Access control: Set default permissions for data sources when using access control (#45482)

* Rename interfaces and use then with wire injection

* Set default permissions when creating new data source

pkg/services/accesscontrol/accesscontrol.go

@@ -37,7 +37,12 @@ type PermissionsProvider interface {
 	GetUserPermissions(ctx context.Context, query GetUserPermissionsQuery) ([]*Permission, error)
 }
 
-type ResourcePermissionsService interface {
+type PermissionsServices interface {
+	GetTeamService() PermissionsService
+	GetDataSourceService() PermissionsService
+}
+
+type PermissionsService interface {
 	// GetPermissions returns all permissions for given resourceID
 	GetPermissions(ctx context.Context, orgID int64, resourceID string) ([]ResourcePermission, error)
 	// SetUserPermission sets permission on resource for a user

pkg/services/accesscontrol/mock/permissions_services_mock.go

@@ -0,0 +1,27 @@
+package mock
+
+import (
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+)
+
+var _ accesscontrol.PermissionsServices = new(PermissionsServicesMock)
+
+func NewPermissionsServicesMock() *PermissionsServicesMock {
+	return &PermissionsServicesMock{
+		teams:       &MockPermissionsService{},
+		datasources: &MockPermissionsService{},
+	}
+}
+
+type PermissionsServicesMock struct {
+	teams       *MockPermissionsService
+	datasources *MockPermissionsService
+}
+
+func (p PermissionsServicesMock) GetTeamService() accesscontrol.PermissionsService {
+	return p.teams
+}
+
+func (p PermissionsServicesMock) GetDataSourceService() accesscontrol.PermissionsService {
+	return p.datasources
+}

pkg/services/accesscontrol/mock/service_mock.go

@@ -0,0 +1,40 @@
+package mock
+
+import (
+	"context"
+
+	"github.com/stretchr/testify/mock"
+
+	"github.com/grafana/grafana/pkg/services/accesscontrol"
+)
+
+var _ accesscontrol.PermissionsService = new(MockPermissionsService)
+
+type MockPermissionsService struct {
+	mock.Mock
+}
+
+func (m *MockPermissionsService) GetPermissions(ctx context.Context, orgID int64, resourceID string) ([]accesscontrol.ResourcePermission, error) {
+	mockedArgs := m.Called(ctx, orgID, resourceID)
+	return mockedArgs.Get(0).([]accesscontrol.ResourcePermission), mockedArgs.Error(1)
+}
+
+func (m *MockPermissionsService) SetUserPermission(ctx context.Context, orgID int64, user accesscontrol.User, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
+	mockedArgs := m.Called(ctx, orgID, user, resourceID, permission)
+	return mockedArgs.Get(0).(*accesscontrol.ResourcePermission), mockedArgs.Error(1)
+}
+
+func (m *MockPermissionsService) SetTeamPermission(ctx context.Context, orgID, teamID int64, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
+	mockedArgs := m.Called(ctx, orgID, teamID, resourceID, permission)
+	return mockedArgs.Get(0).(*accesscontrol.ResourcePermission), mockedArgs.Error(1)
+}
+
+func (m *MockPermissionsService) SetBuiltInRolePermission(ctx context.Context, orgID int64, builtInRole, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
+	mockedArgs := m.Called(ctx, orgID, builtInRole, resourceID, permission)
+	return mockedArgs.Get(0).(*accesscontrol.ResourcePermission), mockedArgs.Error(1)
+}
+
+func (m *MockPermissionsService) SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...accesscontrol.SetResourcePermissionCommand) ([]accesscontrol.ResourcePermission, error) {
+	mockedArgs := m.Called(ctx, orgID, resourceID, commands)
+	return mockedArgs.Get(0).([]accesscontrol.ResourcePermission), mockedArgs.Error(1)
+}

pkg/services/accesscontrol/ossaccesscontrol/ossaccesscontrol.go

@@ -11,7 +11,6 @@ import (
 	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/api"
-	"github.com/grafana/grafana/pkg/services/accesscontrol/resourceservices"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/prometheus/client_golang/prometheus"
 )
@@ -116,7 +115,7 @@ func (ac *OSSAccessControlService) GetUserPermissions(ctx context.Context, user
 		OrgID:   user.OrgId,
 		UserID:  user.UserId,
 		Roles:   ac.GetUserBuiltInRoles(user),
-		Actions: resourceservices.TeamAdminActions,
+		Actions: TeamAdminActions,
 	})
 	if err != nil {
 		return nil, err

pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go

@@ -1,4 +1,4 @@
-package resourceservices
+package ossaccesscontrol
 
 import (
 	"context"
@@ -12,23 +12,26 @@ import (
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 )
 
-func ProvideResourceServices(router routing.RouteRegister, sql *sqlstore.SQLStore, ac accesscontrol.AccessControl, store resourcepermissions.Store) (*ResourceServices, error) {
+func ProvidePermissionsServices(router routing.RouteRegister, sql *sqlstore.SQLStore, ac accesscontrol.AccessControl, store resourcepermissions.Store) (*PermissionsService, error) {
 	teamPermissions, err := ProvideTeamPermissions(router, sql, ac, store)
 	if err != nil {
 		return nil, err
 	}
 
-	return &ResourceServices{services: map[string]*resourcepermissions.Service{
-		"teams": teamPermissions,
-	}}, nil
+	return &PermissionsService{teams: teamPermissions, datasources: provideEmptyPermissionsService()}, nil
 }
 
-type ResourceServices struct {
-	services map[string]*resourcepermissions.Service
+type PermissionsService struct {
+	teams       accesscontrol.PermissionsService
+	datasources accesscontrol.PermissionsService
 }
 
-func (s *ResourceServices) GetTeamService() *resourcepermissions.Service {
-	return s.services["teams"]
+func (s *PermissionsService) GetTeamService() accesscontrol.PermissionsService {
+	return s.teams
+}
+
+func (s *PermissionsService) GetDataSourceService() accesscontrol.PermissionsService {
+	return s.datasources
 }
 
 var (
@@ -101,3 +104,31 @@ func ProvideTeamPermissions(router routing.RouteRegister, sql *sqlstore.SQLStore
 
 	return resourcepermissions.New(options, router, ac, store, sql)
 }
+
+func provideEmptyPermissionsService() accesscontrol.PermissionsService {
+	return &emptyPermissionsService{}
+}
+
+var _ accesscontrol.PermissionsService = new(emptyPermissionsService)
+
+type emptyPermissionsService struct{}
+
+func (e emptyPermissionsService) GetPermissions(ctx context.Context, orgID int64, resourceID string) ([]accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetUserPermission(ctx context.Context, orgID int64, user accesscontrol.User, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetTeamPermission(ctx context.Context, orgID, teamID int64, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetBuiltInRolePermission(ctx context.Context, orgID int64, builtInRole string, resourceID string, permission string) (*accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}
+
+func (e emptyPermissionsService) SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...accesscontrol.SetResourcePermissionCommand) ([]accesscontrol.ResourcePermission, error) {
+	return nil, nil
+}

pkg/services/accesscontrol/resourcepermissions/service_mock.go

@@ -1,40 +0,0 @@
-package resourcepermissions
-
-import (
-	"context"
-
-	"github.com/stretchr/testify/mock"
-
-	"github.com/grafana/grafana/pkg/services/accesscontrol"
-)
-
-var _ accesscontrol.ResourcePermissionsService = new(MockService)
-
-type MockService struct {
-	mock.Mock
-}
-
-func (m *MockService) GetPermissions(ctx context.Context, orgID int64, resourceID string) ([]accesscontrol.ResourcePermission, error) {
-	mockedArgs := m.Called(ctx, orgID, resourceID)
-	return mockedArgs.Get(0).([]accesscontrol.ResourcePermission), mockedArgs.Error(1)
-}
-
-func (m *MockService) SetUserPermission(ctx context.Context, orgID int64, user accesscontrol.User, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
-	mockedArgs := m.Called(ctx, orgID, user, resourceID, permission)
-	return mockedArgs.Get(0).(*accesscontrol.ResourcePermission), mockedArgs.Error(1)
-}
-
-func (m *MockService) SetTeamPermission(ctx context.Context, orgID, teamID int64, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
-	mockedArgs := m.Called(ctx, orgID, teamID, resourceID, permission)
-	return mockedArgs.Get(0).(*accesscontrol.ResourcePermission), mockedArgs.Error(1)
-}
-
-func (m *MockService) SetBuiltInRolePermission(ctx context.Context, orgID int64, builtInRole, resourceID, permission string) (*accesscontrol.ResourcePermission, error) {
-	mockedArgs := m.Called(ctx, orgID, builtInRole, resourceID, permission)
-	return mockedArgs.Get(0).(*accesscontrol.ResourcePermission), mockedArgs.Error(1)
-}
-
-func (m *MockService) SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...accesscontrol.SetResourcePermissionCommand) ([]accesscontrol.ResourcePermission, error) {
-	mockedArgs := m.Called(ctx, orgID, resourceID, commands)
-	return mockedArgs.Get(0).([]accesscontrol.ResourcePermission), mockedArgs.Error(1)
-}