Zanzana: Handle anonymous users (#97171)

* add anonymous users to schema

* sync anonymous user role

* remove unused

* fix linter

* only add anonymous reconciler if feature is enabled

pkg/services/accesscontrol/dualwrite/reconciler.go

@@ -2,6 +2,7 @@ package dualwrite
 
 import (
 	"context"
+	"fmt"
 	"strconv"
 	"time"
 
@@ -12,6 +13,7 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/serverlock"
 	"github.com/grafana/grafana/pkg/services/authz/zanzana"
+	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/setting"
 )
 
@@ -33,7 +35,7 @@ type ZanzanaReconciler struct {
 }
 
 func NewZanzanaReconciler(cfg *setting.Cfg, client zanzana.Client, store db.DB, lock *serverlock.ServerLockService) *ZanzanaReconciler {
-	return &ZanzanaReconciler{
+	zanzanaReconciler := &ZanzanaReconciler{
 		cfg:    cfg,
 		log:    log.New("zanzana.reconciler"),
 		client: client,
@@ -90,6 +92,19 @@ func NewZanzanaReconciler(cfg *setting.Cfg, client zanzana.Client, store db.DB,
 			),
 		},
 	}
+
+	if cfg.AnonymousEnabled {
+		zanzanaReconciler.reconcilers = append(zanzanaReconciler.reconcilers,
+			newResourceReconciler(
+				"anonymous role binding",
+				anonymousRoleBindingsCollector(cfg, store),
+				zanzanaCollector([]string{zanzana.RelationAssignee}),
+				client,
+			),
+		)
+	}
+
+	return zanzanaReconciler
 }
 
 // Reconcile schedules as job that will run and reconcile resources between
@@ -182,3 +197,22 @@ func (r *ZanzanaReconciler) getOrgs(ctx context.Context) ([]int64, error) {
 	}
 	return orgs, nil
 }
+
+func getOrgByName(ctx context.Context, store db.DB, name string) (*org.Org, error) {
+	var orga org.Org
+	err := store.WithDbSession(ctx, func(dbSession *db.Session) error {
+		exists, err := dbSession.Where("name=?", name).Get(&orga)
+		if err != nil {
+			return err
+		}
+		if !exists {
+			return fmt.Errorf("org does not exist: %s", name)
+		}
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+	return &orga, nil
+}