Chore: Add user service method SetUsingOrg and GetSignedInUserWithCacheCtx (#53343)

* Chore: Add user service method SetUsingOrg

* Chore: Add user service method GetSignedInUserWithCacheCtx

* Use method GetSignedInUserWithCacheCtx from user service

* Fix lint after rebase

* Fix lint

* Fix lint error

* roll back some changes

* Roll back changes in api and middleware

* Add xorm tags to SignedInUser ID fields

pkg/services/accesscontrol/accesscontrol.go

@@ -103,7 +103,7 @@ func HasGlobalAccess(ac AccessControl, c *models.ReqContext) func(fallback func(
 		}
 
 		userCopy := *c.SignedInUser
-		userCopy.OrgId = GlobalOrgID
+		userCopy.OrgID = GlobalOrgID
 		userCopy.OrgRole = ""
 		userCopy.OrgName = ""
 		hasAccess, err := ac.Evaluate(c.Req.Context(), &userCopy, evaluator)

pkg/services/accesscontrol/database/resource_permissions_bench_test.go

@@ -57,7 +57,7 @@ func getDSPermissions(b *testing.B, store *AccessControlStore, dataSources []int
 	dsId := dataSources[0]
 
 	permissions, err := store.GetResourcePermissions(context.Background(), accesscontrol.GlobalOrgID, types.GetResourcePermissionsQuery{
-		User:              &user.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: {"org.users:read": {"users:*"}, "teams:read": {"teams:*"}}}},
+		User:              &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: {"org.users:read": {"users:*"}, "teams:read": {"teams:*"}}}},
 		Actions:           []string{dsAction},
 		Resource:          dsResource,
 		ResourceID:        strconv.Itoa(int(dsId)),

pkg/services/accesscontrol/database/resource_permissions_test.go

@@ -351,7 +351,7 @@ func TestAccessControlStore_GetResourcePermissions(t *testing.T) {
 		{
 			desc: "should return permissions for resource id",
 			user: &user.SignedInUser{
-				OrgId: 1,
+				OrgID: 1,
 				Permissions: map[int64]map[string][]string{
 					1: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}},
 				}},
@@ -364,7 +364,7 @@ func TestAccessControlStore_GetResourcePermissions(t *testing.T) {
 		{
 			desc: "should return manage permissions for all resource ids",
 			user: &user.SignedInUser{
-				OrgId: 1,
+				OrgID: 1,
 				Permissions: map[int64]map[string][]string{
 					1: {accesscontrol.ActionOrgUsersRead: {accesscontrol.ScopeUsersAll}},
 				}},
@@ -383,7 +383,7 @@ func TestAccessControlStore_GetResourcePermissions(t *testing.T) {
 
 			err := sql.WithDbSession(context.Background(), func(sess *sqlstore.DBSession) error {
 				role := &accesscontrol.Role{
-					OrgID:   test.user.OrgId,
+					OrgID:   test.user.OrgID,
 					UID:     "seeded",
 					Name:    "seeded",
 					Updated: time.Now(),
@@ -418,7 +418,7 @@ func TestAccessControlStore_GetResourcePermissions(t *testing.T) {
 
 			seedResourcePermissions(t, store, sql, test.actions, test.resource, test.resourceID, test.resourceAttribute, test.numUsers)
 
-			permissions, err := store.GetResourcePermissions(context.Background(), test.user.OrgId, types.GetResourcePermissionsQuery{
+			permissions, err := store.GetResourcePermissions(context.Background(), test.user.OrgID, types.GetResourcePermissionsQuery{
 				User:              test.user,
 				Actions:           test.actions,
 				Resource:          test.resource,

pkg/services/accesscontrol/filter.go

@@ -37,14 +37,14 @@ func Filter(user *user.SignedInUser, sqlID, prefix string, actions ...string) (S
 	if _, ok := sqlIDAcceptList[sqlID]; !ok {
 		return denyQuery, errors.New("sqlID is not in the accept list")
 	}
-	if user == nil || user.Permissions == nil || user.Permissions[user.OrgId] == nil {
+	if user == nil || user.Permissions == nil || user.Permissions[user.OrgID] == nil {
 		return denyQuery, errors.New("missing permissions")
 	}
 
 	wildcards := 0
 	result := make(map[interface{}]int)
 	for _, a := range actions {
-		ids, hasWildcard := ParseScopes(prefix, user.Permissions[user.OrgId][a])
+		ids, hasWildcard := ParseScopes(prefix, user.Permissions[user.OrgID][a])
 		if hasWildcard {
 			wildcards += 1
 			continue

pkg/services/accesscontrol/filter_bench_test.go

@@ -33,7 +33,7 @@ func benchmarkFilter(b *testing.B, numDs, numPermissions int) {
 	for i := 0; i < b.N; i++ {
 		baseSql := `SELECT data_source.* FROM data_source WHERE`
 		acFilter, err := accesscontrol.Filter(
-			&user.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(permissions)}},
+			&user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(permissions)}},
 			"data_source.id",
 			"datasources:id:",
 			"datasources:read",

pkg/services/accesscontrol/filter_test.go

@@ -178,7 +178,7 @@ func TestFilter_Datasources(t *testing.T) {
 			baseSql := `SELECT data_source.* FROM data_source WHERE`
 			acFilter, err := accesscontrol.Filter(
 				&user.SignedInUser{
-					OrgId:       1,
+					OrgID:       1,
 					Permissions: map[int64]map[string][]string{1: tt.permissions},
 				},
 				tt.sqlID,

pkg/services/accesscontrol/middleware.go

@@ -28,7 +28,7 @@ func Middleware(ac AccessControl) func(web.Handler, Evaluator) web.Handler {
 
 func authorize(c *models.ReqContext, ac AccessControl, user *user.SignedInUser, evaluator Evaluator) {
 	injected, err := evaluator.MutateScopes(c.Req.Context(), ScopeInjector(ScopeParams{
-		OrgID:     c.OrgId,
+		OrgID:     c.OrgID,
 		URLParams: web.Params(c.Req),
 	}))
 	if err != nil {
@@ -50,7 +50,7 @@ func deny(c *models.ReqContext, evaluator Evaluator, err error) {
 	} else {
 		c.Logger.Info(
 			"Access denied",
-			"userID", c.UserId,
+			"userID", c.UserID,
 			"accessErrorID", id,
 			"permissions", evaluator.GoString(),
 		)
@@ -110,16 +110,17 @@ func AuthorizeInOrgMiddleware(ac AccessControl, cache userCache) func(web.Handle
 				return
 			}
 			if orgID == GlobalOrgID {
-				userCopy.OrgId = orgID
+				userCopy.OrgID = orgID
 				userCopy.OrgName = ""
 				userCopy.OrgRole = ""
 			} else {
-				query := models.GetSignedInUserQuery{UserId: c.UserId, OrgId: orgID}
-				if err := cache.GetSignedInUserWithCacheCtx(c.Req.Context(), &query); err != nil {
+				query := models.GetSignedInUserQuery{UserId: c.UserID, OrgId: orgID}
+				err := cache.GetSignedInUserWithCacheCtx(c.Req.Context(), &query)
+				if err != nil {
 					deny(c, nil, fmt.Errorf("failed to authenticate user in target org: %w", err))
 					return
 				}
-				userCopy.OrgId = query.Result.OrgId
+				userCopy.OrgID = query.Result.OrgID
 				userCopy.OrgName = query.Result.OrgName
 				userCopy.OrgRole = query.Result.OrgRole
 			}
@@ -163,6 +164,6 @@ func LoadPermissionsMiddleware(ac AccessControl) web.Handler {
 		if c.SignedInUser.Permissions == nil {
 			c.SignedInUser.Permissions = make(map[int64]map[string][]string)
 		}
-		c.SignedInUser.Permissions[c.OrgId] = GroupScopesByAction(permissions)
+		c.SignedInUser.Permissions[c.OrgID] = GroupScopesByAction(permissions)
 	}
 }

pkg/services/accesscontrol/mock/mock.go

@@ -84,27 +84,27 @@ func (m Mock) WithBuiltInRoles(builtInRoles []string) *Mock {
 
 // Evaluate evaluates access to the given resource.
 // This mock uses GetUserPermissions to then call the evaluator Evaluate function.
-func (m *Mock) Evaluate(ctx context.Context, user *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
-	m.Calls.Evaluate = append(m.Calls.Evaluate, []interface{}{ctx, user, evaluator})
+func (m *Mock) Evaluate(ctx context.Context, usr *user.SignedInUser, evaluator accesscontrol.Evaluator) (bool, error) {
+	m.Calls.Evaluate = append(m.Calls.Evaluate, []interface{}{ctx, usr, evaluator})
 	// Use override if provided
 	if m.EvaluateFunc != nil {
-		return m.EvaluateFunc(ctx, user, evaluator)
+		return m.EvaluateFunc(ctx, usr, evaluator)
 	}
 
 	var permissions map[string][]string
-	if user.Permissions != nil && user.Permissions[user.OrgId] != nil {
-		permissions = user.Permissions[user.OrgId]
+	if usr.Permissions != nil && usr.Permissions[usr.OrgID] != nil {
+		permissions = usr.Permissions[usr.OrgID]
 	}
 
 	if permissions == nil {
-		userPermissions, err := m.GetUserPermissions(ctx, user, accesscontrol.Options{ReloadCache: true})
+		userPermissions, err := m.GetUserPermissions(ctx, usr, accesscontrol.Options{ReloadCache: true})
 		if err != nil {
 			return false, err
 		}
 		permissions = accesscontrol.GroupScopesByAction(userPermissions)
 	}
 
-	attributeMutator := m.scopeResolvers.GetScopeAttributeMutator(user.OrgId)
+	attributeMutator := m.scopeResolvers.GetScopeAttributeMutator(usr.OrgID)
 	resolvedEvaluator, err := evaluator.MutateScopes(ctx, attributeMutator)
 	if err != nil {
 		return false, err

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -86,20 +86,20 @@ func (ac *OSSAccessControlService) Evaluate(ctx context.Context, user *user.Sign
 		user.Permissions = map[int64]map[string][]string{}
 	}
 
-	if _, ok := user.Permissions[user.OrgId]; !ok {
+	if _, ok := user.Permissions[user.OrgID]; !ok {
 		permissions, err := ac.GetUserPermissions(ctx, user, accesscontrol.Options{ReloadCache: true})
 		if err != nil {
 			return false, err
 		}
-		user.Permissions[user.OrgId] = accesscontrol.GroupScopesByAction(permissions)
+		user.Permissions[user.OrgID] = accesscontrol.GroupScopesByAction(permissions)
 	}
 
-	attributeMutator := ac.scopeResolvers.GetScopeAttributeMutator(user.OrgId)
+	attributeMutator := ac.scopeResolvers.GetScopeAttributeMutator(user.OrgID)
 	resolvedEvaluator, err := evaluator.MutateScopes(ctx, attributeMutator)
 	if err != nil {
 		return false, err
 	}
-	return resolvedEvaluator.Evaluate(user.Permissions[user.OrgId]), nil
+	return resolvedEvaluator.Evaluate(user.Permissions[user.OrgID]), nil
 }
 
 // GetUserPermissions returns user permissions based on built-in roles
@@ -110,8 +110,8 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 	permissions := ac.getFixedPermissions(ctx, user)
 
 	dbPermissions, err := ac.store.GetUserPermissions(ctx, accesscontrol.GetUserPermissionsQuery{
-		OrgID:   user.OrgId,
-		UserID:  user.UserId,
+		OrgID:   user.OrgID,
+		UserID:  user.UserID,
 		Roles:   accesscontrol.GetOrgRoles(ac.cfg, user),
 		Actions: append(TeamAdminActions, append(DashboardAdminActions, FolderAdminActions...)...),
 	})

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol_test.go

@@ -102,8 +102,8 @@ func TestEvaluatingPermissions(t *testing.T) {
 			require.NoError(t, errRegisterRoles)
 
 			user := &user.SignedInUser{
-				UserId:         1,
-				OrgId:          1,
+				UserID:         1,
+				OrgID:          1,
 				Name:           tc.user.name,
 				OrgRole:        tc.user.orgRole,
 				IsGrafanaAdmin: tc.user.isGrafanaAdmin,
@@ -360,8 +360,8 @@ func TestOSSAccessControlService_RegisterFixedRoles(t *testing.T) {
 
 func TestOSSAccessControlService_GetUserPermissions(t *testing.T) {
 	testUser := user.SignedInUser{
-		UserId:  2,
-		OrgId:   3,
+		UserID:  2,
+		OrgID:   3,
 		OrgName: "TestOrg",
 		OrgRole: org.RoleViewer,
 		Login:   "testUser",
@@ -422,8 +422,8 @@ func TestOSSAccessControlService_GetUserPermissions(t *testing.T) {
 
 func TestOSSAccessControlService_Evaluate(t *testing.T) {
 	testUser := user.SignedInUser{
-		UserId:  2,
-		OrgId:   3,
+		UserID:  2,
+		OrgID:   3,
 		OrgName: "TestOrg",
 		OrgRole: org.RoleViewer,
 		Login:   "testUser",

pkg/services/accesscontrol/resolvers.go

@@ -136,5 +136,5 @@ func ScopeInjector(params ScopeParams) ScopeAttributeMutator {
 }
 
 var userSelfResolver = ScopeKeywordResolverFunc(func(ctx context.Context, user *user.SignedInUser) (string, error) {
-	return Scope("users", "id", fmt.Sprintf("%v", user.UserId)), nil
+	return Scope("users", "id", fmt.Sprintf("%v", user.UserID)), nil
 })

pkg/services/accesscontrol/resolvers_test.go

@@ -52,8 +52,8 @@ func TestResolveKeywordScope(t *testing.T) {
 }
 
 var testUser = &user.SignedInUser{
-	UserId:  2,
-	OrgId:   3,
+	UserID:  2,
+	OrgID:   3,
 	OrgName: "TestOrg",
 	OrgRole: org.RoleViewer,
 	Login:   "testUser",

pkg/services/accesscontrol/resourcepermissions/api.go

@@ -146,7 +146,7 @@ func (a *api) setUserPermission(c *models.ReqContext) response.Response {
 		return response.Error(http.StatusBadRequest, "bad request data", err)
 	}
 
-	_, err = a.service.SetUserPermission(c.Req.Context(), c.OrgId, accesscontrol.User{ID: userID}, resourceID, cmd.Permission)
+	_, err = a.service.SetUserPermission(c.Req.Context(), c.OrgID, accesscontrol.User{ID: userID}, resourceID, cmd.Permission)
 	if err != nil {
 		return response.Error(http.StatusBadRequest, "failed to set user permission", err)
 	}
@@ -166,7 +166,7 @@ func (a *api) setTeamPermission(c *models.ReqContext) response.Response {
 		return response.Error(http.StatusBadRequest, "bad request data", err)
 	}
 
-	_, err = a.service.SetTeamPermission(c.Req.Context(), c.OrgId, teamID, resourceID, cmd.Permission)
+	_, err = a.service.SetTeamPermission(c.Req.Context(), c.OrgID, teamID, resourceID, cmd.Permission)
 	if err != nil {
 		return response.Error(http.StatusBadRequest, "failed to set team permission", err)
 	}
@@ -183,7 +183,7 @@ func (a *api) setBuiltinRolePermission(c *models.ReqContext) response.Response {
 		return response.Error(http.StatusBadRequest, "bad request data", err)
 	}
 
-	_, err := a.service.SetBuiltInRolePermission(c.Req.Context(), c.OrgId, builtInRole, resourceID, cmd.Permission)
+	_, err := a.service.SetBuiltInRolePermission(c.Req.Context(), c.OrgID, builtInRole, resourceID, cmd.Permission)
 	if err != nil {
 		return response.Error(http.StatusBadRequest, "failed to set role permission", err)
 	}

pkg/services/accesscontrol/resourcepermissions/api_test.go

@@ -113,7 +113,7 @@ func TestApi_getDescription(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			service, _ := setupTestEnvironment(t, tt.permissions, tt.options)
-			server := setupTestServer(t, &user.SignedInUser{OrgId: 1}, service)
+			server := setupTestServer(t, &user.SignedInUser{OrgID: 1}, service)
 
 			req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("/api/access-control/%s/description", tt.options.Resource), nil)
 			require.NoError(t, err)
@@ -160,7 +160,7 @@ func TestApi_getPermissions(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			service, sql := setupTestEnvironment(t, tt.permissions, testOptions)
-			server := setupTestServer(t, &user.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
+			server := setupTestServer(t, &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
 
 			seedPermissions(t, tt.resourceID, sql, service)
 
@@ -237,7 +237,7 @@ func TestApi_setBuiltinRolePermission(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			service, _ := setupTestEnvironment(t, tt.permissions, testOptions)
-			server := setupTestServer(t, &user.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
+			server := setupTestServer(t, &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
 
 			recorder := setPermission(t, server, testOptions.Resource, tt.resourceID, tt.permission, "builtInRoles", tt.builtInRole)
 			assert.Equal(t, tt.expectedStatus, recorder.Code)
@@ -315,7 +315,7 @@ func TestApi_setTeamPermission(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			service, sql := setupTestEnvironment(t, tt.permissions, testOptions)
-			server := setupTestServer(t, &user.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
+			server := setupTestServer(t, &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
 
 			// seed team
 			_, err := sql.CreateTeam("test", "test@test.com", 1)
@@ -398,7 +398,7 @@ func TestApi_setUserPermission(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
 			service, sql := setupTestEnvironment(t, tt.permissions, testOptions)
-			server := setupTestServer(t, &user.SignedInUser{OrgId: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
+			server := setupTestServer(t, &user.SignedInUser{OrgID: 1, Permissions: map[int64]map[string][]string{1: accesscontrol.GroupScopesByAction(tt.permissions)}}, service)
 
 			// seed user
 			_, err := sql.CreateUser(context.Background(), user.CreateUserCommand{Login: "test", OrgID: 1})

pkg/services/accesscontrol/resourcepermissions/middleware.go

@@ -15,7 +15,7 @@ func solveInheritedScopes(solve InheritedScopesSolver) web.Handler {
 	return func(c *models.ReqContext) {
 		if solve != nil && util.IsValidShortUID(web.Params(c.Req)[":resourceID"]) {
 			params := web.Params(c.Req)
-			scopes, err := solve(c.Req.Context(), c.OrgId, params[":resourceID"])
+			scopes, err := solve(c.Req.Context(), c.OrgID, params[":resourceID"])
 			if err != nil {
 				c.JsonApiErr(http.StatusNotFound, "Resource not found", err)
 				return

pkg/services/accesscontrol/resourcepermissions/service.go

@@ -111,13 +111,13 @@ func (s *Service) GetPermissions(ctx context.Context, user *user.SignedInUser, r
 	var inheritedScopes []string
 	if s.options.InheritedScopesSolver != nil {
 		var err error
-		inheritedScopes, err = s.options.InheritedScopesSolver(ctx, user.OrgId, resourceID)
+		inheritedScopes, err = s.options.InheritedScopesSolver(ctx, user.OrgID, resourceID)
 		if err != nil {
 			return nil, err
 		}
 	}
 
-	return s.store.GetResourcePermissions(ctx, user.OrgId, types.GetResourcePermissionsQuery{
+	return s.store.GetResourcePermissions(ctx, user.OrgID, types.GetResourcePermissionsQuery{
 		User:              user,
 		Actions:           s.actions,
 		Resource:          s.options.Resource,