AccessControl: Resolve attribute based scopes to id based scopes (#40742)

* AccessControl: POC scope attribute resolution

Refactor based on ScopeMutators

test errors and calls to cache

Add comments to tests

Rename logger

Create keywordMutator only once

* AccessControl: Add AttributeScopeResolver registration

Co-authored-by: gamab <gabriel.mabille@grafana.com>

* AccessControl: Add AttributeScopeResolver to datasources

Co-authored-by: gamab <gabriel.mabille@grafana.com>

* Test evaluation with translation

* fix imports

* AccessControl: Test attribute resolver

* Fix trailing white space

* Make ScopeResolver public for enterprise redefine

* Handle wildcard

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

Co-authored-by: jguer <joao.guerreiro@grafana.com>

pkg/services/accesscontrol/accesscontrol.go

@@ -20,9 +20,13 @@ type AccessControl interface {
 	//IsDisabled returns if access control is enabled or not
 	IsDisabled() bool
 
-	// DeclareFixedRoles allow the caller to declare, to the service, fixed roles and their
+	// DeclareFixedRoles allows the caller to declare, to the service, fixed roles and their
 	// assignments to organization roles ("Viewer", "Editor", "Admin") or "Grafana Admin"
 	DeclareFixedRoles(...RoleRegistration) error
+
+	// RegisterAttributeScopeResolver allows the caller to register a scope resolver for a
+	// specific scope prefix (ex: datasources:name:)
+	RegisterAttributeScopeResolver(scopePrefix string, resolver AttributeScopeResolveFunc)
 }
 
 type PermissionsProvider interface {

pkg/services/accesscontrol/errors.go

@@ -5,4 +5,5 @@ import "errors"
 var (
 	ErrFixedRolePrefixMissing = errors.New("fixed role should be prefixed with '" + FixedRolePrefix + "'")
 	ErrInvalidBuiltinRole     = errors.New("built-in role is not valid")
+	ErrInvalidScope           = errors.New("invalid scope")
 )

pkg/services/accesscontrol/evaluator.go

@@ -1,9 +1,8 @@
 package accesscontrol
 
 import (
-	"bytes"
+	"context"
 	"fmt"
-	"html/template"
 	"strings"
 
 	"github.com/grafana/grafana/pkg/infra/log"
@@ -14,8 +13,8 @@ var logger = log.New("accesscontrol.evaluator")
 type Evaluator interface {
 	// Evaluate permissions that are grouped by action
 	Evaluate(permissions map[string][]string) (bool, error)
-	// Inject params into the evaluator's templated scopes. e.g. "settings:" + eval.Parameters(":id") and returns a new Evaluator
-	Inject(params ScopeParams) (Evaluator, error)
+	// MutateScopes executes a sequence of ScopeModifier functions on all embedded scopes of an evaluator and returns a new Evaluator
+	MutateScopes(context.Context, ...ScopeMutator) (Evaluator, error)
 	// String returns a string representation of permission required by the evaluator
 	String() string
 }
@@ -89,18 +88,22 @@ func match(scope, target string) (bool, error) {
 	return scope == target, nil
 }
 
-func (p permissionEvaluator) Inject(params ScopeParams) (Evaluator, error) {
+func (p permissionEvaluator) MutateScopes(ctx context.Context, modifiers ...ScopeMutator) (Evaluator, error) {
+	var err error
+	if p.Scopes == nil {
+		return EvalPermission(p.Action), nil
+	}
+
 	scopes := make([]string, 0, len(p.Scopes))
 	for _, scope := range p.Scopes {
-		tmpl, err := template.New("scope").Parse(scope)
-		if err != nil {
-			return nil, err
+		modified := scope
+		for _, modifier := range modifiers {
+			modified, err = modifier(ctx, modified)
+			if err != nil {
+				return nil, err
+			}
 		}
-		var buf bytes.Buffer
-		if err = tmpl.Execute(&buf, params); err != nil {
-			return nil, err
-		}
-		scopes = append(scopes, buf.String())
+		scopes = append(scopes, modified)
 	}
 	return EvalPermission(p.Action, scopes...), nil
 }
@@ -129,16 +132,16 @@ func (a allEvaluator) Evaluate(permissions map[string][]string) (bool, error) {
 	return true, nil
 }
 
-func (a allEvaluator) Inject(params ScopeParams) (Evaluator, error) {
-	var injected []Evaluator
+func (a allEvaluator) MutateScopes(ctx context.Context, modifiers ...ScopeMutator) (Evaluator, error) {
+	var modified []Evaluator
 	for _, e := range a.allOf {
-		i, err := e.Inject(params)
+		i, err := e.MutateScopes(ctx, modifiers...)
 		if err != nil {
 			return nil, err
 		}
-		injected = append(injected, i)
+		modified = append(modified, i)
 	}
-	return EvalAll(injected...), nil
+	return EvalAll(modified...), nil
 }
 
 func (a allEvaluator) String() string {
@@ -173,16 +176,16 @@ func (a anyEvaluator) Evaluate(permissions map[string][]string) (bool, error) {
 	return false, nil
 }
 
-func (a anyEvaluator) Inject(params ScopeParams) (Evaluator, error) {
-	var injected []Evaluator
+func (a anyEvaluator) MutateScopes(ctx context.Context, modifiers ...ScopeMutator) (Evaluator, error) {
+	var modified []Evaluator
 	for _, e := range a.anyOf {
-		i, err := e.Inject(params)
+		i, err := e.MutateScopes(ctx, modifiers...)
 		if err != nil {
 			return nil, err
 		}
-		injected = append(injected, i)
+		modified = append(modified, i)
 	}
-	return EvalAny(injected...), nil
+	return EvalAny(modified...), nil
 }
 
 func (a anyEvaluator) String() string {

pkg/services/accesscontrol/evaluator_test.go

@@ -1,6 +1,7 @@
 package accesscontrol
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -120,7 +121,7 @@ func TestPermission_Inject(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
-			injected, err := test.evaluator.Inject(test.params)
+			injected, err := test.evaluator.MutateScopes(context.TODO(), ScopeInjector(test.params))
 			assert.NoError(t, err)
 			ok, err := injected.Evaluate(test.permissions)
 			assert.NoError(t, err)
@@ -233,7 +234,7 @@ func TestAll_Inject(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
-			injected, err := test.evaluator.Inject(test.params)
+			injected, err := test.evaluator.MutateScopes(context.TODO(), ScopeInjector(test.params))
 			assert.NoError(t, err)
 			ok, err := injected.Evaluate(test.permissions)
 			assert.NoError(t, err)
@@ -344,7 +345,7 @@ func TestAny_Inject(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
-			injected, err := test.evaluator.Inject(test.params)
+			injected, err := test.evaluator.MutateScopes(context.TODO(), ScopeInjector(test.params))
 			assert.NoError(t, err)
 			ok, err := injected.Evaluate(test.permissions)
 			assert.NoError(t, err)

pkg/services/accesscontrol/middleware/middleware.go

@@ -15,7 +15,7 @@ import (
 )
 
 func authorize(c *models.ReqContext, ac accesscontrol.AccessControl, user *models.SignedInUser, evaluator accesscontrol.Evaluator) {
-	injected, err := evaluator.Inject(buildScopeParams(c))
+	injected, err := evaluator.MutateScopes(c.Req.Context(), accesscontrol.ScopeInjector(buildScopeParams(c)))
 	if err != nil {
 		c.JsonApiErr(http.StatusInternalServerError, "Internal server error", err)
 		return

pkg/services/accesscontrol/mock/mock.go

@@ -14,13 +14,14 @@ type fullAccessControl interface {
 }
 
 type Calls struct {
-	Evaluate            []interface{}
-	GetUserPermissions  []interface{}
-	GetUserRoles        []interface{}
-	IsDisabled          []interface{}
-	DeclareFixedRoles   []interface{}
-	GetUserBuiltInRoles []interface{}
-	RegisterFixedRoles  []interface{}
+	Evaluate                       []interface{}
+	GetUserPermissions             []interface{}
+	GetUserRoles                   []interface{}
+	IsDisabled                     []interface{}
+	DeclareFixedRoles              []interface{}
+	GetUserBuiltInRoles            []interface{}
+	RegisterFixedRoles             []interface{}
+	RegisterAttributeScopeResolver []interface{}
 }
 
 type Mock struct {
@@ -37,13 +38,14 @@ type Mock struct {
 	Calls Calls
 
 	// Override functions
-	EvaluateFunc            func(context.Context, *models.SignedInUser, accesscontrol.Evaluator) (bool, error)
-	GetUserPermissionsFunc  func(context.Context, *models.SignedInUser) ([]*accesscontrol.Permission, error)
-	GetUserRolesFunc        func(context.Context, *models.SignedInUser) ([]*accesscontrol.RoleDTO, error)
-	IsDisabledFunc          func() bool
-	DeclareFixedRolesFunc   func(...accesscontrol.RoleRegistration) error
-	GetUserBuiltInRolesFunc func(user *models.SignedInUser) []string
-	RegisterFixedRolesFunc  func() error
+	EvaluateFunc                       func(context.Context, *models.SignedInUser, accesscontrol.Evaluator) (bool, error)
+	GetUserPermissionsFunc             func(context.Context, *models.SignedInUser) ([]*accesscontrol.Permission, error)
+	GetUserRolesFunc                   func(context.Context, *models.SignedInUser) ([]*accesscontrol.RoleDTO, error)
+	IsDisabledFunc                     func() bool
+	DeclareFixedRolesFunc              func(...accesscontrol.RoleRegistration) error
+	GetUserBuiltInRolesFunc            func(user *models.SignedInUser) []string
+	RegisterFixedRolesFunc             func() error
+	RegisterAttributeScopeResolverFunc func(string, accesscontrol.AttributeScopeResolveFunc)
 }
 
 // Ensure the mock stays in line with the interface
@@ -162,3 +164,13 @@ func (m *Mock) RegisterFixedRoles() error {
 	}
 	return nil
 }
+
+// RegisterAttributeScopeResolver allows the caller to register a scope resolver for a
+// specific scope prefix (ex: datasources:name:)
+func (m *Mock) RegisterAttributeScopeResolver(scopePrefix string, resolver accesscontrol.AttributeScopeResolveFunc) {
+	m.Calls.RegisterAttributeScopeResolver = append(m.Calls.RegisterAttributeScopeResolver, []struct{}{})
+	// Use override if provided
+	if m.RegisterAttributeScopeResolverFunc != nil {
+		m.RegisterAttributeScopeResolverFunc(scopePrefix, resolver)
+	}
+}

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -18,7 +18,7 @@ func ProvideService(cfg *setting.Cfg, usageStats usagestats.Service) *OSSAccessC
 		Cfg:           cfg,
 		UsageStats:    usageStats,
 		Log:           log.New("accesscontrol"),
-		scopeResolver: accesscontrol.NewScopeResolver(),
+		ScopeResolver: accesscontrol.NewScopeResolver(),
 	}
 	s.registerUsageMetrics()
 	return s
@@ -30,7 +30,7 @@ type OSSAccessControlService struct {
 	UsageStats    usagestats.Service
 	Log           log.Logger
 	registrations accesscontrol.RegistrationList
-	scopeResolver accesscontrol.ScopeResolver
+	ScopeResolver accesscontrol.ScopeResolver
 }
 
 func (ac *OSSAccessControlService) IsDisabled() bool {
@@ -74,7 +74,12 @@ func (ac *OSSAccessControlService) Evaluate(ctx context.Context, user *models.Si
 		user.Permissions[user.OrgId] = accesscontrol.GroupScopesByAction(permissions)
 	}
 
-	return evaluator.Evaluate(user.Permissions[user.OrgId])
+	attributeMutator := ac.ScopeResolver.GetResolveAttributeScopeMutator(user.OrgId)
+	resolvedEvaluator, err := evaluator.MutateScopes(ctx, attributeMutator)
+	if err != nil {
+		return false, err
+	}
+	return resolvedEvaluator.Evaluate(user.Permissions[user.OrgId])
 }
 
 // GetUserRoles returns user permissions based on built-in roles
@@ -87,6 +92,9 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 	timer := prometheus.NewTimer(metrics.MAccessPermissionsSummary)
 	defer timer.ObserveDuration()
 
+	var err error
+	keywordMutator := ac.ScopeResolver.GetResolveKeywordScopeMutator(user)
+
 	builtinRoles := ac.GetUserBuiltInRoles(user)
 	permissions := make([]*accesscontrol.Permission, 0)
 	for _, builtin := range builtinRoles {
@@ -96,13 +104,14 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 				if !exists {
 					continue
 				}
-				for _, p := range role.Permissions {
+				for i := range role.Permissions {
 					// if the permission has a keyword in its scope it will be resolved
-					permission, err := ac.scopeResolver.ResolveKeyword(user, p)
+					p := (role.Permissions[i])
+					p.Scope, err = keywordMutator(ctx, p.Scope)
 					if err != nil {
 						return nil, err
 					}
-					permissions = append(permissions, permission)
+					permissions = append(permissions, &p)
 				}
 			}
 		}
@@ -201,3 +210,9 @@ func (ac *OSSAccessControlService) DeclareFixedRoles(registrations ...accesscont
 
 	return nil
 }
+
+// RegisterAttributeScopeResolver allows the caller to register scope resolvers for a
+// specific scope prefix (ex: datasources:name:)
+func (ac *OSSAccessControlService) RegisterAttributeScopeResolver(scopePrefix string, resolver accesscontrol.AttributeScopeResolveFunc) {
+	ac.ScopeResolver.AddAttributeResolver(scopePrefix, resolver)
+}

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol_test.go

@@ -26,7 +26,7 @@ func setupTestEnv(t testing.TB) *OSSAccessControlService {
 		UsageStats:    &usagestats.UsageStatsMock{T: t},
 		Log:           log.New("accesscontrol"),
 		registrations: accesscontrol.RegistrationList{},
-		scopeResolver: accesscontrol.NewScopeResolver(),
+		ScopeResolver: accesscontrol.NewScopeResolver(),
 	}
 	return ac
 }
@@ -576,3 +576,87 @@ func TestOSSAccessControlService_GetUserPermissions(t *testing.T) {
 		})
 	}
 }
+
+func TestOSSAccessControlService_Evaluate(t *testing.T) {
+	testUser := models.SignedInUser{
+		UserId:  2,
+		OrgId:   3,
+		OrgName: "TestOrg",
+		OrgRole: models.ROLE_VIEWER,
+		Login:   "testUser",
+		Name:    "Test User",
+		Email:   "testuser@example.org",
+	}
+	registration := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Version:     1,
+			UID:         "fixed:test:test",
+			Name:        "fixed:test:test",
+			Description: "Test role",
+			Permissions: []accesscontrol.Permission{},
+		},
+		Grants: []string{"Viewer"},
+	}
+	userLoginScopeSolver := func(ctx context.Context, orgID int64, initialScope string) (string, error) {
+		if initialScope == "users:login:testUser" {
+			return "users:id:2", nil
+		}
+		return initialScope, nil
+	}
+
+	tests := []struct {
+		name       string
+		user       models.SignedInUser
+		rawPerm    accesscontrol.Permission
+		evaluator  accesscontrol.Evaluator
+		wantAccess bool
+		wantErr    bool
+	}{
+		{
+			name:       "Should translate users:self",
+			user:       testUser,
+			rawPerm:    accesscontrol.Permission{Action: "users:read", Scope: "users:self"},
+			evaluator:  accesscontrol.EvalPermission("users:read", "users:id:2"),
+			wantAccess: true,
+			wantErr:    false,
+		},
+		{
+			name:       "Should translate users:login:testUser",
+			user:       testUser,
+			rawPerm:    accesscontrol.Permission{Action: "users:read", Scope: "users:id:2"},
+			evaluator:  accesscontrol.EvalPermission("users:read", "users:login:testUser"),
+			wantAccess: true,
+			wantErr:    false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Remove any inserted role after the test case has been run
+			t.Cleanup(func() {
+				removeRoleHelper(registration.Role.Name)
+			})
+
+			// Setup
+			ac := setupTestEnv(t)
+			ac.Cfg.FeatureToggles = map[string]bool{"accesscontrol": true}
+			ac.RegisterAttributeScopeResolver("users:login:", userLoginScopeSolver)
+
+			registration.Role.Permissions = []accesscontrol.Permission{tt.rawPerm}
+			err := ac.DeclareFixedRoles(registration)
+			require.NoError(t, err)
+
+			err = ac.RegisterFixedRoles()
+			require.NoError(t, err)
+
+			// Test
+			hasAccess, err := ac.Evaluate(context.TODO(), &tt.user, tt.evaluator)
+			if tt.wantErr {
+				assert.Error(t, err)
+				return
+			}
+			assert.NoError(t, err)
+
+			assert.Equal(t, tt.wantAccess, hasAccess)
+		})
+	}
+}

pkg/services/accesscontrol/scope.go

@@ -1,12 +1,23 @@
 package accesscontrol
 
 import (
+	"bytes"
+	"context"
 	"fmt"
+	"html/template"
 	"strings"
+	"time"
 
+	"github.com/grafana/grafana/pkg/infra/localcache"
+	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/models"
 )
 
+const (
+	ttl           = 30 * time.Second
+	cleanInterval = 2 * time.Minute
+)
+
 func GetResourceScope(resource string, resourceID string) string {
 	return Scope(resource, "id", resourceID)
 }
@@ -44,11 +55,17 @@ func Field(key string) string {
 	return fmt.Sprintf(`{{ .%s }}`, key)
 }
 
+// ScopeMutator alters a Scope to return a new modified Scope
+type ScopeMutator func(context.Context, string) (string, error)
+
 type KeywordScopeResolveFunc func(*models.SignedInUser) (string, error)
 
-// ScopeResolver contains a map of functions to resolve scope keywords such as `self` or `current` into `id` based scopes
+// ScopeResolver is used to resolve scope keywords such as `self` or `current` into `id` based scopes and scope attributes such as `name` or `uid` into `id` based scopes.
 type ScopeResolver struct {
-	keywordResolvers map[string]KeywordScopeResolveFunc
+	keywordResolvers   map[string]KeywordScopeResolveFunc
+	attributeResolvers map[string]AttributeScopeResolveFunc
+	cache              *localcache.CacheService
+	log                log.Logger
 }
 
 func NewScopeResolver() ScopeResolver {
@@ -56,21 +73,95 @@ func NewScopeResolver() ScopeResolver {
 		keywordResolvers: map[string]KeywordScopeResolveFunc{
 			"users:self": resolveUserSelf,
 		},
+		attributeResolvers: map[string]AttributeScopeResolveFunc{},
+		cache:              localcache.New(ttl, cleanInterval),
+		log:                log.New("accesscontrol.scoperesolution"),
 	}
 }
 
+func (s *ScopeResolver) AddKeywordResolver(keyword string, fn KeywordScopeResolveFunc) {
+	s.log.Debug("adding keyword resolution for '%v'", keyword)
+	s.keywordResolvers[keyword] = fn
+}
+
+func (s *ScopeResolver) AddAttributeResolver(prefix string, fn AttributeScopeResolveFunc) {
+	s.log.Debug("adding attribute resolution for '%v'", prefix)
+	s.attributeResolvers[prefix] = fn
+}
+
 func resolveUserSelf(u *models.SignedInUser) (string, error) {
 	return Scope("users", "id", fmt.Sprintf("%v", u.UserId)), nil
 }
 
-// ResolveKeyword resolves scope with keywords such as `self` or `current` into `id` based scopes
-func (s *ScopeResolver) ResolveKeyword(user *models.SignedInUser, permission Permission) (*Permission, error) {
-	if fn, ok := s.keywordResolvers[permission.Scope]; ok {
-		resolvedScope, err := fn(user)
-		if err != nil {
-			return nil, fmt.Errorf("could not resolve %v: %v", permission.Scope, err)
+// GetResolveKeywordScopeMutator returns a function to resolve scope with keywords such as `self` or `current` into `id` based scopes
+func (s *ScopeResolver) GetResolveKeywordScopeMutator(user *models.SignedInUser) ScopeMutator {
+	return func(_ context.Context, scope string) (string, error) {
+		var err error
+		// By default the scope remains unchanged
+		resolvedScope := scope
+		if fn, ok := s.keywordResolvers[scope]; ok {
+			resolvedScope, err = fn(user)
+			if err != nil {
+				return "", fmt.Errorf("could not resolve %v: %w", scope, err)
+			}
+			s.log.Debug("resolved '%v' to '%v'", scope, resolvedScope)
 		}
-		permission.Scope = resolvedScope
+		return resolvedScope, nil
+	}
+}
+
+type AttributeScopeResolveFunc func(ctx context.Context, orgID int64, initialScope string) (string, error)
+
+// getCacheKey creates an identifier to fetch and store resolution of scopes in the cache
+func getCacheKey(orgID int64, scope string) string {
+	return fmt.Sprintf("%s-%v", scope, orgID)
+}
+
+// GetResolveAttributeScopeMutator returns a function to resolve scopes with attributes such as `name` or `uid` into `id` based scopes
+func (s *ScopeResolver) GetResolveAttributeScopeMutator(orgID int64) ScopeMutator {
+	return func(ctx context.Context, scope string) (string, error) {
+		// Check cache before computing the scope
+		if cachedScope, ok := s.cache.Get(getCacheKey(orgID, scope)); ok {
+			resolvedScope := cachedScope.(string)
+			s.log.Debug("used cache to resolve '%v' to '%v'", scope, resolvedScope)
+			return resolvedScope, nil
+		}
+
+		var err error
+		// By default the scope remains unchanged
+		resolvedScope := scope
+		prefix := scopePrefix(scope)
+		if fn, ok := s.attributeResolvers[prefix]; ok {
+			resolvedScope, err = fn(ctx, orgID, scope)
+			if err != nil {
+				return "", fmt.Errorf("could not resolve %v: %w", scope, err)
+			}
+			// Cache result
+			s.cache.Set(getCacheKey(orgID, scope), resolvedScope, ttl)
+			s.log.Debug("resolved '%v' to '%v'", scope, resolvedScope)
+		}
+		return resolvedScope, nil
+	}
+}
+
+func scopePrefix(scope string) string {
+	parts := strings.Split(scope, ":")
+	n := len(parts) - 1
+	parts[n] = ""
+	return strings.Join(parts, ":")
+}
+
+//Inject params into the evaluator's templated scopes. e.g. "settings:" + eval.Parameters(":id")
+func ScopeInjector(params ScopeParams) ScopeMutator {
+	return func(_ context.Context, scope string) (string, error) {
+		tmpl, err := template.New("scope").Parse(scope)
+		if err != nil {
+			return "", err
+		}
+		var buf bytes.Buffer
+		if err = tmpl.Execute(&buf, params); err != nil {
+			return "", err
+		}
+		return buf.String(), nil
 	}
-	return &permission, nil
 }

pkg/services/accesscontrol/scope_test.go

@@ -1,6 +1,7 @@
 package accesscontrol
 
 import (
+	"context"
 	"testing"
 
 	"github.com/grafana/grafana/pkg/models"
@@ -22,34 +23,156 @@ func TestResolveKeywordedScope(t *testing.T) {
 		name       string
 		user       *models.SignedInUser
 		permission Permission
-		want       *Permission
+		want       Permission
 		wantErr    bool
 	}{
 		{
 			name:       "no scope",
 			user:       testUser,
 			permission: Permission{Action: "users:read"},
-			want:       &Permission{Action: "users:read"},
+			want:       Permission{Action: "users:read"},
 			wantErr:    false,
 		},
 		{
 			name:       "user if resolution",
 			user:       testUser,
 			permission: Permission{Action: "users:read", Scope: "users:self"},
-			want:       &Permission{Action: "users:read", Scope: "users:id:2"},
+			want:       Permission{Action: "users:read", Scope: "users:id:2"},
 			wantErr:    false,
 		},
 	}
 	for _, tt := range tests {
+		var err error
 		t.Run(tt.name, func(t *testing.T) {
 			resolver := NewScopeResolver()
-			resolved, err := resolver.ResolveKeyword(tt.user, tt.permission)
+			scopeModifier := resolver.GetResolveKeywordScopeMutator(tt.user)
+			tt.permission.Scope, err = scopeModifier(context.TODO(), tt.permission.Scope)
 			if tt.wantErr {
 				assert.Error(t, err, "expected an error during the resolution of the scope")
 				return
 			}
 			assert.NoError(t, err)
-			assert.EqualValues(t, tt.want, resolved, "permission did not match expected resolution")
+			assert.EqualValues(t, tt.want, tt.permission, "permission did not match expected resolution")
+		})
+	}
+}
+
+func TestScopeResolver_ResolveAttribute(t *testing.T) {
+	// Calls allow us to see how many times the fakeDataSourceResolution has been called
+	calls := 0
+	fakeDataSourceResolution := func(ctx context.Context, orgID int64, initialScope string) (string, error) {
+		calls++
+		if initialScope == "datasources:name:testds" {
+			return Scope("datasources", "id", "1"), nil
+		} else if initialScope == "datasources:name:testds2" {
+			return Scope("datasources", "id", "2"), nil
+		} else {
+			return "", models.ErrDataSourceNotFound
+		}
+	}
+
+	tests := []struct {
+		name          string
+		orgID         int64
+		evaluator     Evaluator
+		wantEvaluator Evaluator
+		wantCalls     int
+		wantErr       error
+	}{
+		{
+			name:          "should work with scope less permissions",
+			evaluator:     EvalPermission("datasources:read"),
+			wantEvaluator: EvalPermission("datasources:read"),
+			wantCalls:     0,
+		},
+		{
+			name:      "should handle an error",
+			orgID:     1,
+			evaluator: EvalPermission("datasources:read", Scope("datasources", "name", "testds3")),
+			wantErr:   models.ErrDataSourceNotFound,
+			wantCalls: 1,
+		},
+		{
+			name:          "should resolve a scope",
+			orgID:         1,
+			evaluator:     EvalPermission("datasources:read", Scope("datasources", "name", "testds")),
+			wantEvaluator: EvalPermission("datasources:read", Scope("datasources", "id", "1")),
+			wantCalls:     1,
+		},
+		{
+			name:  "should resolve nested scopes with cache",
+			orgID: 1,
+			evaluator: EvalAll(
+				EvalPermission("datasources:read", Scope("datasources", "name", "testds")),
+				EvalAny(
+					EvalPermission("datasources:read", Scope("datasources", "name", "testds")),
+					EvalPermission("datasources:read", Scope("datasources", "name", "testds2")),
+				),
+			),
+			wantEvaluator: EvalAll(
+				EvalPermission("datasources:read", Scope("datasources", "id", "1")),
+				EvalAny(
+					EvalPermission("datasources:read", Scope("datasources", "id", "1")),
+					EvalPermission("datasources:read", Scope("datasources", "id", "2")),
+				),
+			),
+			wantCalls: 2,
+		},
+	}
+	for _, tt := range tests {
+		resolver := NewScopeResolver()
+
+		// Reset calls counter
+		calls = 0
+		// Register a resolution method
+		resolver.AddAttributeResolver("datasources:name:", fakeDataSourceResolution)
+
+		// Test
+		scopeModifier := resolver.GetResolveAttributeScopeMutator(tt.orgID)
+		resolvedEvaluator, err := tt.evaluator.MutateScopes(context.TODO(), scopeModifier)
+		if tt.wantErr != nil {
+			assert.ErrorAs(t, err, &tt.wantErr, "expected an error during the resolution of the scope")
+			return
+		}
+		assert.NoError(t, err)
+		assert.EqualValues(t, tt.wantEvaluator, resolvedEvaluator, "permission did not match expected resolution")
+
+		assert.Equal(t, tt.wantCalls, calls, "cache has not been used")
+	}
+}
+
+func Test_scopePrefix(t *testing.T) {
+	tests := []struct {
+		name  string
+		scope string
+		want  string
+	}{
+		{
+			name:  "empty",
+			scope: "",
+			want:  "",
+		},
+		{
+			name:  "minimal",
+			scope: ":",
+			want:  ":",
+		},
+		{
+			name:  "datasources",
+			scope: "datasources:",
+			want:  "datasources:",
+		},
+		{
+			name:  "datasources name",
+			scope: "datasources:name:testds",
+			want:  "datasources:name:",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prefix := scopePrefix(tt.scope)
+
+			assert.Equal(t, tt.want, prefix)
 		})
 	}
 }