Move datasource scopes and actions to access control package (#46334)

* create scope provider
* move datasource actions and scopes to datasource package + add provider
* change usages to use datasource scopes and update data source name resolver to use provider
* move folder permissions to dashboard package and update usages

pkg/services/accesscontrol/models.go

@@ -346,17 +346,6 @@ const (
 
 	// Dashboard scopes
 	ScopeDashboardsAll = "dashboards:*"
-
-	// Folder actions
-	ActionFoldersCreate           = "folders:create"
-	ActionFoldersRead             = "folders:read"
-	ActionFoldersWrite            = "folders:write"
-	ActionFoldersDelete           = "folders:delete"
-	ActionFoldersPermissionsRead  = "folders.permissions:read"
-	ActionFoldersPermissionsWrite = "folders.permissions:write"
-
-	// Folder scopes
-	ScopeFoldersAll = "folders:*"
 )
 
 var (
@@ -364,7 +353,9 @@ var (
 	ScopeTeamsID = Scope("teams", "id", Parameter(":teamId"))
 
 	// Folder scopes
-	ScopeFolderID = Scope("folders", "id", Parameter(":id"))
+
+	// Datasource scopes
+
 )
 
 const RoleGrafanaAdmin = "Grafana Admin"

pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go

@@ -10,6 +10,7 @@ import (
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
+	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 	"github.com/grafana/grafana/pkg/setting"
 )
@@ -139,9 +140,9 @@ func ProvideTeamPermissions(
 var DashboardViewActions = []string{accesscontrol.ActionDashboardsRead}
 var DashboardEditActions = append(DashboardViewActions, []string{accesscontrol.ActionDashboardsWrite, accesscontrol.ActionDashboardsDelete}...)
 var DashboardAdminActions = append(DashboardEditActions, []string{accesscontrol.ActionDashboardsPermissionsRead, accesscontrol.ActionDashboardsPermissionsWrite}...)
-var FolderViewActions = []string{accesscontrol.ActionFoldersRead}
-var FolderEditActions = append(FolderViewActions, []string{accesscontrol.ActionFoldersWrite, accesscontrol.ActionFoldersDelete, accesscontrol.ActionDashboardsCreate}...)
-var FolderAdminActions = append(FolderEditActions, []string{accesscontrol.ActionFoldersPermissionsRead, accesscontrol.ActionFoldersPermissionsWrite}...)
+var FolderViewActions = []string{dashboards.ActionFoldersRead}
+var FolderEditActions = append(FolderViewActions, []string{dashboards.ActionFoldersWrite, dashboards.ActionFoldersDelete, accesscontrol.ActionDashboardsCreate}...)
+var FolderAdminActions = append(FolderEditActions, []string{dashboards.ActionFoldersPermissionsRead, dashboards.ActionFoldersPermissionsWrite}...)
 
 func provideDashboardService(
 	cfg *setting.Cfg, router routing.RouteRegister, sql *sqlstore.SQLStore,

pkg/services/accesscontrol/scope.go

@@ -22,6 +22,14 @@ func GetResourceScope(resource string, resourceID string) string {
 	return Scope(resource, "id", resourceID)
 }
 
+func GetResourceScopeUID(resource string, resourceID string) string {
+	return Scope(resource, "uid", resourceID)
+}
+
+func GetResourceScopeName(resource string, resourceID string) string {
+	return Scope(resource, "name", resourceID)
+}
+
 func GetResourceAllScope(resource string) string {
 	return Scope(resource, "*")
 }
@@ -165,3 +173,48 @@ func ScopeInjector(params ScopeParams) ScopeMutator {
 		return buf.String(), nil
 	}
 }
+
+// ScopeProvider provides methods that construct scopes
+type ScopeProvider interface {
+	GetResourceScope(resourceID string) string
+	GetResourceScopeUID(resourceID string) string
+	GetResourceScopeName(resourceID string) string
+	GetResourceAllScope() string
+	GetResourceAllIDScope() string
+}
+
+type scopeProviderImpl struct {
+	root string
+}
+
+// NewScopeProvider creates a new ScopeProvider that is configured with specific root scope
+func NewScopeProvider(root string) ScopeProvider {
+	return &scopeProviderImpl{
+		root: root,
+	}
+}
+
+// GetResourceScope returns scope that has the format "<rootScope>:id:<resourceID>"
+func (s scopeProviderImpl) GetResourceScope(resourceID string) string {
+	return GetResourceScope(s.root, resourceID)
+}
+
+// GetResourceScopeUID returns scope that has the format "<rootScope>:uid:<resourceID>"
+func (s scopeProviderImpl) GetResourceScopeUID(resourceID string) string {
+	return GetResourceScopeUID(s.root, resourceID)
+}
+
+// GetResourceScopeName returns scope that has the format "<rootScope>:name:<resourceID>"
+func (s scopeProviderImpl) GetResourceScopeName(resourceID string) string {
+	return GetResourceScopeName(s.root, resourceID)
+}
+
+// GetResourceAllScope returns scope that has the format "<rootScope>:*"
+func (s scopeProviderImpl) GetResourceAllScope() string {
+	return GetResourceAllScope(s.root)
+}
+
+// GetResourceAllIDScope returns scope that has the format "<rootScope>:id:*"
+func (s scopeProviderImpl) GetResourceAllIDScope() string {
+	return GetResourceAllIDScope(s.root)
+}