Access control: Use access control for dashboard and folder (#44702)

* Add actions and scopes

* add resource service for dashboard and folder

* Add dashboard guardian with fgac permission evaluation

* Add CanDelete function to guardian interface

* Add CanDelete property to folder and dashboard dto and set values

* change to correct function name

* Add accesscontrol to folder endpoints

* add access control to dashboard endpoints

* check access for nav links

* Add fixed roles for dashboard and folders

* use correct package

* add hack to override guardian Constructor if accesscontrol is enabled

* Add services

* Add function to handle api backward compatability

* Add permissionServices to HttpServer

* Set permission when new dashboard is created

* Add default permission when creating new dashboard

* Set default permission when creating folder and dashboard

* Add access control filter for dashboard search

* Add to accept list

* Add accesscontrol to dashboardimport

* Disable access control in tests

* Add check to see if user is allow to create a dashboard

* Use SetPermissions

* Use function to set several permissions at once

* remove permissions for folder and dashboard on delete

* update required permission

* set permission for provisioning

* Add CanCreate to dashboard guardian and set correct permisisons for
provisioning

* Dont set admin on folder / dashboard creation

* Add dashboard and folder permission migrations

* Add tests for CanCreate

* Add roles and update descriptions

* Solve uid to id for dashboard and folder permissions

* Add folder and dashboard actions to permission filter

* Handle viewer_can_edit flag

* set folder and dashboard permissions services

* Add dashboard permissions when importing a new dashboard

* Set access control permissions on provisioning

* Pass feature flags and only set permissions if access control is enabled

* only add default permissions for folders and dashboards without folders

* Batch create permissions in migrations


* Remove `dashboards:edit` action

* Remove unused function from interface

* Update pkg/services/guardian/accesscontrol_guardian_test.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

pkg/services/accesscontrol/accesscontrol.go

@@ -39,6 +39,8 @@ type PermissionsProvider interface {
 
 type PermissionsServices interface {
 	GetTeamService() PermissionsService
+	GetFolderService() PermissionsService
+	GetDashboardService() PermissionsService
 	GetDataSourceService() PermissionsService
 }
 
@@ -53,6 +55,8 @@ type PermissionsService interface {
 	SetBuiltInRolePermission(ctx context.Context, orgID int64, builtInRole string, resourceID string, permission string) (*ResourcePermission, error)
 	// SetPermissions sets several permissions on resource for either built-in role, team or user
 	SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...SetResourcePermissionCommand) ([]ResourcePermission, error)
+	// MapActions will map actions for a ResourcePermissions to it's "friendly" name configured in PermissionsToActions map.
+	MapActions(permission ResourcePermission) string
 }
 
 type User struct {
@@ -101,6 +105,10 @@ func HasAccess(ac AccessControl, c *models.ReqContext) func(fallback func(*model
 	}
 }
 
+var ReqSignedIn = func(c *models.ReqContext) bool {
+	return c.IsSignedIn
+}
+
 var ReqGrafanaAdmin = func(c *models.ReqContext) bool {
 	return c.IsGrafanaAdmin
 }
@@ -109,6 +117,10 @@ var ReqOrgAdmin = func(c *models.ReqContext) bool {
 	return c.OrgRole == models.ROLE_ADMIN
 }
 
+var ReqOrgAdminOrEditor = func(c *models.ReqContext) bool {
+	return c.OrgRole == models.ROLE_ADMIN || c.OrgRole == models.ROLE_EDITOR
+}
+
 func BuildPermissionsMap(permissions []*Permission) map[string]bool {
 	permissionsMap := make(map[string]bool)
 	for _, p := range permissions {

pkg/services/accesscontrol/filter.go

@@ -10,13 +10,15 @@ import (
 )
 
 var sqlIDAcceptList = map[string]struct{}{
-	"org_user.user_id": {},
-	"role.id":          {},
-	"t.id":             {},
-	"team.id":          {},
-	"u.id":             {},
-	"\"user\".\"id\"":  {}, // For Postgres
-	"`user`.`id`":      {}, // For MySQL and SQLite
+	"org_user.user_id":    {},
+	"role.id":             {},
+	"t.id":                {},
+	"team.id":             {},
+	"u.id":                {},
+	"\"user\".\"id\"":     {}, // For Postgres
+	"`user`.`id`":         {}, // For MySQL and SQLite
+	"dashboard.id":        {},
+	"dashboard.folder_id": {},
 }
 
 var (

pkg/services/accesscontrol/mock/permissions_services_mock.go

@@ -9,12 +9,16 @@ var _ accesscontrol.PermissionsServices = new(PermissionsServicesMock)
 func NewPermissionsServicesMock() *PermissionsServicesMock {
 	return &PermissionsServicesMock{
 		teams:       &MockPermissionsService{},
+		folders:     &MockPermissionsService{},
+		dashboards:  &MockPermissionsService{},
 		datasources: &MockPermissionsService{},
 	}
 }
 
 type PermissionsServicesMock struct {
 	teams       *MockPermissionsService
+	folders     *MockPermissionsService
+	dashboards  *MockPermissionsService
 	datasources *MockPermissionsService
 }
 
@@ -22,6 +26,14 @@ func (p PermissionsServicesMock) GetTeamService() accesscontrol.PermissionsServi
 	return p.teams
 }
 
+func (p PermissionsServicesMock) GetFolderService() accesscontrol.PermissionsService {
+	return p.folders
+}
+
+func (p PermissionsServicesMock) GetDashboardService() accesscontrol.PermissionsService {
+	return p.dashboards
+}
+
 func (p PermissionsServicesMock) GetDataSourceService() accesscontrol.PermissionsService {
 	return p.datasources
 }

pkg/services/accesscontrol/mock/service_mock.go

@@ -39,3 +39,8 @@ func (m *MockPermissionsService) SetPermissions(ctx context.Context, orgID int64
 	mockedArgs := m.Called(ctx, orgID, resourceID, commands)
 	return mockedArgs.Get(0).([]accesscontrol.ResourcePermission), mockedArgs.Error(1)
 }
+
+func (m *MockPermissionsService) MapActions(permission accesscontrol.ResourcePermission) string {
+	mockedArgs := m.Called(permission)
+	return mockedArgs.Get(0).(string)
+}

pkg/services/accesscontrol/models.go

@@ -323,17 +323,41 @@ const (
 	ScopeTeamsAll = "teams:*"
 
 	// Annotations related actions
-	ActionAnnotationsRead = "annotations:read"
-
+	ActionAnnotationsRead     = "annotations:read"
 	ActionAnnotationsTagsRead = "annotations.tags:read"
 
 	ScopeAnnotationsAll     = "annotations:*"
 	ScopeAnnotationsTagsAll = "annotations:tags:*"
+
+	// Dashboard actions
+	ActionDashboardsCreate           = "dashboards:create"
+	ActionDashboardsRead             = "dashboards:read"
+	ActionDashboardsWrite            = "dashboards:write"
+	ActionDashboardsDelete           = "dashboards:delete"
+	ActionDashboardsPermissionsRead  = "dashboards.permissions:read"
+	ActionDashboardsPermissionsWrite = "dashboards.permissions:write"
+
+	// Dashboard scopes
+	ScopeDashboardsAll = "dashboards:*"
+
+	// Folder actions
+	ActionFoldersCreate           = "folders:create"
+	ActionFoldersRead             = "folders:read"
+	ActionFoldersWrite            = "folders:write"
+	ActionFoldersDelete           = "folders:delete"
+	ActionFoldersPermissionsRead  = "folders.permissions:read"
+	ActionFoldersPermissionsWrite = "folders.permissions:write"
+
+	// Folder scopes
+	ScopeFoldersAll = "folders:*"
 )
 
 var (
 	// Team scope
 	ScopeTeamsID = Scope("teams", "id", Parameter(":teamId"))
+
+	// Folder scopes
+	ScopeFolderID = Scope("folders", "id", Parameter(":id"))
 )
 
 const RoleGrafanaAdmin = "Grafana Admin"

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -115,7 +115,7 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 		OrgID:   user.OrgId,
 		UserID:  user.UserId,
 		Roles:   ac.GetUserBuiltInRoles(user),
-		Actions: TeamAdminActions,
+		Actions: append(TeamAdminActions, append(DashboardAdminActions, FolderAdminActions...)...),
 	})
 	if err != nil {
 		return nil, err

pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go

@@ -2,6 +2,7 @@ package ossaccesscontrol
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strconv"
 
@@ -12,25 +13,48 @@ import (
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 )
 
-func ProvidePermissionsServices(router routing.RouteRegister, sql *sqlstore.SQLStore, ac accesscontrol.AccessControl, store resourcepermissions.Store) (*PermissionsService, error) {
+func ProvidePermissionsServices(router routing.RouteRegister, sql *sqlstore.SQLStore, ac accesscontrol.AccessControl, store resourcepermissions.Store) (*PermissionsServices, error) {
 	teamPermissions, err := ProvideTeamPermissions(router, sql, ac, store)
 	if err != nil {
 		return nil, err
 	}
+	folderPermissions, err := provideFolderService(router, sql, ac, store)
+	if err != nil {
+		return nil, err
+	}
+	dashboardPermissions, err := provideDashboardService(router, sql, ac, store)
+	if err != nil {
+		return nil, err
+	}
 
-	return &PermissionsService{teams: teamPermissions, datasources: provideEmptyPermissionsService()}, nil
+	return &PermissionsServices{
+		teams:       teamPermissions,
+		folder:      folderPermissions,
+		dashboard:   dashboardPermissions,
+		datasources: provideEmptyPermissionsService(),
+	}, nil
 }
 
-type PermissionsService struct {
+type PermissionsServices struct {
 	teams       accesscontrol.PermissionsService
+	folder      accesscontrol.PermissionsService
+	dashboard   accesscontrol.PermissionsService
 	datasources accesscontrol.PermissionsService
 }
 
-func (s *PermissionsService) GetTeamService() accesscontrol.PermissionsService {
+func (s *PermissionsServices) GetTeamService() accesscontrol.PermissionsService {
 	return s.teams
 }
 
-func (s *PermissionsService) GetDataSourceService() accesscontrol.PermissionsService {
+func (s *PermissionsServices) GetFolderService() accesscontrol.PermissionsService {
+	return s.folder
+}
+
+func (s *PermissionsServices) GetDashboardService() accesscontrol.PermissionsService {
+	return s.dashboard
+}
+
+func (s *PermissionsServices) GetDataSourceService() accesscontrol.PermissionsService {
 	return s.datasources
 }
 
@@ -105,6 +129,107 @@ func ProvideTeamPermissions(router routing.RouteRegister, sql *sqlstore.SQLStore
 	return resourcepermissions.New(options, router, ac, store, sql)
 }
 
+var DashboardViewActions = []string{accesscontrol.ActionDashboardsRead}
+var DashboardEditActions = append(DashboardViewActions, []string{accesscontrol.ActionDashboardsWrite, accesscontrol.ActionDashboardsDelete}...)
+var DashboardAdminActions = append(DashboardEditActions, []string{accesscontrol.ActionDashboardsPermissionsRead, accesscontrol.ActionDashboardsPermissionsWrite}...)
+var FolderViewActions = []string{accesscontrol.ActionFoldersRead}
+var FolderEditActions = append(FolderViewActions, []string{accesscontrol.ActionFoldersWrite, accesscontrol.ActionFoldersDelete, accesscontrol.ActionDashboardsCreate}...)
+var FolderAdminActions = append(FolderEditActions, []string{accesscontrol.ActionFoldersPermissionsRead, accesscontrol.ActionFoldersPermissionsWrite}...)
+
+func provideDashboardService(router routing.RouteRegister, sql *sqlstore.SQLStore, accesscontrol accesscontrol.AccessControl, store resourcepermissions.Store) (*resourcepermissions.Service, error) {
+	options := resourcepermissions.Options{
+		Resource: "dashboards",
+		ResourceValidator: func(ctx context.Context, orgID int64, resourceID string) error {
+			id, err := strconv.ParseInt(resourceID, 10, 64)
+			if err != nil {
+				return err
+			}
+			query := &models.GetDashboardQuery{Id: id, OrgId: orgID}
+			if err := sql.GetDashboard(ctx, query); err != nil {
+				return err
+			}
+
+			if query.Result.IsFolder {
+				return errors.New("not found")
+			}
+
+			return nil
+		},
+		UidSolver: func(ctx context.Context, orgID int64, uid string) (int64, error) {
+			query := &models.GetDashboardQuery{
+				Uid:   uid,
+				OrgId: orgID,
+			}
+			if err := sql.GetDashboard(ctx, query); err != nil {
+				return 0, err
+			}
+			return query.Result.Id, nil
+		},
+		Assignments: resourcepermissions.Assignments{
+			Users:        true,
+			Teams:        true,
+			BuiltInRoles: true,
+		},
+		PermissionsToActions: map[string][]string{
+			"View":  DashboardViewActions,
+			"Edit":  DashboardEditActions,
+			"Admin": DashboardAdminActions,
+		},
+		ReaderRoleName: "Dashboard permission reader",
+		WriterRoleName: "Dashboard permission writer",
+		RoleGroup:      "Dashboards",
+	}
+
+	return resourcepermissions.New(options, router, accesscontrol, store, sql)
+}
+
+func provideFolderService(router routing.RouteRegister, sql *sqlstore.SQLStore, accesscontrol accesscontrol.AccessControl, store resourcepermissions.Store) (*resourcepermissions.Service, error) {
+	options := resourcepermissions.Options{
+		Resource: "folders",
+		ResourceValidator: func(ctx context.Context, orgID int64, resourceID string) error {
+			id, err := strconv.ParseInt(resourceID, 10, 64)
+			if err != nil {
+				return err
+			}
+			query := &models.GetDashboardQuery{Id: id, OrgId: orgID}
+			if err := sql.GetDashboard(ctx, query); err != nil {
+				return err
+			}
+
+			if !query.Result.IsFolder {
+				return errors.New("not found")
+			}
+
+			return nil
+		},
+		UidSolver: func(ctx context.Context, orgID int64, uid string) (int64, error) {
+			query := &models.GetDashboardQuery{
+				Uid:   uid,
+				OrgId: orgID,
+			}
+			if err := sql.GetDashboard(ctx, query); err != nil {
+				return 0, err
+			}
+			return query.Result.Id, nil
+		},
+		Assignments: resourcepermissions.Assignments{
+			Users:        true,
+			Teams:        true,
+			BuiltInRoles: true,
+		},
+		PermissionsToActions: map[string][]string{
+			"View":  append(DashboardViewActions, FolderViewActions...),
+			"Edit":  append(DashboardEditActions, FolderEditActions...),
+			"Admin": append(DashboardAdminActions, FolderAdminActions...),
+		},
+		ReaderRoleName: "Folder permission reader",
+		WriterRoleName: "Folder permission writer",
+		RoleGroup:      "Folders",
+	}
+
+	return resourcepermissions.New(options, router, accesscontrol, store, sql)
+}
+
 func provideEmptyPermissionsService() accesscontrol.PermissionsService {
 	return &emptyPermissionsService{}
 }
@@ -132,3 +257,7 @@ func (e emptyPermissionsService) SetBuiltInRolePermission(ctx context.Context, o
 func (e emptyPermissionsService) SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...accesscontrol.SetResourcePermissionCommand) ([]accesscontrol.ResourcePermission, error) {
 	return nil, nil
 }
+
+func (e emptyPermissionsService) MapActions(permission accesscontrol.ResourcePermission) string {
+	return ""
+}

pkg/services/accesscontrol/resourcepermissions/api.go

@@ -89,7 +89,7 @@ func (a *api) getPermissions(c *models.ReqContext) response.Response {
 
 	dto := make([]resourcePermissionDTO, 0, len(permissions))
 	for _, p := range permissions {
-		if permission := a.service.mapActions(p); permission != "" {
+		if permission := a.service.MapActions(p); permission != "" {
 			teamAvatarUrl := ""
 			if p.TeamId != 0 {
 				teamAvatarUrl = dtos.GetGravatarUrlWithDefault(p.TeamEmail, p.Team)

pkg/services/accesscontrol/resourcepermissions/service.go

@@ -223,7 +223,7 @@ func (s *Service) SetPermissions(
 	})
 }
 
-func (s *Service) mapActions(permission accesscontrol.ResourcePermission) string {
+func (s *Service) MapActions(permission accesscontrol.ResourcePermission) string {
 	for _, p := range s.permissions {
 		if permission.Contains(s.options.PermissionsToActions[p]) {
 			return p