Recreate legacy getFolder from the APIs

grafana · aocenas · Jun 18, 2025 · Jun 19, 2025 · Jun 19, 2025 · Jun 20, 2025
commit 06f0baae4931b979c9d3a829be2c1374aeccce7b
@@ -44,10 +44,11 @@ type FolderInfo struct {
 type FolderAccessInfo struct {
 	metav1.TypeMeta `json:",inline"`
 
-	CanSave   bool `json:"canSave"`
-	CanEdit   bool `json:"canEdit"`
-	CanAdmin  bool `json:"canAdmin"`
-	CanDelete bool `json:"canDelete"`
+	CanSave       bool            `json:"canSave"`
+	CanEdit       bool            `json:"canEdit"`
+	CanAdmin      bool            `json:"canAdmin"`
+	CanDelete     bool            `json:"canDelete"`
+	AccessControl map[string]bool `json:"accessControl,omitempty"`
 }
 
 // +k8s:deepcopy-gen=true

@@ -190,7 +190,10 @@ func (b *FolderAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.API
 		getter: storage[resourceInfo.StoragePath()].(rest.Getter), // Get the parents
 	}
 	storage[resourceInfo.StoragePath("counts")] = &subCountREST{searcher: b.searcher}
-	storage[resourceInfo.StoragePath("access")] = &subAccessREST{b.folderSvc, b.ac}
+	storage[resourceInfo.StoragePath("access")] = &subAccessREST{
+		getter: storage[resourceInfo.StoragePath()].(rest.Getter),
+		ac:     b.ac,
+	}
 
 	// Adds a path to return children of a given folder
 	storage[resourceInfo.StoragePath("children")] = &subChildrenREST{

@@ -2,6 +2,8 @@ package folders
 
 import (
 	"context"
+	"fmt"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"net/http"
 
 	"k8s.io/apimachinery/pkg/runtime"
@@ -10,14 +12,12 @@ import (
 	folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
-	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
 	"github.com/grafana/grafana/pkg/services/dashboards"
-	"github.com/grafana/grafana/pkg/services/folder"
 )
 
 type subAccessREST struct {
-	service folder.Service
-	ac      accesscontrol.AccessControl
+	getter rest.Getter
+	ac     accesscontrol.AccessControl
 }
 
 var _ = rest.Connecter(&subAccessREST{})
@@ -47,37 +47,58 @@ func (r *subAccessREST) NewConnectOptions() (runtime.Object, bool, string) {
 }
 
 func (r *subAccessREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
-	ns, err := request.NamespaceInfoFrom(ctx, true)
-	if err != nil {
-		return nil, err
-	}
 	user, err := identity.GetRequester(ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	// Can view is managed here (and in the Authorizer)
-	f, err := r.service.Get(ctx, &folder.GetFolderQuery{
-		UID:          &name,
-		OrgID:        ns.OrgID,
-		SignedInUser: user,
-	})
+	obj, err := r.getter.Get(ctx, name, &metav1.GetOptions{})
 	if err != nil {
 		return nil, err
 	}
 
+	folderObj, ok := obj.(*folders.Folder)
+	if !ok {
+		return nil, fmt.Errorf("got something else than folders.Folder")
+	}
+
+	folderUID := folderObj.ObjectMeta.Name
+
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		access := &folders.FolderAccessInfo{}
-		canEditEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID))
+		canEditEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID))
 		access.CanEdit, _ = r.ac.Evaluate(ctx, user, canEditEvaluator)
 		access.CanSave = access.CanEdit
 		canAdminEvaluator := accesscontrol.EvalAll(
-			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID)),
-			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID)),
+			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID)),
+			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID)),
 		)
 		access.CanAdmin, _ = r.ac.Evaluate(ctx, user, canAdminEvaluator)
-		canDeleteEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersDelete, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID))
+		canDeleteEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersDelete, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID))
 		access.CanDelete, _ = r.ac.Evaluate(ctx, user, canDeleteEvaluator)
+
+		// Cargo culted from pkg/api/folder.go#getFolderACMetadata
+		allMetadata := getFolderAccessControl(ctx, r.getter, user, folderObj)
+		metadata := map[string]bool{}
+		// Flatten metadata - if any parent has a permission, the child folder inherits it
+		for _, md := range allMetadata {
+			for action := range md {
+				metadata[action] = true
+			}
+		}
+
+		access.AccessControl = metadata
+
 		responder.Object(http.StatusOK, access)
 	}), nil
 }
+
+func getFolderAccessControl(ctx context.Context, folderGetter rest.Getter, user identity.Requester, f *folders.Folder) map[string]accesscontrol.Metadata {
+	parents := getFolderParents(ctx, folderGetter, f)
+	folderIDs := map[string]bool{f.ObjectMeta.Name: true}
+
+	for _, p := range parents.Items {
+		folderIDs[p.Name] = true
+	}
+	return accesscontrol.GetResourcesMetadata(ctx, user.GetPermissions(), dashboards.ScopeFoldersPrefix, folderIDs)
+}
@@ -54,53 +54,9 @@ func (r *subParentsREST) Connect(ctx context.Context, name string, opts runtime.
 	}
 
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		info := r.parents(ctx, folder)
+		info := getFolderParents(ctx, r.getter, folder)
 		// Start from the root
 		slices.Reverse(info.Items)
 		responder.Object(http.StatusOK, info)
 	}), nil
 }
-
-func (r *subParentsREST) parents(ctx context.Context, folder *folders.Folder) *folders.FolderInfoList {
-	info := &folders.FolderInfoList{
-		Items: []folders.FolderInfo{},
-	}
-	for folder != nil {
-		parent := getParent(folder)
-		descr := ""
-		if folder.Spec.Description != nil {
-			descr = *folder.Spec.Description
-		}
-		info.Items = append(info.Items, folders.FolderInfo{
-			Name:        folder.Name,
-			Title:       folder.Spec.Title,
-			Description: descr,
-			Parent:      parent,
-		})
-		if parent == "" {
-			break
-		}
-
-		obj, err := r.getter.Get(ctx, parent, &metav1.GetOptions{})
-		if err != nil {
-			info.Items = append(info.Items, folders.FolderInfo{
-				Name:        parent,
-				Detached:    true,
-				Description: err.Error(),
-			})
-			break
-		}
-
-		parentFolder, ok := obj.(*folders.Folder)
-		if !ok {
-			info.Items = append(info.Items, folders.FolderInfo{
-				Name:        parent,
-				Detached:    true,
-				Description: fmt.Sprintf("expected folder, found: %T", obj),
-			})
-			break
-		}
-		folder = parentFolder
-	}
-	return info
-}
@@ -0,0 +1,57 @@
+package folders
+
+import (
+	"context"
+	"fmt"
+	folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/registry/rest"
+)
+
+// getFolderParents gets a list of info objects for each parent of a Folder
+// TODO: There are some other implementations that seem to do similar thing like pkg/services/folder/service.go#GetParents.
+//
+//	Not sure if they should be merged somehow or not.
+func getFolderParents(ctx context.Context, folderGetter rest.Getter, folder *folders.Folder) *folders.FolderInfoList {
+	info := &folders.FolderInfoList{
+		Items: []folders.FolderInfo{},
+	}
+	for folder != nil {
+		parent := getParent(folder)
+		descr := ""
+		if folder.Spec.Description != nil {
+			descr = *folder.Spec.Description
+		}
+		info.Items = append(info.Items, folders.FolderInfo{
+			Name:        folder.Name,
+			Title:       folder.Spec.Title,
+			Description: descr,
+			Parent:      parent,
+		})
+		if parent == "" {
+			break
+		}
+
+		obj, err := folderGetter.Get(ctx, parent, &metav1.GetOptions{})
+		if err != nil {
+			info.Items = append(info.Items, folders.FolderInfo{
+				Name:        parent,
+				Detached:    true,
+				Description: err.Error(),
+			})
+			break
+		}
+
+		parentFolder, ok := obj.(*folders.Folder)
+		if !ok {
+			info.Items = append(info.Items, folders.FolderInfo{
+				Name:        parent,
+				Detached:    true,
+				Description: fmt.Sprintf("expected folder, found: %T", obj),
+			})
+			break
+		}
+		folder = parentFolder
+	}
+	return info
+}
@@ -1159,6 +1159,13 @@
           "canDelete"
         ],
         "properties": {
+          "accessControl": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "boolean",
+              "default": false
+            }
+          },
           "apiVersion": {
             "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
             "type": "string"

@@ -519,6 +519,9 @@ export type Status = {
 };
 export type Patch = object;
 export type FolderAccessInfo = {
+  accessControl?: {
+    [key: string]: boolean;
+  };
   /** APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources */
   apiVersion?: string;
   canAdmin: boolean;