, err := h.DashboardService.GetDashboard(ctx, &query)
+		_, err = h.DashboardService.GetDashboard(ctx, &query)
 		if err != nil {
 			logger.Error("Unknown dashboard", "query", query)
 			return model.PublishReply{}, backend.PublishStreamStatusNotFound, nil
 		}
 
-		guard, err := guardian.NewByDashboard(ctx, queryResult, requester.GetOrgID(), requester)
-		if err != nil {
-			logger.Error("Failed to create guardian", "err", err)
-			return model.PublishReply{}, backend.PublishStreamStatusNotFound, fmt.Errorf("internal error")
-		}
-
-		canEdit, err := guard.CanEdit()
+		evaluator := accesscontrol.EvalPermission(dashboards.ActionDashboardsWrite, dashboards.ScopeDashboardsProvider.GetResourceScopeUID(parts[1]))
+		canEdit, err := h.AccessControl.Evaluate(ctx, requester, evaluator)
 		if err != nil {
 			return model.PublishReply{}, backend.PublishStreamStatusNotFound, fmt.Errorf("internal error")
 		}

pkg/services/live/live.go

@@ -184,6 +184,7 @@ func ProvideService(plugCtxProvider *plugincontext.Provider, cfg *setting.Cfg, r
 		ClientCount:      g.ClientCount,
 		Store:            sqlStore,
 		DashboardService: dashboardService,
+		AccessControl:    accessControl,
 	}
 	g.storage = database.NewStorage(g.SQLStore, g.CacheService)
 	g.GrafanaScope.Dashboards = dash