Access control: Filter users and teams by read permissions (#45968)

* pass signed in user and filter based on permissions

pkg/services/accesscontrol/database/resource_permissions.go

@@ -359,16 +359,28 @@ func (s *AccessControlStore) getResourcesPermissions(sess *sqlstore.DBSession, o
 		args = append(args, a)
 	}
 
-	// Need args x3 due to union
 	initialLength := len(args)
-	args = append(args, args[:initialLength]...)
-	args = append(args, args[:initialLength]...)
 
-	user := userSelect + userFrom + where
-	team := teamSelect + teamFrom + where
+	userFilter, err := accesscontrol.Filter(context.Background(), "u.id", "users", accesscontrol.ActionOrgUsersRead, query.User)
+	if err != nil {
+		return nil, err
+	}
+	user := userSelect + userFrom + where + " AND " + userFilter.Where
+	args = append(args, userFilter.Args...)
+
+	teamFilter, err := accesscontrol.Filter(context.Background(), "t.id", "teams", accesscontrol.ActionTeamsRead, query.User)
+	if err != nil {
+		return nil, err
+	}
+
+	team := teamSelect + teamFrom + where + " AND " + teamFilter.Where
+	args = append(args, args[:initialLength]...)
+	args = append(args, teamFilter.Args...)
+
 	builtin := builtinSelect + builtinFrom + where
-	sql := user + "UNION" + team + "UNION" + builtin
+	args = append(args, args[:initialLength]...)
 
+	sql := user + " UNION " + team + " UNION " + builtin
 	queryResults := make([]flatResourcePermission, 0)
 	if err := sess.SQL(sql, args...).Find(&queryResults); err != nil {
 		return nil, err

pkg/services/accesscontrol/database/resource_permissions_test.go

@@ -313,6 +313,7 @@ func TestAccessControlStore_SetResourcePermissions(t *testing.T) {
 
 type getResourcesPermissionsTest struct {
 	desc        string
+	user        *models.SignedInUser
 	numUsers    int
 	actions     []string
 	resource    string
@@ -323,14 +324,24 @@ type getResourcesPermissionsTest struct {
 func TestAccessControlStore_GetResourcesPermissions(t *testing.T) {
 	tests := []getResourcesPermissionsTest{
 		{
-			desc:        "should return permissions for all resource ids",
+			desc: "should return permissions for all resource ids",
+			user: &models.SignedInUser{
+				OrgId: 1,
+				Permissions: map[int64]map[string][]string{
+					1: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}},
+				}},
 			numUsers:    3,
 			actions:     []string{"datasources:query"},
 			resource:    "datasources",
 			resourceIDs: []string{"1", "2"},
 		},
 		{
-			desc:        "should return manage permissions for all resource ids",
+			desc: "should return manage permissions for all resource ids",
+			user: &models.SignedInUser{
+				OrgId: 1,
+				Permissions: map[int64]map[string][]string{
+					1: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}},
+				}},
 			numUsers:    3,
 			actions:     []string{"datasources:query"},
 			resource:    "datasources",
@@ -345,7 +356,7 @@ func TestAccessControlStore_GetResourcesPermissions(t *testing.T) {
 
 			err := sql.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
 				role := &accesscontrol.Role{
-					OrgID:   1,
+					OrgID:   test.user.OrgId,
 					UID:     "seeded",
 					Name:    "seeded",
 					Updated: time.Now(),
@@ -382,7 +393,8 @@ func TestAccessControlStore_GetResourcesPermissions(t *testing.T) {
 				seedResourcePermissions(t, store, sql, test.actions, test.resource, id, test.numUsers)
 			}
 
-			permissions, err := store.GetResourcesPermissions(context.Background(), 1, types.GetResourcesPermissionsQuery{
+			permissions, err := store.GetResourcesPermissions(context.Background(), test.user.OrgId, types.GetResourcesPermissionsQuery{
+				User:        test.user,
 				Actions:     test.actions,
 				Resource:    test.resource,
 				ResourceIDs: test.resourceIDs,