Change permissions used for finishing plugin setup

grafana-plugin/src/state/rootBaseStore/index.ts

@@ -1,3 +1,5 @@
+import { OrgRole } from '@grafana/data';
+import { contextSrv } from 'grafana/app/core/core';
 import { action, observable } from 'mobx';
 import moment from 'moment-timezone';
 import qs from 'query-string';
@@ -32,7 +34,6 @@ import { UserGroupStore } from 'models/user_group/user_group';
 import { makeRequest } from 'network';
 import { AppFeature } from 'state/features';
 import PluginState from 'state/plugin';
-import { isUserActionAllowed, UserActions } from 'utils/authorization';
 import { GRAFANA_LICENSE_OSS } from 'utils/consts';
 
 // ------ Dashboard ------ //
@@ -184,22 +185,42 @@ export class RootBaseStore {
       if (!allow_signup) {
         return this.setupPluginError('🚫 OnCall has temporarily disabled signup of new users. Please try again later.');
       }
-
-      if (!isUserActionAllowed(UserActions.PluginsInstall)) {
-        return this.setupPluginError(
-          '🚫 An Admin in your organization must sign on and setup OnCall before it can be used'
-        );
-      }
-
-      try {
-        /**
-         * this will install AND sync the necessary data
-         * the sync is done automatically by the /plugin/install OnCall API endpoint
-         * therefore there is no need to trigger an additional/separate sync, nor poll a status
-         */
-        await PluginState.installPlugin();
-      } catch (e) {
-        return this.setupPluginError(PluginState.getHumanReadableErrorFromOnCallError(e, this.onCallApiUrl, 'install'));
+      const fallback = contextSrv.user.orgRole === OrgRole.Admin && !contextSrv.accessControlEnabled();
+      const setupRequiredPermissions = [
+        'plugins:write',
+        'users:read',
+        'teams:read',
+        'apikeys:create',
+        'apikeys:delete',
+      ];
+      const missingPermissions = setupRequiredPermissions.filter(function (permission) {
+        return !contextSrv.hasAccess(permission, fallback);
+      });
+      if (missingPermissions.length === 0) {
+        try {
+          /**
+           * this will install AND sync the necessary data
+           * the sync is done automatically by the /plugin/install OnCall API endpoint
+           * therefore there is no need to trigger an additional/separate sync, nor poll a status
+           */
+          await PluginState.installPlugin();
+        } catch (e) {
+          return this.setupPluginError(
+            PluginState.getHumanReadableErrorFromOnCallError(e, this.onCallApiUrl, 'install')
+          );
+        }
+      } else {
+        if (contextSrv.accessControlEnabled()) {
+          return this.setupPluginError(
+            '🚫 User is missing permission(s) ' +
+              missingPermissions.join(', ') +
+              ' to setup OnCall before it can be used'
+          );
+        } else {
+          return this.setupPluginError(
+            '🚫 User with Admin permissions in your organization must sign on and setup OnCall before it can be used'
+          );
+        }
       }
     } else {
       const syncDataResponse = await PluginState.syncDataWithOnCall(this.onCallApiUrl);

grafana-plugin/src/state/rootBaseStore/rootBaseStore.test.ts

@@ -1,7 +1,7 @@
 import { OnCallAppPluginMeta } from 'types';
 
 import PluginState from 'state/plugin';
-import { UserActions, isUserActionAllowed as isUserActionAllowedOriginal } from 'utils/authorization';
+import { isUserActionAllowed as isUserActionAllowedOriginal } from 'utils/authorization';
 
 import { RootBaseStore } from './';
 
@@ -10,8 +10,6 @@ jest.mock('utils/authorization');
 
 const isUserActionAllowed = isUserActionAllowedOriginal as jest.Mock<ReturnType<typeof isUserActionAllowedOriginal>>;
 
-const PluginInstallAction = UserActions.PluginsInstall;
-
 const generatePluginData = (
   onCallApiUrl: OnCallAppPluginMeta['jsonData']['onCallApiUrl'] = null
 ): OnCallAppPluginMeta =>
@@ -159,14 +157,13 @@ describe('rootBaseStore', () => {
     expect(PluginState.checkIfPluginIsConnected).toHaveBeenCalledTimes(1);
     expect(PluginState.checkIfPluginIsConnected).toHaveBeenCalledWith(onCallApiUrl);
 
-    expect(isUserActionAllowed).toHaveBeenCalledTimes(1);
-    expect(isUserActionAllowed).toHaveBeenCalledWith(PluginInstallAction);
+    // todo: add check for access
 
     expect(PluginState.installPlugin).toHaveBeenCalledTimes(0);
 
     expect(rootBaseStore.appLoading).toBe(false);
     expect(rootBaseStore.initializationError).toEqual(
-      '🚫 An Admin in your organization must sign on and setup OnCall before it can be used'
+      '🚫 User with Admin permissions in your organization must sign on and setup OnCall before it can be used'
     );
   });
 
@@ -198,8 +195,7 @@ describe('rootBaseStore', () => {
     expect(PluginState.checkIfPluginIsConnected).toHaveBeenCalledTimes(1);
     expect(PluginState.checkIfPluginIsConnected).toHaveBeenCalledWith(onCallApiUrl);
 
-    expect(isUserActionAllowed).toHaveBeenCalledTimes(1);
-    expect(isUserActionAllowed).toHaveBeenCalledWith(PluginInstallAction);
+    // todo: add check for access
 
     expect(PluginState.installPlugin).toHaveBeenCalledTimes(1);
     expect(PluginState.installPlugin).toHaveBeenCalledWith();
@@ -238,8 +234,7 @@ describe('rootBaseStore', () => {
     expect(PluginState.checkIfPluginIsConnected).toHaveBeenCalledTimes(1);
     expect(PluginState.checkIfPluginIsConnected).toHaveBeenCalledWith(onCallApiUrl);
 
-    expect(isUserActionAllowed).toHaveBeenCalledTimes(1);
-    expect(isUserActionAllowed).toHaveBeenCalledWith(PluginInstallAction);
+    // todo: add check for access
 
     expect(PluginState.installPlugin).toHaveBeenCalledTimes(1);
     expect(PluginState.installPlugin).toHaveBeenCalledWith();

grafana-plugin/src/utils/authorization/index.ts

@@ -35,7 +35,6 @@ export enum Action {
   TEST = 'test',
   EXPORT = 'export',
   UPDATE_SETTINGS = 'update-settings',
-  INSTALL = 'install',
 }
 
 type Actions =
@@ -66,8 +65,7 @@ type Actions =
   | 'UserSettingsAdmin'
   | 'OtherSettingsRead'
   | 'OtherSettingsWrite'
-  | 'TeamsWrite'
-  | 'PluginsInstall';
+  | 'TeamsWrite';
 
 const roleMapping: Record<OrgRole, number> = {
   [OrgRole.Admin]: 0,
@@ -164,5 +162,4 @@ export const UserActions: { [action in Actions]: UserAction } = {
 
   // These are not oncall specific
   TeamsWrite: constructAction(Resource.TEAMS, Action.WRITE, OrgRole.Admin, false),
-  PluginsInstall: constructAction(Resource.PLUGINS, Action.INSTALL, OrgRole.Admin, false),
 };