Access control: Load permissions from memory and database (#42080)

* Load permission from both in memory and from database
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

pkg/services/accesscontrol/database/database_test.go

@@ -20,6 +20,7 @@ type getUserPermissionsTestCase struct {
 	userPermissions    []string
 	teamPermissions    []string
 	builtinPermissions []string
+	actions            []string
 	expected           int
 }
 
@@ -52,6 +53,26 @@ func TestAccessControlStore_GetUserPermissions(t *testing.T) {
 			builtinPermissions: []string{"5", "6"},
 			expected:           5,
 		},
+		{
+			desc:               "Should filter on actions",
+			orgID:              1,
+			role:               "",
+			userPermissions:    []string{"1", "2", "10"},
+			teamPermissions:    []string{"100", "2"},
+			builtinPermissions: []string{"5", "6"},
+			expected:           3,
+			actions:            []string{"dashboards:write"},
+		},
+		{
+			desc:               "Should return no permission when passing empty slice of actions",
+			orgID:              1,
+			role:               "Viewer",
+			userPermissions:    []string{"1", "2", "10"},
+			teamPermissions:    []string{"100", "2"},
+			builtinPermissions: []string{"5", "6"},
+			expected:           0,
+			actions:            []string{},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
@@ -61,7 +82,7 @@ func TestAccessControlStore_GetUserPermissions(t *testing.T) {
 
 			for _, id := range tt.userPermissions {
 				_, err := store.SetUserResourcePermission(context.Background(), tt.orgID, user.Id, accesscontrol.SetResourcePermissionCommand{
-					Actions:    []string{"dashboards:read"},
+					Actions:    []string{"dashboards:write"},
 					Resource:   "dashboards",
 					ResourceID: id,
 				}, nil)
@@ -97,9 +118,10 @@ func TestAccessControlStore_GetUserPermissions(t *testing.T) {
 			}
 
 			permissions, err := store.GetUserPermissions(context.Background(), accesscontrol.GetUserPermissionsQuery{
-				OrgID:  tt.orgID,
-				UserID: user.Id,
-				Roles:  roles,
+				OrgID:   tt.orgID,
+				UserID:  user.Id,
+				Roles:   roles,
+				Actions: tt.actions,
 			})
 
 			require.NoError(t, err)