RBAC: Validate plugin app access permission targets the plugin (#59468)

* RBAC: Validate plugin app access permission targets the plugin

* Fix service test

pkg/services/accesscontrol/acimpl/service_test.go

@@ -189,7 +189,7 @@ func TestService_DeclarePluginRoles(t *testing.T) {
 					Role: plugins.Role{
 						Name: "Tester",
 						Permissions: []plugins.Permission{
-							{Action: "plugins.app:access"},
+							{Action: "plugins.app:access", Scope: "plugins:id:test-app"},
 							{Action: "test-app:read"},
 							{Action: "test-app.resource:read"},
 						},

pkg/services/accesscontrol/errors.go

@@ -44,3 +44,17 @@ func (e *ErrorActionPrefixMissing) Error() string {
 func (e *ErrorActionPrefixMissing) Unwrap() error {
 	return &ErrorInvalidRole{}
 }
+
+type ErrorScopeTarget struct {
+	Action        string
+	Scope         string
+	ExpectedScope string
+}
+
+func (e *ErrorScopeTarget) Error() string {
+	return fmt.Sprintf("expected action '%s' to be scoped with '%v', found '%v'", e.Action, e.ExpectedScope, e.Scope)
+}
+
+func (e *ErrorScopeTarget) Unwrap() error {
+	return &ErrorInvalidRole{}
+}

pkg/services/accesscontrol/pluginutils/utils.go

@@ -17,6 +17,11 @@ func ValidatePluginPermissions(pluginID string, permissions []ac.Permission) err
 			return &ac.ErrorActionPrefixMissing{Action: permissions[i].Action,
 				Prefixes: []string{plugins.ActionAppAccess, pluginID + ":", pluginID + "."}}
 		}
+		if strings.HasPrefix(permissions[i].Action, plugins.ActionAppAccess) &&
+			permissions[i].Scope != plugins.ScopeProvider.GetResourceScope(pluginID) {
+			return &ac.ErrorScopeTarget{Action: permissions[i].Action, Scope: permissions[i].Scope,
+				ExpectedScope: plugins.ScopeProvider.GetResourceScope(pluginID)}
+		}
 	}
 
 	return nil

pkg/services/accesscontrol/pluginutils/utils_test.go

@@ -122,12 +122,23 @@ func TestValidatePluginRole(t *testing.T) {
 			role: ac.RoleDTO{
 				Name: "plugins:test-app:reader",
 				Permissions: []ac.Permission{
-					{Action: "plugins.app:access"},
+					{Action: "plugins.app:access", Scope: "plugins:id:test-app"},
 					{Action: "test-app:read"},
 					{Action: "test-app.resources:read"},
 				},
 			},
 		},
+		{
+			name:     "invalid permission targets other plugin",
+			pluginID: "test-app",
+			role: ac.RoleDTO{
+				Name: "plugins:test-app:reader",
+				Permissions: []ac.Permission{
+					{Action: "plugins.app:access", Scope: "plugins:id:other-app"},
+				},
+			},
+			wantErr: &ac.ErrorInvalidRole{},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {