Chore: Update plugin schema with service registration info (#70692)

pkg/plugins/plugindef/plugindef.cue

@@ -405,6 +405,37 @@ schemas: [{
 			// Parameters for the JWT token authentication request.
 			params: [string]: string
 		}
+
+		// External service registration information
+		externalServiceRegistration: #ExternalServiceRegistration
+
+		#ExternalServiceRegistration: {
+			// Impersonation describes the permissions that the external service will have on behalf of the user
+			impersonation?: #Impersonation
+			// Self describes the permissions that the external service will have on behalf of itself
+			self?: 		#Self
+		}
+
+		#Impersonation: {
+			// Enabled allows the service to request access tokens to impersonate users using the jwtbearer grant
+			// Defaults to true.
+			enabled?: bool
+			// Groups allows the service to list the impersonated user's teams.
+			// Defaults to true.
+			groups?: bool
+			// Permissions are the permissions that the external service needs when impersonating a user.
+			// The intersection of this set with the impersonated user's permission guarantees that the client will not
+			// gain more privileges than the impersonated user has.
+			permissions?: [...#Permission]
+		}
+
+		#Self: {
+			// Enabled allows the service to request access tokens for itself using the client_credentials grant
+			// Defaults to true.
+			enabled?: bool
+			// Permissions are the permissions that the external service needs its associated service account to have.
+			permissions?: [...#Permission]
+		}
 	}
 }]
 lenses: []

pkg/plugins/plugindef/plugindef_types_gen.go

@@ -122,6 +122,12 @@ type Dependency struct {
 // DependencyType defines model for Dependency.Type.
 type DependencyType string
 
+// ExternalServiceRegistration defines model for ExternalServiceRegistration.
+type ExternalServiceRegistration struct {
+	Impersonation *Impersonation `json:"impersonation,omitempty"`
+	Self          *Self          `json:"self,omitempty"`
+}
+
 // Header describes an HTTP header that is forwarded with a proxied request for
 // a plugin route.
 type Header struct {
@@ -129,6 +135,22 @@ type Header struct {
 	Name    string `json:"name"`
 }
 
+// Impersonation defines model for Impersonation.
+type Impersonation struct {
+	// Enabled allows the service to request access tokens to impersonate users using the jwtbearer grant
+	// Defaults to true.
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Groups allows the service to list the impersonated user's teams.
+	// Defaults to true.
+	Groups *bool `json:"groups,omitempty"`
+
+	// Permissions are the permissions that the external service needs when impersonating a user.
+	// The intersection of this set with the impersonated user's permission guarantees that the client will not
+	// gain more privileges than the impersonated user has.
+	Permissions []Permission `json:"permissions,omitempty"`
+}
+
 // A resource to be included in a plugin.
 type Include struct {
 	// RBAC action the user must have to access the route
@@ -288,7 +310,8 @@ type PluginDef struct {
 	// $GOARCH><.exe for Windows>`, e.g. `plugin_linux_amd64`.
 	// Combination of $GOOS and $GOARCH can be found here:
 	// https://golang.org/doc/install/source#environment.
-	Executable *string `json:"executable,omitempty"`
+	Executable                  *string                     `json:"executable,omitempty"`
+	ExternalServiceRegistration ExternalServiceRegistration `json:"externalServiceRegistration"`
 
 	// [internal only] Excludes the plugin from listings in Grafana's UI. Only
 	// allowed for `builtIn` plugins.
@@ -445,6 +468,16 @@ type Route struct {
 	UrlParams []URLParam `json:"urlParams,omitempty"`
 }
 
+// Self defines model for Self.
+type Self struct {
+	// Enabled allows the service to request access tokens for itself using the client_credentials grant
+	// Defaults to true.
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Permissions are the permissions that the external service needs its associated service account to have.
+	Permissions []Permission `json:"permissions,omitempty"`
+}
+
 // TODO docs
 type TokenAuth struct {
 	// Parameters for the token authentication request.