Zanzana: Handle anonymous users (#97171)

* add anonymous users to schema

* sync anonymous user role

* remove unused

* fix linter

* only add anonymous reconciler if feature is enabled

pkg/services/authz/zanzana/common/tuple.go

@@ -14,6 +14,7 @@ const (
 	TypeUser           string = "user"
 	TypeServiceAccount string = "service-account"
 	TypeRenderService  string = "render"
+	TypeAnonymous      string = "anonymous"
 	TypeTeam           string = "team"
 	TypeRole           string = "role"
 )

pkg/services/authz/zanzana/schema/schema_core.fga

@@ -6,9 +6,11 @@ type service-account
 
 type render
 
+type anonymous
+
 type role
   relations
-    define assignee: [user, service-account, team#member, role#assignee]
+    define assignee: [user, service-account, anonymous, team#member, role#assignee]
 
 type team
   relations

pkg/services/authz/zanzana/zanzana.go

@@ -14,6 +14,7 @@ const (
 	TypeUser           = common.TypeUser
 	TypeServiceAccount = common.TypeServiceAccount
 	TypeRenderService  = common.TypeRenderService
+	TypeAnonymous      = common.TypeAnonymous
 	TypeTeam           = common.TypeTeam
 	TypeRole           = common.TypeRole
 	TypeFolder         = common.TypeFolder