DataSourcePermissions: Handle licensing properly for ds permissions (#59694)

* RBAC: add viewer grand if dspermissions enforcement is not enabled

* RBAC: Change permissions based on role prefix

* RBAC: Add option to for permission service to add a license middleware

* RBAC: Remove actions from query struct

pkg/services/accesscontrol/database/database.go

@@ -35,16 +35,11 @@ func (s *AccessControlStore) GetUserPermissions(ctx context.Context, query acces
 			INNER JOIN role ON role.id = permission.role_id
 		` + filter
 
-		if len(query.Actions) > 0 {
-			q += " WHERE permission.action IN("
-			if len(query.Actions) > 0 {
-				q += "?" + strings.Repeat(",?", len(query.Actions)-1)
-			}
-			q += ")"
-			for _, a := range query.Actions {
-				params = append(params, a)
-			}
+		if query.RolePrefix != "" {
+			q += " WHERE role.name LIKE ?"
+			params = append(params, query.RolePrefix+"%")
 		}
+
 		if err := sess.SQL(q, params...).Find(&result); err != nil {
 			return err
 		}

pkg/services/accesscontrol/database/database_test.go

@@ -30,7 +30,6 @@ type getUserPermissionsTestCase struct {
 	userPermissions    []string
 	teamPermissions    []string
 	builtinPermissions []string
-	actions            []string
 	expected           int
 }
 
@@ -63,16 +62,6 @@ func TestAccessControlStore_GetUserPermissions(t *testing.T) {
 			builtinPermissions: []string{"5", "6"},
 			expected:           5,
 		},
-		{
-			desc:               "Should filter on actions",
-			orgID:              1,
-			role:               "",
-			userPermissions:    []string{"1", "2", "10"},
-			teamPermissions:    []string{"100", "2"},
-			builtinPermissions: []string{"5", "6"},
-			expected:           3,
-			actions:            []string{"dashboards:write"},
-		},
 		{
 			desc:               "should only get br permissions for anonymous user",
 			anonymousUser:      true,
@@ -137,7 +126,6 @@ func TestAccessControlStore_GetUserPermissions(t *testing.T) {
 				OrgID:   tt.orgID,
 				UserID:  userID,
 				Roles:   roles,
-				Actions: tt.actions,
 				TeamIDs: teamIDs,
 			})