From 0270152e35c8d3ec2501db4f19a254591463ac28 Mon Sep 17 00:00:00 2001
From: Alexander Zobnin <alexanderzobnin@gmail.com>
Date: Wed, 18 Jun 2025 12:53:39 +0200
Subject: [PATCH] Zanzana: Improve server side tracing (#106804)

---
 pkg/services/authz/zanzana/server/server_check.go | 13 +++++++++++++
 pkg/services/authz/zanzana/server/server_list.go  | 10 ++++++++++
 2 files changed, 23 insertions(+)

diff --git a/pkg/services/authz/zanzana/server/server_check.go b/pkg/services/authz/zanzana/server/server_check.go
index d43ee1ab36a..33b0892b1b8 100644
--- a/pkg/services/authz/zanzana/server/server_check.go
+++ b/pkg/services/authz/zanzana/server/server_check.go
@@ -7,6 +7,7 @@ import (
 
 	authzv1 "github.com/grafana/authlib/authz/proto/v1"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+	"go.opentelemetry.io/otel/attribute"
 	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
@@ -15,6 +16,9 @@ import (
 func (s *Server) Check(ctx context.Context, r *authzv1.CheckRequest) (*authzv1.CheckResponse, error) {
 	ctx, span := s.tracer.Start(ctx, "server.Check")
 	defer span.End()
+	span.SetAttributes(
+		attribute.String("namespace", r.GetNamespace()),
+	)
 
 	res, err := s.check(ctx, r)
 	if err != nil {
@@ -70,6 +74,9 @@ func (s *Server) check(ctx context.Context, r *authzv1.CheckRequest) (*authzv1.C
 // checkGroupResource check if subject has access to the full "GroupResource", if they do they can access every object
 // within it.
 func (s *Server) checkGroupResource(ctx context.Context, subject, relation string, resource common.ResourceInfo, contextuals *openfgav1.ContextualTupleKeys, store *storeInfo) (*authzv1.CheckResponse, error) {
+	ctx, span := s.tracer.Start(ctx, "server.checkGroupResource")
+	defer span.End()
+
 	if !common.IsGroupResourceRelation(relation) {
 		return &authzv1.CheckResponse{Allowed: false}, nil
 	}
@@ -84,6 +91,9 @@ func (s *Server) checkGroupResource(ctx context.Context, subject, relation strin
 
 // checkTyped checks on our typed resources e.g. folder.
 func (s *Server) checkTyped(ctx context.Context, subject, relation string, resource common.ResourceInfo, contextuals *openfgav1.ContextualTupleKeys, store *storeInfo) (*authzv1.CheckResponse, error) {
+	ctx, span := s.tracer.Start(ctx, "server.checkTyped")
+	defer span.End()
+
 	if !resource.IsValidRelation(relation) {
 		return &authzv1.CheckResponse{Allowed: false}, nil
 	}
@@ -123,6 +133,9 @@ func (s *Server) checkTyped(ctx context.Context, subject, relation string, resou
 // 1. If subject has access as a sub resource for a folder.
 // 2. If subject has direct access to resource.
 func (s *Server) checkGeneric(ctx context.Context, subject, relation string, resource common.ResourceInfo, contextuals *openfgav1.ContextualTupleKeys, store *storeInfo) (*authzv1.CheckResponse, error) {
+	ctx, span := s.tracer.Start(ctx, "server.checkGeneric")
+	defer span.End()
+
 	var (
 		folderIdent    = resource.FolderIdent()
 		resourceCtx    = resource.Context()
diff --git a/pkg/services/authz/zanzana/server/server_list.go b/pkg/services/authz/zanzana/server/server_list.go
index c3543ca253e..ee08be863f7 100644
--- a/pkg/services/authz/zanzana/server/server_list.go
+++ b/pkg/services/authz/zanzana/server/server_list.go
@@ -11,6 +11,7 @@ import (
 
 	authzv1 "github.com/grafana/authlib/authz/proto/v1"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+	"go.opentelemetry.io/otel/attribute"
 
 	"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
 )
@@ -18,6 +19,9 @@ import (
 func (s *Server) List(ctx context.Context, r *authzv1.ListRequest) (*authzv1.ListResponse, error) {
 	ctx, span := s.tracer.Start(ctx, "server.List")
 	defer span.End()
+	span.SetAttributes(
+		attribute.String("namespace", r.GetNamespace()),
+	)
 
 	res, err := s.list(ctx, r)
 	if err != nil {
@@ -63,6 +67,9 @@ func (s *Server) list(ctx context.Context, r *authzv1.ListRequest) (*authzv1.Lis
 }
 
 func (s *Server) listTyped(ctx context.Context, subject, relation string, resource common.ResourceInfo, contextuals *openfgav1.ContextualTupleKeys, store *storeInfo) (*authzv1.ListResponse, error) {
+	ctx, span := s.tracer.Start(ctx, "server.listTyped")
+	defer span.End()
+
 	if !resource.IsValidRelation(relation) {
 		return &authzv1.ListResponse{}, nil
 	}
@@ -112,6 +119,9 @@ func (s *Server) listTyped(ctx context.Context, subject, relation string, resour
 }
 
 func (s *Server) listGeneric(ctx context.Context, subject, relation string, resource common.ResourceInfo, contextuals *openfgav1.ContextualTupleKeys, store *storeInfo) (*authzv1.ListResponse, error) {
+	ctx, span := s.tracer.Start(ctx, "server.listGeneric")
+	defer span.End()
+
 	var (
 		folderRelation = common.SubresourceRelation(relation)
 		resourceCtx    = resource.Context()