grafana · aocenas · Jun 18, 2025 · Jun 19, 2025 · Jun 19, 2025 · Jun 20, 2025
@@ -847,6 +847,9 @@ exports[`better eslint`] = {
     "packages/grafana-ui/src/utils/useAsyncDependency.ts:5381": [
       [0, 0, 0, "Unexpected any. Specify a different type.", "0"]
     ],
+    "public/app/api/clients/folder/v1beta1/hooks.ts:5381": [
+      [0, 0, 0, "Do not use any type assertions.", "0"]
+    ],
     "public/app/core/TableModel.ts:5381": [
       [0, 0, 0, "Unexpected any. Specify a different type.", "0"],
       [0, 0, 0, "Unexpected any. Specify a different type.", "1"]

@@ -44,10 +44,11 @@ type FolderInfo struct {
 type FolderAccessInfo struct {
 	metav1.TypeMeta `json:",inline"`
 
-	CanSave   bool `json:"canSave"`
-	CanEdit   bool `json:"canEdit"`
-	CanAdmin  bool `json:"canAdmin"`
-	CanDelete bool `json:"canDelete"`
+	CanSave       bool            `json:"canSave"`
+	CanEdit       bool            `json:"canEdit"`
+	CanAdmin      bool            `json:"canAdmin"`
+	CanDelete     bool            `json:"canDelete"`
+	AccessControl map[string]bool `json:"accessControl,omitempty"`
 }
 
 // +k8s:deepcopy-gen=true

@@ -191,7 +191,10 @@ func (b *FolderAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.API
 		getter: storage[resourceInfo.StoragePath()].(rest.Getter), // Get the parents
 	}
 	storage[resourceInfo.StoragePath("counts")] = &subCountREST{searcher: b.searcher}
-	storage[resourceInfo.StoragePath("access")] = &subAccessREST{b.folderSvc, b.ac}
+	storage[resourceInfo.StoragePath("access")] = &subAccessREST{
+		getter: storage[resourceInfo.StoragePath()].(rest.Getter),
+		ac:     b.ac,
+	}
 
 	// Adds a path to return children of a given folder
 	storage[resourceInfo.StoragePath("children")] = &subChildrenREST{

@@ -2,6 +2,9 @@
 
 import (
 	"context"
+	"fmt"
+	"github.com/grafana/grafana/pkg/services/folder"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"net/http"
 
 	"k8s.io/apimachinery/pkg/runtime"
@@ -10,14 +13,12 @@
 	folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
-	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
 	"github.com/grafana/grafana/pkg/services/dashboards"
-	"github.com/grafana/grafana/pkg/services/folder"
 )
 
 type subAccessREST struct {
-	service folder.Service
-	ac      accesscontrol.AccessControl
+	getter rest.Getter
+	ac     accesscontrol.AccessControl
 }
 
 var _ = rest.Connecter(&subAccessREST{})
@@ -47,37 +48,62 @@
 }
 
 func (r *subAccessREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
-	ns, err := request.NamespaceInfoFrom(ctx, true)
-	if err != nil {
-		return nil, err
-	}
 	user, err := identity.GetRequester(ctx)
 	if err != nil {
 		return nil, err
 	}
 
-	// Can view is managed here (and in the Authorizer)
-	f, err := r.service.Get(ctx, &folder.GetFolderQuery{
-		UID:          &name,
-		OrgID:        ns.OrgID,
-		SignedInUser: user,
-	})
-	if err != nil {
-		return nil, err
-	}
+	folderUID := name
 
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		access := &folders.FolderAccessInfo{}
-		canEditEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID))
+		canEditEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID))
 		access.CanEdit, _ = r.ac.Evaluate(ctx, user, canEditEvaluator)
 		access.CanSave = access.CanEdit
 		canAdminEvaluator := accesscontrol.EvalAll(
-			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID)),
-			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID)),
+			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsRead, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID)),
+			accesscontrol.EvalPermission(dashboards.ActionFoldersPermissionsWrite, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID)),
 		)
 		access.CanAdmin, _ = r.ac.Evaluate(ctx, user, canAdminEvaluator)
-		canDeleteEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersDelete, dashboards.ScopeFoldersProvider.GetResourceScopeUID(f.UID))
+		canDeleteEvaluator := accesscontrol.EvalPermission(dashboards.ActionFoldersDelete, dashboards.ScopeFoldersProvider.GetResourceScopeUID(folderUID))
 		access.CanDelete, _ = r.ac.Evaluate(ctx, user, canDeleteEvaluator)
+
+		// Cargo culted from pkg/api/folder.go#getFolderACMetadata
+		allMetadata, err := getFolderAccessControl(ctx, r.getter, user, name)
+		if err != nil {
+			responder.Error(err)
+			return
+		}
+		metadata := map[string]bool{}
+		// Flatten metadata - if any parent has a permission, the child folder inherits it
+		for _, md := range allMetadata {
+			for action := range md {
+				metadata[action] = true
+			}
+		}
+
+		access.AccessControl = metadata
 		responder.Object(http.StatusOK, access)
 	}), nil
 }
+
+func getFolderAccessControl(ctx context.Context, folderGetter rest.Getter, user identity.Requester, name string) (map[string]accesscontrol.Metadata, error) {
+	folderIDs := map[string]bool{name: true}
+
+	if name != folder.GeneralFolderUID && name != folder.SharedWithMeFolderUID {
+		obj, err := folderGetter.Get(ctx, name, &metav1.GetOptions{})
+		if err != nil {
+			return nil, err
+		}
+		folderObj, ok := obj.(*folders.Folder)
+		if !ok {
+			return nil, fmt.Errorf("expecting folder, found: %T", folderObj)
+		}
+		parents := getFolderParents(ctx, folderGetter, folderObj)
+		for _, p := range parents.Items {
+			folderIDs[p.Name] = true
+		}
+	}
+
+	return accesscontrol.GetResourcesMetadata(ctx, user.GetPermissions(), dashboards.ScopeFoldersPrefix, folderIDs), nil
+}
@@ -3,6 +3,8 @@
 import (
 	"context"
 	"fmt"
+	"github.com/grafana/grafana/pkg/services/folder"
+	"k8s.io/apiserver/pkg/storage"
 	"net/http"
 	"slices"
 
@@ -44,63 +46,30 @@
 }
 
 func (r *subParentsREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
-	obj, err := r.getter.Get(ctx, name, &metav1.GetOptions{})
-	if err != nil {
-		return nil, err
-	}
-	folder, ok := obj.(*folders.Folder)
-	if !ok {
-		return nil, fmt.Errorf("expecting folder, found: %T", folder)
-	}
-
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		info := r.parents(ctx, folder)
-		// Start from the root
-		slices.Reverse(info.Items)
-		responder.Object(http.StatusOK, info)
-	}), nil
-}
-
-func (r *subParentsREST) parents(ctx context.Context, folder *folders.Folder) *folders.FolderInfoList {
-	info := &folders.FolderInfoList{
-		Items: []folders.FolderInfo{},
-	}
-	for folder != nil {
-		parent := getParent(folder)
-		descr := ""
-		if folder.Spec.Description != nil {
-			descr = *folder.Spec.Description
-		}
-		info.Items = append(info.Items, folders.FolderInfo{
-			Name:        folder.Name,
-			Title:       folder.Spec.Title,
-			Description: descr,
-			Parent:      parent,
-		})
-		if parent == "" {
-			break
+		if name == folder.GeneralFolderUID || name == folder.SharedWithMeFolderUID {
+			responder.Object(http.StatusOK, &folders.FolderInfoList{
+				Items: []folders.FolderInfo{},
+			})
+			return
 		}
 
-		obj, err := r.getter.Get(ctx, parent, &metav1.GetOptions{})
+		obj, err := r.getter.Get(ctx, name, &metav1.GetOptions{})
+		if storage.IsNotFound(err) {
+			responder.Object(http.StatusNotFound, nil)
+		}
 		if err != nil {
-			info.Items = append(info.Items, folders.FolderInfo{
-				Name:        parent,
-				Detached:    true,
-				Description: err.Error(),
-			})
-			break
+			responder.Error(err)
 		}
 
-		parentFolder, ok := obj.(*folders.Folder)
+		folderObj, ok := obj.(*folders.Folder)
 		if !ok {
-			info.Items = append(info.Items, folders.FolderInfo{
-				Name:        parent,
-				Detached:    true,
-				Description: fmt.Sprintf("expected folder, found: %T", obj),
-			})
-			break
+			responder.Error(fmt.Errorf("expecting folder, found: %T", folderObj))
 		}
-		folder = parentFolder
-	}
-	return info
+
+		info := getFolderParents(ctx, r.getter, folderObj)
+		// Start from the root
+		slices.Reverse(info.Items)
+		responder.Object(http.StatusOK, info)
+	}), nil
 }
@@ -0,0 +1,57 @@
+package folders
+
+import (
+	"context"
+	"fmt"
+	folders "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apiserver/pkg/registry/rest"
+)
+
+// getFolderParents gets a list of info objects for each parent of a Folder
+// TODO: There are some other implementations that seem to do similar thing like pkg/services/folder/service.go#GetParents.
+//
+//	Not sure if they should be merged somehow or not.
+func getFolderParents(ctx context.Context, folderGetter rest.Getter, folder *folders.Folder) *folders.FolderInfoList {
+	info := &folders.FolderInfoList{
+		Items: []folders.FolderInfo{},
+	}
+	for folder != nil {
+		parent := getParent(folder)
+		descr := ""
+		if folder.Spec.Description != nil {
+			descr = *folder.Spec.Description
+		}
+		info.Items = append(info.Items, folders.FolderInfo{
+			Name:        folder.Name,
+			Title:       folder.Spec.Title,
+			Description: descr,
+			Parent:      parent,
+		})
+		if parent == "" {
+			break
+		}
+
+		obj, err := folderGetter.Get(ctx, parent, &metav1.GetOptions{})
+		if err != nil {
+			info.Items = append(info.Items, folders.FolderInfo{
+				Name:        parent,
+				Detached:    true,
+				Description: err.Error(),
+			})
+			break
+		}
+
+		parentFolder, ok := obj.(*folders.Folder)
+		if !ok {
+			info.Items = append(info.Items, folders.FolderInfo{
+				Name:        parent,
+				Detached:    true,
+				Description: fmt.Sprintf("expected folder, found: %T", obj),
+			})
+			break
+		}
+		folder = parentFolder
+	}
+	return info
+}
@@ -12,7 +12,7 @@ import (
 	grafanarest "github.com/grafana/grafana/pkg/apiserver/rest"
 )
 
-func TestSubParent(t *testing.T) {
+func TestGetFolderParents(t *testing.T) {
 	tests := []struct {
 		name     string
 		input    *folders.Folder
@@ -65,13 +65,10 @@ func TestSubParent(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			r := &subParentsREST{
-				getter: gm,
-			}
 			if tt.setuFn != nil {
 				tt.setuFn(m)
 			}
-			parents := r.parents(context.TODO(), tt.input)
+			parents := getFolderParents(context.TODO(), gm, tt.input)
 			require.Equal(t, tt.expected, parents)
 		})
 	}

@@ -1159,6 +1159,13 @@
           "canDelete"
         ],
         "properties": {
+          "accessControl": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "boolean",
+              "default": false
+            }
+          },
           "apiVersion": {
             "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
             "type": "string"

@@ -519,6 +519,9 @@ export type Status = {
 };
 export type Patch = object;
 export type FolderAccessInfo = {
+  accessControl?: {
+    [key: string]: boolean;
+  };
   /** APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources */
   apiVersion?: string;
   canAdmin: boolean;