security: disable auth when provisioning is enabled

pkg/services/authz/client.go

@@ -3,6 +3,7 @@ package authz
 import (
 	"context"
 	"errors"
+	"log/slog"
 
 	"github.com/fullstorydev/grpchan"
 	"github.com/fullstorydev/grpchan/inprocgrpc"
@@ -33,6 +34,12 @@ func ProvideAuthZClient(
 	cfg *setting.Cfg, features featuremgmt.FeatureToggles, grpcServer grpcserver.Provider,
 	tracer tracing.Tracer, db db.DB,
 ) (authzlib.AccessClient, error) {
+	// FIXME: SECURITY: Enable authorization. DO NOT MERGE until fixed.
+	if features.IsEnabledGlobally(featuremgmt.FlagProvisioning) && !setting.IsEnterprise {
+		slog.Warn("Authorization is disabled for provisioning. To enable, use Enterprise, or wait for OSS fix.")
+		return nil, nil
+	}
+
 	authCfg, err := ReadCfg(cfg)
 	if err != nil {
 		return nil, err

pkg/storage/unified/resource/go.sum

@@ -75,6 +75,7 @@ github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f h1:HR5nRmUQgX
 github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f/go.mod h1:f3HiCrHjHBdcm6E83vGaXh1KomZMA2P6aeo3hKx/wg0=
 github.com/Yiling-J/theine-go v0.6.0 h1:jv7V/tcD6ijL0T4kfbJDKP81TCZBkoriNTPSqwivWuY=
 github.com/Yiling-J/theine-go v0.6.0/go.mod h1:mdch1vjgGWd7s3rWKvY+MF5InRLfRv/CWVI9RVNQ8wY=
+github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=