diff --git a/pkg/api/accesscontrol.go b/pkg/api/accesscontrol.go index 2ba234c8a69..65136a3cf86 100644 --- a/pkg/api/accesscontrol.go +++ b/pkg/api/accesscontrol.go @@ -7,7 +7,6 @@ import ( contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model" "github.com/grafana/grafana/pkg/services/dashboards" "github.com/grafana/grafana/pkg/services/datasources" - "github.com/grafana/grafana/pkg/services/featuremgmt" "github.com/grafana/grafana/pkg/services/libraryelements" "github.com/grafana/grafana/pkg/services/org" "github.com/grafana/grafana/pkg/services/pluginsintegration/pluginaccesscontrol" @@ -459,7 +458,7 @@ func (hs *HTTPServer) declareFixedRoles() error { Description: "Read all library panels.", Group: "Library panels", Permissions: []ac.Permission{ - {Action: libraryelements.ActionLibraryPanelsRead, Scope: libraryelements.ScopeLibraryPanelsAll}, + {Action: libraryelements.ActionLibraryPanelsRead, Scope: dashboards.ScopeFoldersAll}, }, }, Grants: []string{"Admin"}, @@ -485,9 +484,9 @@ func (hs *HTTPServer) declareFixedRoles() error { Group: "Library panels", Description: "Create, read, write or delete all library panels and their permissions.", Permissions: ac.ConcatPermissions(libraryPanelsReaderRole.Role.Permissions, []ac.Permission{ - {Action: libraryelements.ActionLibraryPanelsWrite, Scope: libraryelements.ScopeLibraryPanelsAll}, - {Action: libraryelements.ActionLibraryPanelsDelete, Scope: libraryelements.ScopeLibraryPanelsAll}, - {Action: libraryelements.ActionLibraryPanelsCreate, Scope: libraryelements.ScopeLibraryPanelsAll}, + {Action: libraryelements.ActionLibraryPanelsWrite, Scope: dashboards.ScopeFoldersAll}, + {Action: libraryelements.ActionLibraryPanelsDelete, Scope: dashboards.ScopeFoldersAll}, + {Action: libraryelements.ActionLibraryPanelsCreate, Scope: dashboards.ScopeFoldersAll}, }), }, Grants: []string{"Admin"}, @@ -553,11 +552,8 @@ func (hs *HTTPServer) declareFixedRoles() error { annotationsReaderRole, dashboardAnnotationsWriterRole, annotationsWriterRole, dashboardsCreatorRole, dashboardsReaderRole, dashboardsWriterRole, foldersCreatorRole, foldersReaderRole, foldersWriterRole, apikeyReaderRole, apikeyWriterRole, - publicDashboardsWriterRole, featuremgmtReaderRole, featuremgmtWriterRole} - - if hs.Features.IsEnabled(featuremgmt.FlagLibraryPanelRBAC) { - roles = append(roles, libraryPanelsCreatorRole, libraryPanelsReaderRole, libraryPanelsWriterRole, libraryPanelsGeneralReaderRole, libraryPanelsGeneralWriterRole) - } + publicDashboardsWriterRole, featuremgmtReaderRole, featuremgmtWriterRole, libraryPanelsCreatorRole, + libraryPanelsReaderRole, libraryPanelsWriterRole, libraryPanelsGeneralReaderRole, libraryPanelsGeneralWriterRole} return hs.accesscontrolService.DeclareFixedRoles(roles...) }