From f44bc0dd6b0a80143fb27ed0f712d28c87b77a6a Mon Sep 17 00:00:00 2001
From: Ieva <ieva.vasiljeva@grafana.com>
Date: Tue, 17 Jan 2023 09:58:40 +0000
Subject: [PATCH] RBAC: use scope reduction for user permission listing
 (#61583)

use scope reduction for user permission listing
---
 .../accesscontrol/accesscontrol_test.go       | 21 +++++++++++++++++++
 pkg/services/accesscontrol/api/api.go         |  4 ++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/pkg/services/accesscontrol/accesscontrol_test.go b/pkg/services/accesscontrol/accesscontrol_test.go
index 9d20738441a..6d8afd673da 100644
--- a/pkg/services/accesscontrol/accesscontrol_test.go
+++ b/pkg/services/accesscontrol/accesscontrol_test.go
@@ -42,6 +42,17 @@ func TestReduce(t *testing.T) {
 				"teams:write": {"teams:id:1"},
 			},
 		},
+		{
+			name: "specific permissions with repeated scope",
+			ps: []Permission{
+				{Action: "teams:read", Scope: "teams:id:1"},
+				{Action: "teams:read", Scope: "teams:id:2"},
+				{Action: "teams:read", Scope: "teams:id:1"},
+			},
+			want: map[string][]string{
+				"teams:read": {"teams:id:1", "teams:id:2"},
+			},
+		},
 		{
 			name: "wildcard permission",
 			ps: []Permission{
@@ -88,6 +99,16 @@ func TestReduce(t *testing.T) {
 				"dashboards:read": {"*"},
 			},
 		},
+		{
+			name: "non-wilcard scopes with * in them",
+			ps: []Permission{
+				{Action: "dashboards:read", Scope: "dashboards:uid:123"},
+				{Action: "dashboards:read", Scope: "dashboards:uid:1*"},
+			},
+			want: map[string][]string{
+				"dashboards:read": {"dashboards:uid:123", "dashboards:uid:1*"},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/pkg/services/accesscontrol/api/api.go b/pkg/services/accesscontrol/api/api.go
index eadfaf0a028..a3d279e103f 100644
--- a/pkg/services/accesscontrol/api/api.go
+++ b/pkg/services/accesscontrol/api/api.go
@@ -91,7 +91,7 @@ func (api *AccessControlAPI) searchUsersPermissions(c *models.ReqContext) respon
 
 	permsByAction := map[int64]map[string][]string{}
 	for userID, userPerms := range permissions {
-		permsByAction[userID] = ac.GroupScopesByAction(userPerms)
+		permsByAction[userID] = ac.Reduce(userPerms)
 	}
 
 	return response.JSON(http.StatusOK, permsByAction)
@@ -121,5 +121,5 @@ func (api *AccessControlAPI) searchUserPermissions(c *models.ReqContext) respons
 		response.Error(http.StatusInternalServerError, "could not search user permissions", err)
 	}
 
-	return response.JSON(http.StatusOK, ac.GroupScopesByAction(permissions))
+	return response.JSON(http.StatusOK, ac.Reduce(permissions))
 }