Authlib: Use types package rather than claims (#99243)

pkg/services/accesscontrol/authorizer.go

@@ -5,8 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/grafana/authlib/authz"
-	"github.com/grafana/authlib/claims"
+	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 )
@@ -45,7 +44,7 @@ type ResourceAuthorizerOptions struct {
 	Resolver ResourceResolver
 }
 
-var _ authz.AccessClient = (*LegacyAccessClient)(nil)
+var _ claims.AccessClient = (*LegacyAccessClient)(nil)
 
 func NewLegacyAccessClient(ac AccessControl, opts ...ResourceAuthorizerOptions) *LegacyAccessClient {
 	stored := map[string]ResourceAuthorizerOptions{}
@@ -85,34 +84,34 @@ type LegacyAccessClient struct {
 	opts map[string]ResourceAuthorizerOptions
 }
 
-func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req authz.CheckRequest) (authz.CheckResponse, error) {
+func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req claims.CheckRequest) (claims.CheckResponse, error) {
 	ident, ok := id.(identity.Requester)
 	if !ok {
-		return authz.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
+		return claims.CheckResponse{}, errors.New("expected identity.Requester for legacy access control")
 	}
 
 	opts, ok := c.opts[req.Resource]
 	if !ok {
 		// For now we fallback to grafana admin if no options are found for resource.
 		if ident.GetIsGrafanaAdmin() {
-			return authz.CheckResponse{Allowed: true}, nil
+			return claims.CheckResponse{Allowed: true}, nil
 		}
-		return authz.CheckResponse{}, nil
+		return claims.CheckResponse{}, nil
 	}
 
 	skip := opts.Unchecked[req.Verb]
 	if skip {
-		return authz.CheckResponse{Allowed: true}, nil
+		return claims.CheckResponse{Allowed: true}, nil
 	}
 
 	action, ok := opts.Mapping[req.Verb]
 	if !ok {
-		return authz.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
+		return claims.CheckResponse{}, fmt.Errorf("missing action for %s %s", req.Verb, req.Resource)
 	}
 
 	ns, err := claims.ParseNamespace(req.Namespace)
 	if err != nil {
-		return authz.CheckResponse{}, err
+		return claims.CheckResponse{}, err
 	}
 
 	var eval Evaluator
@@ -120,7 +119,7 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
 		if opts.Resolver != nil {
 			scopes, err := opts.Resolver.Resolve(ctx, ns, req.Name)
 			if err != nil {
-				return authz.CheckResponse{}, err
+				return claims.CheckResponse{}, err
 			}
 			eval = EvalPermission(action, scopes...)
 		} else {
@@ -131,18 +130,18 @@ func (c *LegacyAccessClient) Check(ctx context.Context, id claims.AuthInfo, req
 		eval = EvalPermission(action)
 	} else {
 		// Assuming that all non list request should have a valid name
-		return authz.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
+		return claims.CheckResponse{}, fmt.Errorf("unhandled authorization: %s %s", req.Group, req.Verb)
 	}
 
 	allowed, err := c.ac.Evaluate(ctx, ident, eval)
 	if err != nil {
-		return authz.CheckResponse{}, err
+		return claims.CheckResponse{}, err
 	}
 
-	return authz.CheckResponse{Allowed: allowed}, nil
+	return claims.CheckResponse{Allowed: allowed}, nil
 }
 
-func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req authz.ListRequest) (authz.ItemChecker, error) {
+func (c *LegacyAccessClient) Compile(ctx context.Context, id claims.AuthInfo, req claims.ListRequest) (claims.ItemChecker, error) {
 	ident, ok := id.(identity.Requester)
 	if !ok {
 		return nil, errors.New("expected identity.Requester for legacy access control")