Auth: Extended JWT client for OBO and Service Authentication (#83814)

* reenable ext-jwt-client

* fixup settings struct

* add user and service auth

* lint up

* add user auth to grafana ext

* fixes

* Populate token permissions

Co-authored-by: jguer <joao.guerreiro@grafana.com>

* fix tests

* fix lint

* small prealloc

* small prealloc

* use special namespace for access policies

* fix access policy auth

* fix tests

* fix uncalled settings expander

* add feature toggle

* small feedback fixes

* rename entitlements to permissions

* add authlibn

* allow viewing the signed in user info for non user namespace

* fix invalid namespacedID

* use authlib as verifier for tokens

* Update pkg/services/authn/clients/ext_jwt.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Update pkg/services/authn/clients/ext_jwt_test.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix parameter names

* change asserts to normal package

* add rule for assert

* fix ownerships

* Local diff

* test and lint

* Fix test

* Fix ac test

* Fix pluginproxy test

* Revert testdata changes

* Force revert on test data

---------

Co-authored-by: gamab <gabriel.mabille@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

pkg/services/authn/authnimpl/sync/rbac_sync.go

@@ -2,6 +2,7 @@ package sync
 
 import (
 	"context"
+	"errors"
 
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
@@ -34,19 +35,57 @@ func (s *RBACSync) SyncPermissionsHook(ctx context.Context, ident *authn.Identit
 		return nil
 	}
 
-	permissions, err := s.ac.GetUserPermissions(ctx, ident, accesscontrol.Options{ReloadCache: false})
+	// Populate permissions from roles
+	permissions, err := s.fetchPermissions(ctx, ident)
 	if err != nil {
-		s.log.FromContext(ctx).Error("Failed to fetch permissions from db", "error", err, "id", ident.ID)
-		return errSyncPermissionsForbidden
+		return err
 	}
 
 	if ident.Permissions == nil {
-		ident.Permissions = make(map[int64]map[string][]string)
+		ident.Permissions = make(map[int64]map[string][]string, 1)
 	}
-	ident.Permissions[ident.OrgID] = accesscontrol.GroupScopesByAction(permissions)
+	grouped := accesscontrol.GroupScopesByAction(permissions)
+
+	// Restrict access to the list of actions
+	actionsLookup := ident.ClientParams.FetchPermissionsParams.ActionsLookup
+	if len(actionsLookup) > 0 {
+		filtered := make(map[string][]string, len(actionsLookup))
+		for _, action := range actionsLookup {
+			if scopes, ok := grouped[action]; ok {
+				filtered[action] = scopes
+			}
+		}
+		grouped = filtered
+	}
+
+	ident.Permissions[ident.OrgID] = grouped
 	return nil
 }
 
+func (s *RBACSync) fetchPermissions(ctx context.Context, ident *authn.Identity) ([]accesscontrol.Permission, error) {
+	permissions := make([]accesscontrol.Permission, 0, 8)
+	roles := ident.ClientParams.FetchPermissionsParams.Roles
+	if len(roles) > 0 {
+		for _, role := range roles {
+			roleDTO, err := s.ac.GetRoleByName(ctx, ident.GetOrgID(), role)
+			if err != nil && !errors.Is(err, accesscontrol.ErrRoleNotFound) {
+				s.log.FromContext(ctx).Error("Failed to fetch role from db", "error", err, "role", role)
+				return nil, errSyncPermissionsForbidden
+			}
+			permissions = append(permissions, roleDTO.Permissions...)
+		}
+
+		return permissions, nil
+	}
+
+	permissions, err := s.ac.GetUserPermissions(ctx, ident, accesscontrol.Options{ReloadCache: false})
+	if err != nil {
+		s.log.FromContext(ctx).Error("Failed to fetch permissions from db", "error", err, "id", ident.ID)
+		return nil, errSyncPermissionsForbidden
+	}
+	return permissions, nil
+}
+
 var fixedCloudRoles = map[org.RoleType]string{
 	org.RoleViewer: accesscontrol.FixedCloudViewerRole,
 	org.RoleEditor: accesscontrol.FixedCloudEditorRole,