From b5faf5d9a12a68f2fe8063c1ecefe7e0e97ee64c Mon Sep 17 00:00:00 2001
From: Sven Grossmann <sven.grossmann@grafana.com>
Date: Wed, 26 Feb 2025 17:33:05 +0100
Subject: [PATCH] Drilldown: Require `datasources:explore` RBAC action
 (#101366)

Drilldown: Require `datasources:explore` acton
---
 pkg/api/accesscontrol.go                    | 3 ---
 pkg/api/api.go                              | 2 +-
 pkg/services/accesscontrol/models.go        | 3 +--
 pkg/services/navtree/navtreeimpl/navtree.go | 2 +-
 4 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkg/api/accesscontrol.go b/pkg/api/accesscontrol.go
index 0f1c4efe772..0ad8d8eeedc 100644
--- a/pkg/api/accesscontrol.go
+++ b/pkg/api/accesscontrol.go
@@ -66,9 +66,6 @@ func (hs *HTTPServer) declareFixedRoles() error {
 				{
 					Action: ac.ActionDatasourcesExplore,
 				},
-				{
-					Action: ac.ActionDatasourcesDrilldown,
-				},
 			},
 		},
 		Grants: []string{string(org.RoleEditor)},
diff --git a/pkg/api/api.go b/pkg/api/api.go
index 18e52419ece..61ced28f276 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -183,7 +183,7 @@ func (hs *HTTPServer) registerRoutes() {
 	}
 
 	r.Get("/explore", authorize(ac.EvalPermission(ac.ActionDatasourcesExplore)), hs.Index)
-	r.Get("/drilldown", authorize(ac.EvalPermission(ac.ActionDatasourcesDrilldown)), hs.Index)
+	r.Get("/drilldown", authorize(ac.EvalPermission(ac.ActionDatasourcesExplore)), hs.Index)
 
 	r.Get("/playlists/", reqSignedIn, hs.Index)
 	r.Get("/playlists/*", reqSignedIn, hs.Index)
diff --git a/pkg/services/accesscontrol/models.go b/pkg/services/accesscontrol/models.go
index 4c15e3c5e56..dc12171eaa5 100644
--- a/pkg/services/accesscontrol/models.go
+++ b/pkg/services/accesscontrol/models.go
@@ -386,8 +386,7 @@ const (
 	ActionSettingsWrite = "settings:write"
 
 	// Datasources actions
-	ActionDatasourcesExplore   = "datasources:explore"
-	ActionDatasourcesDrilldown = "datasources:drilldown"
+	ActionDatasourcesExplore = "datasources:explore"
 
 	// Global Scopes
 	ScopeGlobalUsersAll = "global.users:*"
diff --git a/pkg/services/navtree/navtreeimpl/navtree.go b/pkg/services/navtree/navtreeimpl/navtree.go
index 7158c8884dc..d84240556f8 100644
--- a/pkg/services/navtree/navtreeimpl/navtree.go
+++ b/pkg/services/navtree/navtreeimpl/navtree.go
@@ -130,7 +130,7 @@ func (s *ServiceImpl) GetNavTree(c *contextmodel.ReqContext, prefs *pref.Prefere
 		})
 	}
 
-	if hasAccess(ac.EvalPermission(ac.ActionDatasourcesDrilldown)) {
+	if hasAccess(ac.EvalPermission(ac.ActionDatasourcesExplore)) {
 		drilldownChildNavLinks := s.buildDrilldownNavLinks(c)
 		treeRoot.AddSection(&navtree.NavLink{
 			Text:       "Drilldown",