From 49aaa5c9550406d3b98de15edefa40b9241c416e Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Fri, 17 Jun 2022 12:53:38 -0400
Subject: [PATCH] Search: fix anonymous user access (#51045) (#51055)

(cherry picked from commit 40b152e813510289830f6e5df67c7da631bea403)

Co-authored-by: Artur Wierzbicki <wierzbicki.artur.94@gmail.com>
---
 pkg/services/searchV2/service.go | 45 +++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 15 deletions(-)

diff --git a/pkg/services/searchV2/service.go b/pkg/services/searchV2/service.go
index 1ac2a467353..dd79b172a59 100644
--- a/pkg/services/searchV2/service.go
+++ b/pkg/services/searchV2/service.go
@@ -70,24 +70,39 @@ func (s *StandardSearchService) RegisterDashboardIndexExtender(ext DashboardInde
 func (s *StandardSearchService) getUser(ctx context.Context, backendUser *backend.User, orgId int64) (*models.SignedInUser, error) {
 	// TODO: get user & user's permissions from the request context
 
-	getSignedInUserQuery := &models.GetSignedInUserQuery{
-		Login: backendUser.Login,
-		Email: backendUser.Email,
-		OrgId: orgId,
-	}
+	var user *models.SignedInUser
+	if s.cfg.AnonymousEnabled && backendUser.Email == "" && backendUser.Login == "" {
+		org, err := s.sql.GetOrgByName(s.cfg.AnonymousOrgName)
+		if err != nil {
+			s.logger.Error("Anonymous access organization error.", "org_name", s.cfg.AnonymousOrgName, "error", err)
+			return nil, err
+		}
 
-	err := s.sql.GetSignedInUser(ctx, getSignedInUserQuery)
-	if err != nil {
-		s.logger.Error("Error while retrieving user", "error", err, "email", backendUser.Email)
-		return nil, errors.New("auth error")
-	}
+		user = &models.SignedInUser{
+			OrgId:       org.Id,
+			OrgName:     org.Name,
+			OrgRole:     models.RoleType(s.cfg.AnonymousOrgRole),
+			IsAnonymous: true,
+		}
+	} else {
+		getSignedInUserQuery := &models.GetSignedInUserQuery{
+			Login: backendUser.Login,
+			Email: backendUser.Email,
+			OrgId: orgId,
+		}
+		err := s.sql.GetSignedInUser(ctx, getSignedInUserQuery)
+		if err != nil {
+			s.logger.Error("Error while retrieving user", "error", err, "email", backendUser.Email)
+			return nil, errors.New("auth error")
+		}
 
-	if getSignedInUserQuery.Result == nil {
-		s.logger.Error("No user found", "email", backendUser.Email)
-		return nil, errors.New("auth error")
-	}
+		if getSignedInUserQuery.Result == nil {
+			s.logger.Error("No user found", "email", backendUser.Email)
+			return nil, errors.New("auth error")
+		}
 
-	user := getSignedInUserQuery.Result
+		user = getSignedInUserQuery.Result
+	}
 
 	if s.ac.IsDisabled() {
 		return user, nil