Revert "Anonymous: Enforce org role Viewer setting (#102070)" (#103043)

This reverts commit e216c2f29d.

pkg/services/anonymous/anonimpl/client.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"strings"
 
 	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
@@ -93,6 +94,18 @@ func (a *Anonymous) ResolveIdentity(ctx context.Context, orgID int64, typ claims
 	return a.newAnonymousIdentity(o), nil
 }
 
+func (a *Anonymous) UsageStatFn(ctx context.Context) (map[string]any, error) {
+	m := map[string]any{}
+
+	// Add stats about anonymous auth
+	m["stats.anonymous.customized_role.count"] = 0
+	if !strings.EqualFold(a.cfg.Anonymous.OrgRole, "Viewer") {
+		m["stats.anonymous.customized_role.count"] = 1
+	}
+
+	return m, nil
+}
+
 func (a *Anonymous) Priority() uint {
 	return 100
 }
@@ -103,7 +116,7 @@ func (a *Anonymous) newAnonymousIdentity(o *org.Org) *authn.Identity {
 		Type:         claims.TypeAnonymous,
 		OrgID:        o.ID,
 		OrgName:      o.Name,
-		OrgRoles:     map[int64]org.RoleType{o.ID: org.RoleViewer},
+		OrgRoles:     map[int64]org.RoleType{o.ID: org.RoleType(a.cfg.Anonymous.OrgRole)},
 		ClientParams: authn.ClientParams{SyncPermissions: true},
 	}
 }

pkg/services/anonymous/anonimpl/client_test.go

@@ -31,6 +31,7 @@ func TestAnonymous_Authenticate(t *testing.T) {
 			org:  &org.Org{ID: 1, Name: "some org"},
 			cfg: &setting.Cfg{
 				Anonymous: setting.AnonymousSettings{
+					OrgRole: "Viewer",
 					OrgName: "some org",
 				},
 			},
@@ -40,6 +41,7 @@ func TestAnonymous_Authenticate(t *testing.T) {
 			err:  fmt.Errorf("some error"),
 			cfg: &setting.Cfg{
 				Anonymous: setting.AnonymousSettings{
+					OrgRole: "Viewer",
 					OrgName: "some org",
 				},
 			},
@@ -65,6 +67,7 @@ func TestAnonymous_Authenticate(t *testing.T) {
 				assert.Equal(t, "anonymous:0", user.GetID())
 				assert.Equal(t, tt.org.ID, user.OrgID)
 				assert.Equal(t, tt.org.Name, user.OrgName)
+				assert.Equal(t, tt.cfg.Anonymous.OrgRole, string(user.GetOrgRole()))
 			}
 		})
 	}