RBAC: Make fixed role UIDs deterministic (#76239)

* Add fixed role UID

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* Use base64 url encoding

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

pkg/services/accesscontrol/models.go

@@ -321,6 +321,7 @@ func (cmd *SaveExternalServiceRoleCommand) Validate() error {
 const (
 	GlobalOrgID                  = 0
 	FixedRolePrefix              = "fixed:"
+	FixedRoleUIDPrefix           = "fixed_"
 	ManagedRolePrefix            = "managed:"
 	BasicRolePrefix              = "basic:"
 	PluginRolePrefix             = "plugins:"

pkg/services/accesscontrol/roles.go

@@ -1,6 +1,9 @@
 package accesscontrol
 
 import (
+	// #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes
+	"crypto/sha1"
+	"encoding/base64"
 	"fmt"
 	"strings"
 	"sync"
@@ -253,6 +256,15 @@ func ConcatPermissions(permissions ...[]Permission) []Permission {
 	return perms
 }
 
+// FixedRoleUID generates a UID of 34 bytes: "fixed_" + base64(sha1(roleName))
+func FixedRoleUID(roleName string) string {
+	// #nosec G505 Used only for generating a 160 bit hash, it's not used for security purposes
+	hasher := sha1.New()
+	hasher.Write([]byte(roleName))
+
+	return fmt.Sprintf("%s%s", FixedRoleUIDPrefix, base64.RawURLEncoding.EncodeToString(hasher.Sum(nil)))
+}
+
 // ValidateFixedRole errors when a fixed role does not match expected pattern
 func ValidateFixedRole(role RoleDTO) error {
 	if !strings.HasPrefix(role.Name, FixedRolePrefix) {