Anon: Add support to resolve anonymous identity (#87486)

pkg/services/anonymous/anonimpl/client.go

@@ -9,12 +9,20 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/anonymous"
 	"github.com/grafana/grafana/pkg/services/anonymous/anonimpl/anonstore"
+	"github.com/grafana/grafana/pkg/services/auth/identity"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/util/errutil"
+)
+
+var (
+	errInvalidOrg = errutil.Unauthorized("anonymous.invalid-org")
+	errInvalidID  = errutil.Unauthorized("anonymous.invalid-id")
 )
 
 var _ authn.ContextAwareClient = new(Anonymous)
+var _ authn.IdentityResolverClient = new(Anonymous)
 
 type Anonymous struct {
 	cfg               *setting.Cfg
@@ -49,13 +57,7 @@ func (a *Anonymous) Authenticate(ctx context.Context, r *authn.Request) (*authn.
 		a.log.Warn("Failed to tag anonymous session", "error", err)
 	}
 
-	return &authn.Identity{
-		ID:           authn.AnonymousNamespaceID,
-		OrgID:        o.ID,
-		OrgName:      o.Name,
-		OrgRoles:     map[int64]org.RoleType{o.ID: org.RoleType(a.cfg.AnonymousOrgRole)},
-		ClientParams: authn.ClientParams{SyncPermissions: true},
-	}, nil
+	return a.newAnonymousIdentity(o), nil
 }
 
 func (a *Anonymous) IsEnabled() bool {
@@ -67,8 +69,26 @@ func (a *Anonymous) Test(ctx context.Context, r *authn.Request) bool {
 	return true
 }
 
-func (a *Anonymous) Priority() uint {
-	return 100
+func (a *Anonymous) Namespace() string {
+	return authn.NamespaceAnonymous.String()
+}
+
+func (a *Anonymous) ResolveIdentity(ctx context.Context, orgID int64, namespaceID identity.NamespaceID) (*authn.Identity, error) {
+	o, err := a.orgService.GetByName(ctx, &org.GetOrgByNameQuery{Name: a.cfg.AnonymousOrgName})
+	if err != nil {
+		return nil, err
+	}
+
+	if o.ID != orgID {
+		return nil, errInvalidOrg.Errorf("anonymous user cannot authenticate in org %d", o.ID)
+	}
+
+	// Anonymous identities should always have the same namespace id.
+	if namespaceID != authn.AnonymousNamespaceID {
+		return nil, errInvalidID
+	}
+
+	return a.newAnonymousIdentity(o), nil
 }
 
 func (a *Anonymous) UsageStatFn(ctx context.Context) (map[string]any, error) {
@@ -82,3 +102,17 @@ func (a *Anonymous) UsageStatFn(ctx context.Context) (map[string]any, error) {
 
 	return m, nil
 }
+
+func (a *Anonymous) Priority() uint {
+	return 100
+}
+
+func (a *Anonymous) newAnonymousIdentity(o *org.Org) *authn.Identity {
+	return &authn.Identity{
+		ID:           authn.AnonymousNamespaceID,
+		OrgID:        o.ID,
+		OrgName:      o.Name,
+		OrgRoles:     map[int64]org.RoleType{o.ID: org.RoleType(a.cfg.AnonymousOrgRole)},
+		ClientParams: authn.ClientParams{SyncPermissions: true},
+	}
+}