MT AuthZ: Resolve renderer permissions in MT authZ service (#99362)

* resolve renderer permissions in MT authZ service

* also include DS read perms

* fix tests and linting

pkg/services/authn/clients/render.go

@@ -41,9 +41,13 @@ func (c *Render) Authenticate(ctx context.Context, r *authn.Request) (*authn.Ide
 	}
 
 	if renderUsr.UserID <= 0 {
+		identityType := claims.TypeAnonymous
+		if org.RoleType(renderUsr.OrgRole) == org.RoleAdmin {
+			identityType = claims.TypeRenderService
+		}
 		return &authn.Identity{
 			ID:              "0",
-			Type:            claims.TypeRenderService,
+			Type:            identityType,
 			OrgID:           renderUsr.OrgID,
 			OrgRoles:        map[int64]org.RoleType{renderUsr.OrgID: org.RoleType(renderUsr.OrgRole)},
 			ClientParams:    authn.ClientParams{SyncPermissions: true},

pkg/services/authn/clients/render_test.go

@@ -29,7 +29,29 @@ func TestRender_Authenticate(t *testing.T) {
 
 	tests := []TestCase{
 		{
-			desc:      "expect valid render key to return render user identity",
+			desc:      "expect valid render key to return anonymous user identity for org role Viewer",
+			renderKey: "123",
+			req: &authn.Request{
+				HTTPRequest: &http.Request{
+					Header: map[string][]string{"Cookie": {"renderKey=123"}},
+				},
+			},
+			expectedIdentity: &authn.Identity{
+				ID:              "0",
+				Type:            claims.TypeAnonymous,
+				OrgID:           1,
+				OrgRoles:        map[int64]org.RoleType{1: org.RoleViewer},
+				AuthenticatedBy: login.RenderModule,
+				ClientParams:    authn.ClientParams{SyncPermissions: true},
+			},
+			expectedRenderUsr: &rendering.RenderUser{
+				OrgID:   1,
+				UserID:  0,
+				OrgRole: "Viewer",
+			},
+		},
+		{
+			desc:      "expect valid render key to return render user identity for org role Admin",
 			renderKey: "123",
 			req: &authn.Request{
 				HTTPRequest: &http.Request{
@@ -40,14 +62,14 @@ func TestRender_Authenticate(t *testing.T) {
 				ID:              "0",
 				Type:            claims.TypeRenderService,
 				OrgID:           1,
-				OrgRoles:        map[int64]org.RoleType{1: org.RoleViewer},
+				OrgRoles:        map[int64]org.RoleType{1: org.RoleAdmin},
 				AuthenticatedBy: login.RenderModule,
 				ClientParams:    authn.ClientParams{SyncPermissions: true},
 			},
 			expectedRenderUsr: &rendering.RenderUser{
 				OrgID:   1,
 				UserID:  0,
-				OrgRole: "Viewer",
+				OrgRole: "Admin",
 			},
 		},
 		{