MT AuthZ: Resolve renderer permissions in MT authZ service (#99362)

* resolve renderer permissions in MT authZ service * also include DS read perms * fix tests and linting
2025-01-23 10:21:43 +00:00
parent 4fb7b47971
commit 723fa7ddf9
4 changed files with 61 additions and 12 deletions
@@ -41,9 +41,13 @@ func (c *Render) Authenticate(ctx context.Context, r *authn.Request) (*authn.Ide
 	}

 	if renderUsr.UserID <= 0 {
+		identityType := claims.TypeAnonymous
+		if org.RoleType(renderUsr.OrgRole) == org.RoleAdmin {
+			identityType = claims.TypeRenderService
+		}
 		return &authn.Identity{
 			ID:              "0",
-			Type:            claims.TypeRenderService,
+			Type:            identityType,
 			OrgID:           renderUsr.OrgID,
 			OrgRoles:        map[int64]org.RoleType{renderUsr.OrgID: org.RoleType(renderUsr.OrgRole)},
 			ClientParams:    authn.ClientParams{SyncPermissions: true},