Authz: Remove legacy API Key permissions (#110860)

* remove API key roles

* remove API key gen

* remove frontend and doc mentions

* restore legacy keygen

* restore codeowners

* prettier

* update swagger

* remove permissions including apikeys

* add migrator for removing deprecated permissions

* add tracing

* update openapi3

* simplify migrator for now

* accesscontrol/migrator: remove batching for deprecated permissions deletion

pkg/services/accesscontrol/migrator/migrator.go

@@ -4,8 +4,11 @@ import (
 	"context"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/infra/tracing"
 	ac "github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/services/sqlstore/session"
@@ -120,6 +123,90 @@ func batch(count, batchSize int, eachFn func(start, end int) error) error {
 	return nil
 }
 
+// MigrateRemoveDeprecatedPermissions removes deprecated permissions from the database
+func MigrateRemoveDeprecatedPermissions(db db.DB, log log.Logger) error {
+	ctx := context.Background()
+	ctx, span := tracing.Start(ctx, "migrator.removeDeprecatedPermissions",
+		attribute.String("migration.type", "removeDeprecatedPermissions"))
+	defer span.End()
+
+	t := time.Now()
+
+	// Define the deprecated permissions to remove
+	deprecatedPermissions := []string{
+		"apikeys:", // remove this line in 2026/03, no apikeys:read/write/create should exist by then and downgrade/upgrade scenarios are less likely
+	}
+	if len(deprecatedPermissions) == 0 {
+		span.SetAttributes(attribute.Bool("migration.skipped", true))
+		log.Debug("No deprecated permissions to remove", "migration", "removeDeprecatedPermissions")
+		return nil
+	}
+
+	span.SetAttributes(attribute.Int("deprecated.patterns.count", len(deprecatedPermissions)))
+	log.Info("Starting migration to remove deprecated permissions", "migration", "removeDeprecatedPermissions")
+
+	// Find and remove permissions matching the deprecated patterns
+	var totalRemoved int
+	for _, permPattern := range deprecatedPermissions {
+		patternCtx, patternSpan := tracing.Start(ctx, "migrator.removeDeprecatedPermissions.pattern",
+			attribute.String("pattern", permPattern))
+		patternSpan.SetAttributes(attribute.String("migration.type", "removeDeprecatedPermissions"))
+
+		var permissions []ac.Permission
+		if errFind := db.WithTransactionalDbSession(patternCtx, func(sess *sqlstore.DBSession) error {
+			return sess.SQL("SELECT id FROM permission WHERE action LIKE ?", permPattern+"%").Find(&permissions)
+		}); errFind != nil {
+			log.Error("Could not search for deprecated permissions to remove", "migration", "removeDeprecatedPermissions", "pattern", permPattern, "error", errFind)
+			patternSpan.RecordError(errFind)
+			patternSpan.End()
+			return errFind
+		}
+
+		patternSpan.SetAttributes(attribute.Int("permissions.found", len(permissions)))
+
+		if len(permissions) == 0 {
+			log.Debug("No permissions found for pattern", "migration", "removeDeprecatedPermissions", "pattern", permPattern)
+			patternSpan.End()
+			continue
+		}
+
+		// Remove permissions by the exact IDs we found
+		if errDel := db.GetSqlxSession().WithTransaction(patternCtx, func(tx *session.SessionTx) error {
+			delQuery := "DELETE FROM permission WHERE id IN ("
+			delArgs := make([]any, 0, len(permissions))
+			for i := range permissions {
+				delQuery += "?,"
+				delArgs = append(delArgs, permissions[i].ID)
+			}
+			// close the IN clause
+			delQuery = delQuery[:len(delQuery)-1] + ")"
+
+			_, err := tx.Exec(patternCtx, delQuery, delArgs...)
+			return err
+		}); errDel != nil {
+			log.Error("Error deleting deprecated permissions", "migration", "removeDeprecatedPermissions", "pattern", permPattern, "error", errDel)
+			patternSpan.RecordError(errDel)
+			patternSpan.End()
+			return errDel
+		}
+
+		// We previously fetched matching permissions; count them as removed
+		totalRemoved += len(permissions)
+		patternSpan.SetAttributes(attribute.Int("permissions.removed", len(permissions)))
+		log.Info("Removed deprecated permissions for pattern", "migration", "removeDeprecatedPermissions", "pattern", permPattern, "count", len(permissions))
+
+		patternSpan.End()
+	}
+
+	span.SetAttributes(
+		attribute.Int("permissions.total.removed", totalRemoved),
+		attribute.Int("migration.duration.ms", int(time.Since(t).Milliseconds())),
+	)
+
+	log.Info("Completed migration to remove deprecated permissions", "migration", "removeDeprecatedPermissions", "totalRemoved", totalRemoved, "duration", time.Since(t))
+	return nil
+}
+
 func trimToMaxLen(s string, maxLen int) string {
 	if len(s) > maxLen {
 		return s[:maxLen]