Authlib: Use types package rather than claims (#99243)

pkg/services/accesscontrol/acimpl/service.go

@@ -8,10 +8,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel/attribute"
 
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/api/routing"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/db"

pkg/services/accesscontrol/api/api.go

@@ -7,9 +7,10 @@ import (
 	"net/http"
 	"strconv"
 
-	"github.com/grafana/authlib/claims"
 	"go.opentelemetry.io/otel"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"
 	"github.com/grafana/grafana/pkg/middleware"

pkg/services/accesscontrol/authorize_in_org_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"

pkg/services/accesscontrol/authorizer.go

@@ -5,8 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/grafana/authlib/authz"
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 )
@@ -45,7 +44,7 @@ type ResourceAuthorizerOptions struct {
 	Resolver ResourceResolver
 }
 
-var _ authz.AccessClient = (*LegacyAccessClient)(nil)
+var _ claims.AccessClient = (*LegacyAccessClient)(nil)
 
 func NewLegacyAccessClient(ac AccessControl, opts ...ResourceAuthorizerOptions) *LegacyAccessClient {
 	stored := map[string]ResourceAuthorizerOptions{}
@@ -85,34 +84,34 @@ type LegacyAccessClient struct {
 	opts map[string]ResourceAuthorizerOptions
 }
 
-func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
+func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
 	ident, ok := id.(identity.Requester)
 	if !ok {
-		return authz.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
+		return claims.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
 	}
 
 	opts, ok := c.opts[req.Resource]
 	if !ok {
 		// For now we fallback to grafana admin if no options are found for resource.
 		if ident.GetIsGrafanaAdmin() {
-			return authz.CheckResponse{Allowed: true}, nil
+			return claims.CheckResponse{Allowed: true}, nil
 		}
-		return authz.CheckResponse{}, nil
+		return claims.CheckResponse{}, nil
 	}
 
 	skip := opts.Unchecked[req.Verb]
 	if skip {
-		return authz.CheckResponse{Allowed: true}, nil
+		return claims.CheckResponse{Allowed: true}, nil
 	}
 
 	action, ok := opts.Mapping[req.Verb]
 	if !ok {
-		return authz.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
+		return claims.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
 	}
 
 	ns, err := claims.ParseNamespace(req.Namespace)
 	if err != nil {
-		return authz.CheckResponse{}, err
+		return claims.CheckResponse{}, err
 	}
 
 	var eval Evaluator
@@ -120,7 +119,7 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
 		if opts.Resolver != nil {
 			scopes, err := opts.Resolver.Resolve(ctx, ns, req.Name)
 			if err != nil {
-				return authz.CheckResponse{}, err
+				return claims.CheckResponse{}, err
 			}
 			eval = EvalPermission(action, scopes...)
 		} else {
@@ -131,18 +130,18 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
 		eval = EvalPermission(action)
 	} else {
 		// Assuming that all non list request should have a valid name
-		return authz.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
+		return claims.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
 	}
 
 	allowed, err := c.ac.Evaluate(ctx, ident, eval)
 	if err != nil {
-		return authz.CheckResponse{}, err
+		return claims.CheckResponse{}, err
 	}
 
-	return authz.CheckResponse{Allowed: allowed}, nil
+	return claims.CheckResponse{Allowed: allowed}, nil
 }
 
-func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
+func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req claims.ListRequest) (claims.ItemChecker, error) {
 	ident, ok := id.(identity.Requester)
 	if !ok {
 		return nil, errors.New("expected identity.Requester for legacy access control")

pkg/services/accesscontrol/authorizer_test.go

@@ -6,8 +6,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/grafana/authlib/authz"
-
+	authlib "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/accesscontrol/acimpl"
@@ -20,7 +19,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
 	t.Run("should reject when when no configuration for resource exist", func(t *testing.T) {
 		a := accesscontrol.NewLegacyAccessClient(ac)
 
-		res, err := a.Check(context.Background(), &identity.StaticRequester{}, authz.CheckRequest{
+		res, err := a.Check(context.Background(), &identity.StaticRequester{}, authlib.CheckRequest{
 			Verb:      "get",
 			Resource:  "dashboards",
 			Namespace: "default",
@@ -43,7 +42,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
 			accesscontrol.Permission{Action: "dashboards:read", Scope: "dashboards:uid:2"},
 		)
 
-		res, err := a.Check(context.Background(), ident, authz.CheckRequest{
+		res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
 			Verb:      "get",
 			Namespace: "default",
 			Resource:  "dashboards",
@@ -67,7 +66,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
 			accesscontrol.Permission{Action: "dashboards:read"},
 		)
 
-		res, err := a.Check(context.Background(), ident, authz.CheckRequest{
+		res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
 			Verb:      "list",
 			Namespace: "default",
 			Resource:  "dashboards",
@@ -90,7 +89,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
 			accesscontrol.Permission{Action: "dashboards:read", Scope: "dashboards:uid:1"},
 		)
 
-		res, err := a.Check(context.Background(), ident, authz.CheckRequest{
+		res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
 			Verb:      "get",
 			Namespace: "default",
 			Resource:  "dashboards",
@@ -115,7 +114,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
 
 		ident := newIdent(accesscontrol.Permission{})
 
-		res, err := a.Check(context.Background(), ident, authz.CheckRequest{
+		res, err := a.Check(context.Background(), ident, authlib.CheckRequest{
 			Verb:      "get",
 			Namespace: "default",
 			Resource:  "dashboards",
@@ -125,7 +124,7 @@ func TestLegacyAccessClient_Check(t *testing.T) {
 		assert.NoError(t, err)
 		assert.Equal(t, true, res.Allowed)
 
-		res, err = a.Check(context.Background(), ident, authz.CheckRequest{
+		res, err = a.Check(context.Background(), ident, authlib.CheckRequest{
 			Verb:      "create",
 			Namespace: "default",
 			Resource:  "dashboards",

pkg/services/accesscontrol/cacheutils_test.go

@@ -6,7 +6,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/org"

pkg/services/accesscontrol/dualwrite/reconciler.go

@@ -6,9 +6,10 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
 	"go.opentelemetry.io/otel"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/serverlock"

pkg/services/accesscontrol/dualwrite/resource_reconciler.go

@@ -4,9 +4,10 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/grafana/authlib/claims"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 
+	claims "github.com/grafana/authlib/types"
+
 	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
 	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 )

pkg/services/accesscontrol/ossaccesscontrol/receivers.go

@@ -3,7 +3,7 @@ package ossaccesscontrol
 import (
 	"context"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/api/routing"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"

pkg/services/anonymous/anonimpl/client.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/anonymous"

pkg/services/anonymous/anonimpl/client_test.go

@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/anonymous/anontest"
 	"github.com/grafana/grafana/pkg/services/authn"

pkg/services/apiserver/auth/authorizer/org_id.go

@@ -4,11 +4,12 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/grafana/authlib/claims"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/org"
-	"k8s.io/apiserver/pkg/authorization/authorizer"
 )
 
 var _ authorizer.Authorizer = &orgIDAuthorizer{}

pkg/services/apiserver/auth/authorizer/resource.go

@@ -4,18 +4,18 @@ import (
 	"context"
 	"errors"
 
-	"github.com/grafana/authlib/authz"
-	"github.com/grafana/authlib/claims"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
+
+	claims "github.com/grafana/authlib/types"
 )
 
-func NewResourceAuthorizer(c authz.AccessClient) authorizer.Authorizer {
+func NewResourceAuthorizer(c claims.AccessClient) authorizer.Authorizer {
 	return ResourceAuthorizer{c}
 }
 
 // ResourceAuthorizer is used to translate authorizer.Authorizer calls to claims.AccessClient calls
 type ResourceAuthorizer struct {
-	c authz.AccessClient
+	c claims.AccessClient
 }
 
 func (r ResourceAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error) {
@@ -23,12 +23,12 @@ func (r ResourceAuthorizer) Authorize(ctx context.Context, attr authorizer.Attri
 		return authorizer.DecisionNoOpinion, "", nil
 	}
 
-	ident, ok := claims.From(ctx)
+	ident, ok := claims.AuthInfoFrom(ctx)
 	if !ok {
 		return authorizer.DecisionDeny, "", errors.New("no identity found for request")
 	}
 
-	res, err := r.c.Check(ctx, ident, authz.CheckRequest{
+	res, err := r.c.Check(ctx, ident, claims.CheckRequest{
 		Verb:        attr.GetVerb(),
 		Group:       attr.GetAPIGroup(),
 		Resource:    attr.GetResource(),

pkg/services/apiserver/auth/authorizer/stack_id.go

@@ -5,11 +5,12 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/grafana/authlib/claims"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/setting"
-	"k8s.io/apiserver/pkg/authorization/authorizer"
 )
 
 var _ authorizer.Authorizer = &stackIDAuthorizer{}

pkg/services/apiserver/endpoints/request/namespace.go

@@ -7,7 +7,7 @@ import (
 
 	"k8s.io/apiserver/pkg/endpoints/request"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/setting"
 )

pkg/services/auth/idimpl/service.go

@@ -7,11 +7,12 @@ import (
 	"time"
 
 	"github.com/go-jose/go-jose/v3/jwt"
-	authnlib "github.com/grafana/authlib/authn"
-	"github.com/grafana/authlib/claims"
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/sync/singleflight"
 
+	authnlib "github.com/grafana/authlib/authn"
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/remotecache"

pkg/services/auth/idimpl/service_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/infra/remotecache"
 	"github.com/grafana/grafana/pkg/services/auth"
 	"github.com/grafana/grafana/pkg/services/auth/idtest"

pkg/services/authn/authn.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/middleware/cookies"

pkg/services/authn/authnimpl/service.go

@@ -7,12 +7,13 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/trace"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"

pkg/services/authn/authnimpl/service_test.go

@@ -8,13 +8,14 @@ import (
 	"slices"
 	"testing"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel/codes"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 	"go.opentelemetry.io/otel/sdk/trace/tracetest"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"

pkg/services/authn/authnimpl/sync/oauth_token_sync.go

@@ -7,10 +7,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/grafana/authlib/claims"
 	"golang.org/x/oauth2"
 	"golang.org/x/sync/singleflight"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/localcache"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"

pkg/services/authn/authnimpl/sync/oauth_token_sync_test.go

@@ -6,11 +6,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/oauth2"
 	"golang.org/x/sync/singleflight"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/localcache"
 	"github.com/grafana/grafana/pkg/infra/log"

pkg/services/authn/authnimpl/sync/org_sync.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"sort"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"

pkg/services/authn/authnimpl/sync/org_sync_test.go

@@ -5,10 +5,11 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"

pkg/services/authn/authnimpl/sync/rbac_sync.go

@@ -6,7 +6,7 @@ import (
 
 	"golang.org/x/exp/maps"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"

pkg/services/authn/authnimpl/sync/rbac_sync_test.go

@@ -4,10 +4,11 @@ import (
 	"context"
 	"testing"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"

pkg/services/authn/authnimpl/sync/user_sync.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/infra/log"

pkg/services/authn/authnimpl/sync/user_sync_test.go

@@ -4,10 +4,11 @@ import (
 	"context"
 	"testing"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"

pkg/services/authn/authntest/mock.go

@@ -3,7 +3,7 @@ package authntest
 import (
 	"context"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/models/usertoken"
 	"github.com/grafana/grafana/pkg/services/authn"

pkg/services/authn/clients/api_key.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/components/apikeygen"
 	"github.com/grafana/grafana/pkg/components/satokengen"

pkg/services/authn/clients/api_key_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/components/apikeygen"
 	"github.com/grafana/grafana/pkg/components/satokengen"
 	"github.com/grafana/grafana/pkg/services/apikey"

pkg/services/authn/clients/basic_test.go

@@ -5,9 +5,10 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
 )

pkg/services/authn/clients/ext_jwt.go

@@ -7,8 +7,9 @@ import (
 	"strings"
 
 	"github.com/go-jose/go-jose/v3/jwt"
+
 	authlib "github.com/grafana/authlib/authn"
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/infra/log"

pkg/services/authn/clients/ext_jwt_test.go

@@ -11,11 +11,12 @@ import (
 
 	"github.com/go-jose/go-jose/v3"
 	"github.com/go-jose/go-jose/v3/jwt"
-	authnlib "github.com/grafana/authlib/authn"
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	authnlib "github.com/grafana/authlib/authn"
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/setting"
 )

pkg/services/authn/clients/grafana.go

@@ -7,7 +7,7 @@ import (
 	"net/mail"
 	"strconv"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/login"
 	"github.com/grafana/grafana/pkg/services/org"

pkg/services/authn/clients/grafana_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/login"
 	"github.com/grafana/grafana/pkg/services/org"

pkg/services/authn/clients/oauth_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/login/social"
 	"github.com/grafana/grafana/pkg/login/social/socialtest"

pkg/services/authn/clients/password_test.go

@@ -4,9 +4,10 @@ import (
 	"context"
 	"testing"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
 	"github.com/grafana/grafana/pkg/services/loginattempt/loginattempttest"

pkg/services/authn/clients/passwordless.go

@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/remotecache"

pkg/services/authn/clients/passwordless_test.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/infra/remotecache"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/login"

pkg/services/authn/clients/proxy.go

@@ -12,7 +12,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/infra/log"

pkg/services/authn/clients/proxy_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
 	"github.com/grafana/grafana/pkg/setting"

pkg/services/authn/clients/render.go

@@ -5,7 +5,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/login"

pkg/services/authn/clients/render_test.go

@@ -7,9 +7,10 @@ import (
 	"time"
 
 	"github.com/golang/mock/gomock"
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/login"
 	"github.com/grafana/grafana/pkg/services/org"

pkg/services/authn/clients/session.go

@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/auth"
 	"github.com/grafana/grafana/pkg/services/authn"

pkg/services/authn/clients/session_test.go

@@ -6,10 +6,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/models/usertoken"
 	"github.com/grafana/grafana/pkg/services/auth"
 	"github.com/grafana/grafana/pkg/services/auth/authtest"

pkg/services/authn/identity.go

@@ -5,10 +5,11 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/authn"
-	"github.com/grafana/authlib/claims"
 	"golang.org/x/oauth2"
 
+	"github.com/grafana/authlib/authn"
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/models/usertoken"
 	"github.com/grafana/grafana/pkg/services/login"

pkg/services/authz/client.go

@@ -6,14 +6,14 @@ import (
 
 	"github.com/fullstorydev/grpchan"
 	"github.com/fullstorydev/grpchan/inprocgrpc"
-	authnlib "github.com/grafana/authlib/authn"
-	authzlib "github.com/grafana/authlib/authz"
-	authzv1 "github.com/grafana/authlib/authz/proto/v1"
-	"github.com/grafana/authlib/claims"
 	grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
+	authnlib "github.com/grafana/authlib/authn"
+	authzlib "github.com/grafana/authlib/authz"
+	authzv1 "github.com/grafana/authlib/authz/proto/v1"
+	authlib "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"
@@ -38,7 +38,7 @@ func ProvideAuthZClient(
 	tracer tracing.Tracer,
 	db db.DB,
 	acService accesscontrol.Service,
-) (authzlib.AccessClient, error) {
+) (authlib.AccessClient, error) {
 	authCfg, err := ReadCfg(cfg)
 	if err != nil {
 		return nil, err
@@ -76,7 +76,7 @@ func ProvideAuthZClient(
 // You need to provide a remote address in the configuration
 func ProvideStandaloneAuthZClient(
 	cfg *setting.Cfg, features featuremgmt.FeatureToggles, tracer tracing.Tracer,
-) (authzlib.AccessClient, error) {
+) (authlib.AccessClient, error) {
 	if !features.IsEnabledGlobally(featuremgmt.FlagAuthZGRPCServer) {
 		return nil, nil
 	}
@@ -92,10 +92,10 @@ func ProvideStandaloneAuthZClient(
 	return newCloudLegacyClient(authCfg, tracer)
 }
 
-func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authzlib.AccessClient, error) {
+func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authlib.AccessClient, error) {
 	// For in-proc use-case authorize add fake service claims - it should be able to access every namespace, as there is only one
 	staticAuth := func(ctx context.Context) (context.Context, error) {
-		ctx = claims.WithClaims(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
+		ctx = authlib.WithAuthInfo(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
 			Rest: authnlib.AccessTokenClaims{
 				Namespace: "*",
 			},
@@ -121,7 +121,7 @@ func newInProcLegacyClient(server *rbac.Service, tracer tracing.Tracer) (authzli
 	)
 }
 
-func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessClient, error) {
+func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authlib.AccessClient, error) {
 	// This client interceptor is a noop, as we don't send an access token
 	clientConfig := authnlib.GrpcClientConfig{}
 	clientInterceptor, err := authnlib.NewGrpcClientInterceptor(
@@ -151,7 +151,7 @@ func newGrpcLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessCl
 	return client, nil
 }
 
-func newCloudLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authzlib.AccessClient, error) {
+func newCloudLegacyClient(authCfg *Cfg, tracer tracing.Tracer) (authlib.AccessClient, error) {
 	grpcClientConfig := authnlib.GrpcClientConfig{
 		TokenClientConfig: &authnlib.TokenExchangeConfig{
 			Token:            authCfg.token,

pkg/services/authz/rbac/models.go

@@ -1,6 +1,6 @@
 package rbac
 
-import "github.com/grafana/authlib/claims"
+import claims "github.com/grafana/authlib/types"
 
 type CheckRequest struct {
 	Namespace    claims.NamespaceInfo

pkg/services/authz/rbac/service.go

@@ -7,8 +7,6 @@ import (
 	"strings"
 	"time"
 
-	authzv1 "github.com/grafana/authlib/authz/proto/v1"
-	"github.com/grafana/authlib/claims"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/sync/singleflight"
@@ -16,6 +14,9 @@ import (
 	"google.golang.org/grpc/status"
 	"k8s.io/apiserver/pkg/endpoints/request"
 
+	authzv1 "github.com/grafana/authlib/authz/proto/v1"
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/localcache"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"
@@ -200,7 +201,7 @@ func validateNamespace(ctx context.Context, nameSpace string) (claims.NamespaceI
 	if nameSpace == "" {
 		return claims.NamespaceInfo{}, status.Error(codes.InvalidArgument, "namespace is required")
 	}
-	authInfo, has := claims.From(ctx)
+	authInfo, has := claims.AuthInfoFrom(ctx)
 	if !has {
 		return claims.NamespaceInfo{}, status.Error(codes.Internal, "could not get auth info from context")
 	}

pkg/services/authz/rbac/service_test.go

@@ -5,11 +5,12 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/grafana/authlib/claims"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/sync/singleflight"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/localcache"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"

pkg/services/authz/rbac/store/permission_store.go

@@ -3,8 +3,7 @@ package store
 import (
 	"context"
 
-	"github.com/grafana/authlib/claims"
-
+	"github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/storage/legacysql"
@@ -12,7 +11,7 @@ import (
 )
 
 type PermissionStore interface {
-	GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error)
+	GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error)
 }
 
 type PermissionsQuery struct {
@@ -63,7 +62,7 @@ func newGetPermissions(sql *legacysql.LegacyDatabaseHelper, q *PermissionsQuery)
 	}
 }
 
-func (s *SQLPermissionsStore) GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
+func (s *SQLPermissionsStore) GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
 	ctx, span := s.tracer.Start(ctx, "authz_direct_db.database.GetUserPermissions")
 	defer span.End()
 
@@ -111,7 +110,7 @@ type StaticPermissionStore struct {
 	ac accesscontrol.Service
 }
 
-func (s *StaticPermissionStore) GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
+func (s *StaticPermissionStore) GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
 	roles := []string{query.Role}
 	if query.IsServerAdmin {
 		roles = append(roles, "Grafana Admin")
@@ -146,7 +145,7 @@ type UnionPermissionStore struct {
 	stores []PermissionStore
 }
 
-func (u *UnionPermissionStore) GetUserPermissions(ctx context.Context, ns claims.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
+func (u *UnionPermissionStore) GetUserPermissions(ctx context.Context, ns types.NamespaceInfo, query PermissionsQuery) ([]accesscontrol.Permission, error) {
 	var permissions []accesscontrol.Permission
 	for _, s := range u.stores {
 		result, err := s.GetUserPermissions(ctx, ns, query)

pkg/services/authz/rbac/store/store.go

@@ -3,9 +3,10 @@ package store
 import (
 	"fmt"
 
-	"github.com/grafana/authlib/claims"
 	"golang.org/x/net/context"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/storage/legacysql"
 	"github.com/grafana/grafana/pkg/storage/unified/sql/sqltemplate"

pkg/services/authz/zanzana.go

@@ -6,10 +6,6 @@ import (
 	"fmt"
 
 	"github.com/fullstorydev/grpchan/inprocgrpc"
-	authnlib "github.com/grafana/authlib/authn"
-	authzv1 "github.com/grafana/authlib/authz/proto/v1"
-	"github.com/grafana/authlib/claims"
-	"github.com/grafana/dskit/services"
 	grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 	"github.com/prometheus/client_golang/prometheus"
@@ -18,6 +14,10 @@ import (
 	healthv1pb "google.golang.org/grpc/health/grpc_health_v1"
 	"google.golang.org/grpc/metadata"
 
+	authnlib "github.com/grafana/authlib/authn"
+	authzv1 "github.com/grafana/authlib/authz/proto/v1"
+	claims "github.com/grafana/authlib/types"
+	"github.com/grafana/dskit/services"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"
@@ -96,7 +96,7 @@ func ProvideZanzana(cfg *setting.Cfg, db db.DB, features featuremgmt.FeatureTogg
 		channel := &inprocgrpc.Channel{}
 		// Put * as a namespace so we can properly authorize request with in-proc mode
 		channel.WithServerUnaryInterceptor(grpcAuth.UnaryServerInterceptor(func(ctx context.Context) (context.Context, error) {
-			ctx = claims.WithClaims(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
+			ctx = claims.WithAuthInfo(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
 				Rest: authnlib.AccessTokenClaims{
 					Namespace: "*",
 				},
@@ -196,7 +196,7 @@ func (z *Zanzana) start(ctx context.Context) error {
 		if err != nil {
 			return nil, err
 		}
-		return claims.WithClaims(ctx, c), nil
+		return claims.WithAuthInfo(ctx, c), nil
 	})
 
 	z.handle, err = grpcserver.ProvideService(z.cfg, z.features, authfn, tracer, prometheus.DefaultRegisterer)

pkg/services/authz/zanzana/client.go

@@ -3,16 +3,16 @@ package zanzana
 import (
 	"context"
 
-	"github.com/grafana/authlib/authz"
 	"google.golang.org/grpc"
 
+	authlib "github.com/grafana/authlib/types"
 	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
 	"github.com/grafana/grafana/pkg/services/authz/zanzana/client"
 )
 
 // Client is a wrapper around [openfgav1.OpenFGAServiceClient]
 type Client interface {
-	authz.AccessClient
+	authlib.AccessClient
 	Read(ctx context.Context, req *authzextv1.ReadRequest) (*authzextv1.ReadResponse, error)
 	Write(ctx context.Context, req *authzextv1.WriteRequest) error
 	BatchCheck(ctx context.Context, req *authzextv1.BatchCheckRequest) (*authzextv1.BatchCheckResponse, error)

pkg/services/authz/zanzana/client/client.go

@@ -3,18 +3,18 @@ package client
 import (
 	"context"
 
-	"github.com/grafana/authlib/authz"
-	authzv1 "github.com/grafana/authlib/authz/proto/v1"
-	"github.com/grafana/authlib/claims"
 	"go.opentelemetry.io/otel"
 	"google.golang.org/grpc"
 
+	authzv1 "github.com/grafana/authlib/authz/proto/v1"
+	authlib "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	"github.com/grafana/grafana/pkg/infra/log"
 	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
 )
 
-var _ authz.AccessClient = (*Client)(nil)
+var _ authlib.AccessClient = (*Client)(nil)
 
 var tracer = otel.Tracer("github.com/grafana/grafana/pkg/services/authz/zanzana/client")
 
@@ -34,8 +34,8 @@ func New(cc grpc.ClientConnInterface) (*Client, error) {
 	return c, nil
 }
 
-func (c *Client) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
-	ctx, span := tracer.Start(ctx, "authz.zanzana.client.Check")
+func (c *Client) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
+	ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Check")
 	defer span.End()
 
 	res, err := c.authz.Check(ctx, &authzv1.CheckRequest{
@@ -51,14 +51,14 @@ func (c *Client) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckR
 	})
 
 	if err != nil {
-		return authz.CheckResponse{}, err
+		return authlib.CheckResponse{}, err
 	}
 
-	return authz.CheckResponse{Allowed: res.GetAllowed()}, nil
+	return authlib.CheckResponse{Allowed: res.GetAllowed()}, nil
 }
 
-func (c *Client) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
-	ctx, span := tracer.Start(ctx, "authz.zanzana.client.Compile")
+func (c *Client) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.ListRequest) (authlib.ItemChecker, error) {
+	ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Compile")
 	defer span.End()
 
 	res, err := c.authz.List(ctx, &authzv1.ListRequest{
@@ -76,7 +76,7 @@ func (c *Client) Compile(ctx context.Context, id claims.AuthInfo, req authz.List
 	return newItemChecker(res), nil
 }
 
-func newItemChecker(res *authzv1.ListResponse) authz.ItemChecker {
+func newItemChecker(res *authzv1.ListResponse) authlib.ItemChecker {
 	// if we can see all resource of this type we can just return a function that always return true
 	if res.GetAll() {
 		return func(_, _, _ string) bool { return true }
@@ -104,14 +104,14 @@ func newItemChecker(res *authzv1.ListResponse) authz.ItemChecker {
 }
 
 func (c *Client) Read(ctx context.Context, req *authzextv1.ReadRequest) (*authzextv1.ReadResponse, error) {
-	ctx, span := tracer.Start(ctx, "authz.zanzana.client.Read")
+	ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Read")
 	defer span.End()
 
 	return c.authzext.Read(ctx, req)
 }
 
 func (c *Client) Write(ctx context.Context, req *authzextv1.WriteRequest) error {
-	ctx, span := tracer.Start(ctx, "authz.zanzana.client.Write")
+	ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Write")
 	defer span.End()
 
 	_, err := c.authzext.Write(ctx, req)
@@ -119,7 +119,7 @@ func (c *Client) Write(ctx context.Context, req *authzextv1.WriteRequest) error
 }
 
 func (c *Client) BatchCheck(ctx context.Context, req *authzextv1.BatchCheckRequest) (*authzextv1.BatchCheckResponse, error) {
-	ctx, span := tracer.Start(ctx, "authz.zanzana.client.Check")
+	ctx, span := tracer.Start(ctx, "authlib.zanzana.client.Check")
 	defer span.End()
 
 	return c.authzext.BatchCheck(ctx, req)

pkg/services/authz/zanzana/client/noop.go

@@ -3,13 +3,11 @@ package client
 import (
 	"context"
 
-	"github.com/grafana/authlib/authz"
-	"github.com/grafana/authlib/claims"
-
+	authlib "github.com/grafana/authlib/types"
 	authzextv1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
 )
 
-var _ authz.AccessClient = (*NoopClient)(nil)
+var _ authlib.AccessClient = (*NoopClient)(nil)
 
 func NewNoop() *NoopClient {
 	return &NoopClient{}
@@ -17,11 +15,11 @@ func NewNoop() *NoopClient {
 
 type NoopClient struct{}
 
-func (nc *NoopClient) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
-	return authz.CheckResponse{}, nil
+func (nc *NoopClient) Check(ctx context.Context, id authlib.AuthInfo, req authlib.CheckRequest) (authlib.CheckResponse, error) {
+	return authlib.CheckResponse{}, nil
 }
 
-func (nc *NoopClient) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
+func (nc *NoopClient) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.ListRequest) (authlib.ItemChecker, error) {
 	return nil, nil
 }
 

pkg/services/authz/zanzana/server/auth.go

@@ -3,13 +3,14 @@ package server
 import (
 	"context"
 
-	"github.com/grafana/authlib/claims"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	claims "github.com/grafana/authlib/types"
 )
 
 func authorize(ctx context.Context, namespace string) error {
-	c, ok := claims.From(ctx)
+	c, ok := claims.AuthInfoFrom(ctx)
 	if !ok {
 		return status.Errorf(codes.Unauthenticated, "unauthenticated")
 	}

pkg/services/authz/zanzana/server/server_test.go

@@ -4,11 +4,12 @@ import (
 	"context"
 	"testing"
 
-	authnlib "github.com/grafana/authlib/authn"
-	"github.com/grafana/authlib/claims"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 	"github.com/stretchr/testify/require"
 
+	authnlib "github.com/grafana/authlib/authn"
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
@@ -113,7 +114,7 @@ func setup(t *testing.T, testDB db.DB, cfg *setting.Cfg) *Server {
 
 func newContextWithNamespace() context.Context {
 	ctx := context.Background()
-	ctx = claims.WithClaims(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
+	ctx = claims.WithAuthInfo(ctx, authnlib.NewAccessTokenAuthInfo(authnlib.Claims[authnlib.AccessTokenClaims]{
 		Rest: authnlib.AccessTokenClaims{
 			Namespace: "*",
 		},

pkg/services/authz/zanzana/zanzana.go

@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/grafana/authlib/authz"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 
+	authlib "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/services/authz/zanzana/common"
 )
 
@@ -124,7 +124,7 @@ func MergeFolderResourceTuples(a, b *openfgav1.TupleKey) {
 	va.GetListValue().Values = append(va.GetListValue().Values, vb.GetListValue().Values...)
 }
 
-func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*authz.CheckRequest, bool) {
+func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*authlib.CheckRequest, bool) {
 	translation, ok := resourceTranslations[kind]
 
 	if !ok {
@@ -141,7 +141,7 @@ func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*aut
 		return nil, false
 	}
 
-	req := &authz.CheckRequest{
+	req := &authlib.CheckRequest{
 		Namespace: namespace,
 		Verb:      verb,
 		Group:     translation.group,
@@ -153,7 +153,7 @@ func TranslateToCheckRequest(namespace, action, kind, folder, name string) (*aut
 	return req, true
 }
 
-func TranslateToListRequest(namespace, action, kind string) (*authz.ListRequest, bool) {
+func TranslateToListRequest(namespace, action, kind string) (*authlib.ListRequest, bool) {
 	translation, ok := resourceTranslations[kind]
 
 	if !ok {
@@ -161,7 +161,7 @@ func TranslateToListRequest(namespace, action, kind string) (*authz.ListRequest,
 	}
 
 	// FIXME: support different verbs
-	req := &authz.ListRequest{
+	req := &authlib.ListRequest{
 		Namespace: namespace,
 		Group:     translation.group,
 		Resource:  translation.resource,

pkg/services/contexthandler/contexthandler.go

@@ -9,7 +9,7 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	authnClients "github.com/grafana/grafana/pkg/services/authn/clients"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 

pkg/services/contexthandler/contexthandler_test.go

@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/api/routing"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/tracing"

pkg/services/dashboards/database/database.go

@@ -7,9 +7,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/grafana/authlib/claims"
 	"go.opentelemetry.io/otel"
 
+	claims "github.com/grafana/authlib/types"
+
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/metrics"

pkg/services/dashboards/service/dashboard_service.go

@@ -12,7 +12,6 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.opentelemetry.io/otel"
 	"golang.org/x/exp/slices"
@@ -22,7 +21,9 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/selection"
 
-	"github.com/grafana/authlib/claims"
+	common "github.com/grafana/grafana/pkg/apimachinery/apis/common/v0alpha1"
+
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend/gtime"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"

pkg/services/dashboardsnapshots/database/database.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/services/dashboardsnapshots"

pkg/services/folder/folderimpl/sqlstore.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/dskit/concurrency"
 
 	"github.com/grafana/grafana/pkg/infra/db"

pkg/services/oauthtoken/oauth_token.go

@@ -13,7 +13,7 @@ import (
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/oauth2"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/serverlock"

pkg/services/oauthtoken/oauth_token_test.go

@@ -6,7 +6,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"golang.org/x/oauth2"
+
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/serverlock"
@@ -22,10 +27,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/login/authinfotest"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/tests/testsuite"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"golang.org/x/oauth2"
 )
 
 const EXPIRED_ID_TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2V4YW1wbGUuY29tIiwic3ViIjoiMTIzNDU2Nzg5MCIsImF1ZCI6InlvdXItY2xpZW50LWlkIiwiZXhwIjoxNjAwMDAwMDAwLCJpYXQiOjE2MDAwMDAwMDAsIm5hbWUiOiJKb2huIERvZSIsImVtYWlsIjoiam9obkBleGFtcGxlLmNvbSJ9.c2lnbmF0dXJl" // #nosec G101 not a hardcoded credential

pkg/services/pluginsintegration/clientmiddleware/user_header_middleware.go

@@ -3,7 +3,7 @@ package clientmiddleware
 import (
 	"context"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 
 	"github.com/grafana/grafana/pkg/services/contexthandler"

pkg/services/serviceaccounts/api/api.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"strconv"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"

pkg/services/serviceaccounts/manager/service.go

@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/db"

pkg/services/stats/statsimpl/stats.go

@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/services/dashboards"

pkg/services/team/teamapi/team.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"strconv"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"

pkg/services/user/identity.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	authnlib "github.com/grafana/authlib/authn"
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 )

pkg/services/user/userimpl/verifier.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 	"github.com/grafana/grafana/pkg/services/auth"
 	"github.com/grafana/grafana/pkg/services/authn"