Access control: expose permissions to the frontend (#32954)

* Expose user permissions to the frontend

* Do not include empty scope

* Extend ContextSrv with hasPermission() method

* Add access control types

* Fix type error (make permissions optional)

* Fallback if access control disabled

* Move UserPermission to types

* Simplify hasPermission()

public/app/core/services/context_srv.ts

@@ -2,6 +2,7 @@ import config from '../../core/config';
 import _ from 'lodash';
 import coreModule from 'app/core/core_module';
 import { rangeUtil } from '@grafana/data';
+import { AccessControlAction, AccessControlScope, UserPermission } from 'app/types';
 
 export class User {
   id: number;
@@ -17,6 +18,7 @@ export class User {
   lightTheme: boolean;
   hasEditPermissionInFolders: boolean;
   email?: string;
+  permissions?: UserPermission;
 
   constructor() {
     this.id = 0;
@@ -74,6 +76,16 @@ export class ContextSrv {
     return this.user.orgRole === role;
   }
 
+  // Checks whether user has required permission
+  hasPermission(action: AccessControlAction, scope?: AccessControlScope): boolean {
+    // Fallback if access control disabled
+    if (!config.featureToggles['accesscontrol']) {
+      return true;
+    }
+
+    return !!(this.user.permissions?.[action] && (scope ? this.user.permissions[action][scope] : true));
+  }
+
   isGrafanaVisible() {
     return !!(document.visibilityState === undefined || document.visibilityState === 'visible');
   }

public/app/types/accessControl.ts

@@ -0,0 +1,38 @@
+/**
+ * UserPermission is a map storing permissions in a form of
+ * {
+ *   action: { scope: scope }
+ * }
+ */
+export type UserPermission = {
+  [key: string]: { [key: string]: string };
+};
+
+export interface AccessControlPermission {
+  action: AccessControlAction;
+  scope?: AccessControlScope;
+}
+
+// Permission actions
+export enum AccessControlAction {
+  UsersRead = 'users:read',
+  UsersWrite = 'users:write',
+  UsersTeamRead = 'users.teams:read',
+  UsersAuthTokenList = 'users.authtoken:list',
+  UsersAuthTokenUpdate = 'users.authtoken:update',
+  UsersPasswordUpdate = 'users.password.update',
+  UsersDelete = 'users:delete',
+  UsersCreate = 'users:create',
+  UsersEnable = 'users:enable',
+  UsersDisable = 'users:disable',
+  UsersPermissionsUpdate = 'users.permissions.update',
+  UsersLogout = 'users:logout',
+  UsersQuotasList = 'users.quotas:list',
+  UsersQuotasUpdate = 'users.quotas:update',
+}
+
+// Global Scopes
+export enum AccessControlScope {
+  UsersAll = 'users:*',
+  UsersSelf = 'users:self',
+}

public/app/types/index.ts

@@ -17,6 +17,7 @@ export * from './appEvent';
 export * from './angular';
 export * from './query';
 export * from './preferences';
+export * from './accessControl';
 
 import * as CoreEvents from './events';
 export { CoreEvents };