Auth: Use claims.AuthInfo in requester (#91739)

pkg/apimachinery/go.mod

@@ -3,7 +3,8 @@ module github.com/grafana/grafana/pkg/apimachinery
 go 1.22.4
 
 require (
-	github.com/grafana/authlib v0.0.0-20240730122259-a0d13672efb1
+	github.com/grafana/authlib v0.0.0-20240809101159-74eaccc31a06 // @grafana/identity-access-team
+	github.com/grafana/authlib/claims v0.0.0-20240809101159-74eaccc31a06 // @grafana/identity-access-team
 	github.com/stretchr/testify v1.9.0
 	k8s.io/apimachinery v0.31.0-rc.1
 	k8s.io/apiserver v0.31.0-rc.1

pkg/apimachinery/go.sum

@@ -28,8 +28,10 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/grafana/authlib v0.0.0-20240730122259-a0d13672efb1 h1:EiaupmOnt6XF/LPxvagjTofWmByzYaf5VyMIF+w/71M=
-github.com/grafana/authlib v0.0.0-20240730122259-a0d13672efb1/go.mod h1:YA9We4kTafu7mlMnUh3In6Q2wpg8fYN3ycgCKOK1TB8=
+github.com/grafana/authlib v0.0.0-20240809101159-74eaccc31a06 h1:qks7nEo/A0+mWvjMjWEIfFD9eIVipb5Lxjfg+HcB5u4=
+github.com/grafana/authlib v0.0.0-20240809101159-74eaccc31a06/go.mod h1:5uu+ADz2c8bVsXheavXS735IcDuO6M3dr+evuDl8rIE=
+github.com/grafana/authlib/claims v0.0.0-20240809101159-74eaccc31a06 h1:uD1LcKwvEAqzDsgVChBudPqo5BhPxkj9AgylT5QCReo=
+github.com/grafana/authlib/claims v0.0.0-20240809101159-74eaccc31a06/go.mod h1:r+F8H6awwjNQt/KPZ2GNwjk8TvsJ7/gxzkXN26GlL/A=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=

pkg/apimachinery/identity/context.go

@@ -4,12 +4,15 @@ import (
 	"context"
 	"fmt"
 	"reflect"
+
+	"github.com/grafana/authlib/claims"
 )
 
 type ctxUserKey struct{}
 
 // WithRequester attaches the requester to the context.
 func WithRequester(ctx context.Context, usr Requester) context.Context {
+	ctx = claims.WithClaims(ctx, usr) // also set the upstream auth info claims
 	return context.WithValue(ctx, ctxUserKey{}, usr)
 }
 

pkg/apimachinery/identity/requester.go

@@ -5,11 +5,13 @@ import (
 	"strconv"
 
 	authnlib "github.com/grafana/authlib/authn"
+	"github.com/grafana/authlib/claims"
 	"k8s.io/apiserver/pkg/authentication/user"
 )
 
 type Requester interface {
 	user.Info
+	claims.AuthInfo
 
 	// GetIdentityType returns the type for the requester
 	GetIdentityType() IdentityType

pkg/apimachinery/identity/static.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	authnlib "github.com/grafana/authlib/authn"
+	"github.com/grafana/authlib/claims"
 )
 
 var _ Requester = &StaticRequester{}
@@ -35,6 +36,19 @@ type StaticRequester struct {
 	CacheKey      string
 }
 
+// Access implements Requester.
+func (u *StaticRequester) GetAccess() claims.AccessClaims {
+	return &IDClaimsWrapper{Source: u}
+}
+
+// Identity implements Requester.
+func (u *StaticRequester) GetIdentity() claims.IdentityClaims {
+	if u.IDTokenClaims != nil {
+		return authnlib.NewIdentityClaims(*u.IDTokenClaims)
+	}
+	return &IDClaimsWrapper{Source: u}
+}
+
 // GetRawIdentifier implements Requester.
 func (u *StaticRequester) GetUID() string {
 	return fmt.Sprintf("%s:%s", u.Type, u.UserUID)

pkg/apimachinery/identity/wrapper.go

@@ -0,0 +1,115 @@
+package identity
+
+import (
+	"time"
+
+	"github.com/grafana/authlib/claims"
+)
+
+var _ claims.IdentityClaims = &IDClaimsWrapper{}
+var _ claims.AccessClaims = &IDClaimsWrapper{}
+
+type IDClaimsWrapper struct {
+	Source Requester
+}
+
+// GetAuthenticatedBy implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) AuthenticatedBy() string {
+	return i.Source.GetAuthenticatedBy()
+}
+
+// GetDisplayName implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) DisplayName() string {
+	return i.Source.GetDisplayName()
+}
+
+// GetEmail implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) Email() string {
+	return i.Source.GetEmail()
+}
+
+// GetEmailVerified implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) EmailVerified() bool {
+	return i.Source.IsEmailVerified()
+}
+
+// GetIdentityType implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) IdentityType() claims.IdentityType {
+	return claims.IdentityType(i.Source.GetIdentityType())
+}
+
+// GetInternalID implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) InternalID() int64 {
+	v, _ := i.Source.GetInternalID()
+	return v
+}
+
+// GetOrgID implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) OrgID() int64 {
+	return i.Source.GetOrgID()
+}
+
+// GetRawUID implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) UID() string {
+	return i.Source.GetRawIdentifier()
+}
+
+// GetUsername implements claims.IdentityClaims.
+func (i *IDClaimsWrapper) Username() string {
+	return i.Source.GetLogin()
+}
+
+// GetAudience implements claims.AccessClaims.
+func (i *IDClaimsWrapper) Audience() []string {
+	return []string{}
+}
+
+// GetDelegatedPermissions implements claims.AccessClaims.
+func (i *IDClaimsWrapper) DelegatedPermissions() []string {
+	return []string{}
+}
+
+// GetExpiry implements claims.AccessClaims.
+func (i *IDClaimsWrapper) Expiry() *time.Time {
+	return nil
+}
+
+// GetIssuedAt implements claims.AccessClaims.
+func (i *IDClaimsWrapper) IssuedAt() *time.Time {
+	return nil
+}
+
+// GetIssuer implements claims.AccessClaims.
+func (i *IDClaimsWrapper) Issuer() string {
+	return ""
+}
+
+// GetJTI implements claims.AccessClaims.
+func (i *IDClaimsWrapper) JTI() string {
+	return ""
+}
+
+// GetNamespace implements claims.AccessClaims.
+func (i *IDClaimsWrapper) Namespace() string {
+	return i.Source.GetAllowedKubernetesNamespace()
+}
+
+// GetNotBefore implements claims.AccessClaims.
+func (i *IDClaimsWrapper) NotBefore() *time.Time {
+	return nil
+}
+
+// GetPermissions implements claims.AccessClaims.
+func (i *IDClaimsWrapper) Permissions() []string {
+	return []string{}
+}
+
+// GetScopes implements claims.AccessClaims.
+func (i *IDClaimsWrapper) Scopes() []string {
+	return []string{}
+}
+
+// GetSubject implements claims.AccessClaims.
+func (i *IDClaimsWrapper) Subject() string {
+	return ""
+}