Frontend Sandbox: Do not perform authenticated queries for non authenticated users (#101946)

* Do not perform authenticated queries for non authenticated users

* Empty commit

public/app/features/plugins/sandbox/sandbox_plugin_loader_registry.test.ts

@@ -1,5 +1,6 @@
 import { PluginMeta, PluginSignatureStatus, PluginSignatureType } from '@grafana/data';
 import { config } from '@grafana/runtime';
+import { contextSrv } from 'app/core/services/context_srv';
 
 import { getPluginDetails } from '../admin/api';
 import { CatalogPluginDetails } from '../admin/types';
@@ -30,6 +31,7 @@ jest.mock('../admin/api', () => ({
 
 const getPluginSettingsMock = jest.mocked(getPluginSettings);
 const getPluginDetailsMock = jest.mocked(getPluginDetails);
+const mockContextSrv = jest.mocked(contextSrv);
 
 const fakePluginSettings: PluginMeta = {
   id: 'test-plugin',
@@ -45,6 +47,7 @@ describe('Sandbox eligibility checks', () => {
     jest.clearAllMocks();
     getPluginDetailsMock.mockReset();
     getPluginSettingsMock.mockReset();
+    mockContextSrv.isSignedIn = true;
 
     // restore default check
     setSandboxEnabledCheck(isPluginFrontendSandboxEnabled);
@@ -63,6 +66,12 @@ describe('Sandbox eligibility checks', () => {
     expect(result).toBe(false);
   });
 
+  test('isPluginFrontendSandboxEligible returns false for unsigned users', async () => {
+    mockContextSrv.isSignedIn = false;
+    const isEligible = await isPluginFrontendSandboxEligible({ pluginId: 'test-plugin' });
+    expect(isEligible).toBe(false);
+  });
+
   test('shouldLoadPluginInFrontendSandbox returns false when feature toggle is off', async () => {
     config.featureToggles.pluginsFrontendSandbox = false;
     const result = await shouldLoadPluginInFrontendSandbox({ pluginId: 'test-plugin' });

public/app/features/plugins/sandbox/sandbox_plugin_loader_registry.ts

@@ -1,5 +1,6 @@
 import { PluginSignatureType } from '@grafana/data';
 import { config } from '@grafana/runtime';
+import { contextSrv } from 'app/core/core';
 
 import { getPluginDetails } from '../admin/api';
 import { getPluginSettings } from '../pluginSettings';
@@ -62,6 +63,10 @@ export async function isPluginFrontendSandboxEligible({
     return false;
   }
 
+  if (!contextSrv.isSignedIn) {
+    return false;
+  }
+
   // grafana signature and internal plugins are not allowed in the sandbox
   return isPluginSignatureEligibleForSandbox({ pluginId });
 }