Zanzana: app platform style write APIs (#112812)

* refactor zanzana client instantiation

* refactor client imports

* POC write API (Mutate)

* fix linter

* delete exisitng folder parents

* refactor common functions

* minor refactor

* groupd operations by type

* atomic folder operations

* use deleteExisting for deletes

* Add tests for folders

* more tests

* resource permissions tests

* add more tests

* fix mock zanzana client

* fix linter

* fix linter

* re-use types from apps

* add some comments to the protobuf

pkg/services/authz/proto/v1/extention.proto

@@ -13,6 +13,70 @@ service AuthzExtentionService {
 
   rpc Read(ReadRequest) returns (ReadResponse);
   rpc Write(WriteRequest) returns (WriteResponse);
+
+  rpc Mutate(MutateRequest) returns (MutateResponse);
+}
+
+message MutateRequest {
+  string namespace = 1;
+  repeated MutateOperation operations = 2;
+}
+
+message MutateResponse {}
+
+message MutateOperation {
+  oneof operation {
+    SetFolderParentOperation set_folder_parent = 1;
+    DeleteFolderOperation delete_folder = 2;
+    CreatePermissionOperation create_permission = 3;
+    DeletePermissionOperation delete_permission = 4;
+  }
+}
+
+message SetFolderParentOperation {
+  // UID of the folder
+  string folder = 1;
+  // UID of the parent folder
+  string parent = 2;
+  // If true, delete all existing parent relations associated with the folder
+  bool delete_existing = 3;
+}
+
+message DeleteFolderOperation {
+  // UID of the folder to delete
+  string folder = 1;
+  // UID of the parent folder
+  string parent = 2;
+  // If true, delete all existing parent relations associated with the folder
+  bool delete_existing = 3;
+}
+
+message CreatePermissionOperation {
+  Resource resource = 1;
+  Permission permission = 2;
+}
+
+message DeletePermissionOperation {
+  Resource resource = 1;
+  Permission permission = 2;
+}
+
+message Resource {
+  // group of the resource (e.g: "dashboard.grafana.app")
+  string group = 1;
+  // kind of the resource (e.g: "dashboards")
+  string resource = 2;
+  // uid of the resource
+  string name = 3;
+}
+
+message Permission {
+  // kind of the identity getting the permission (e.g: "user", "team", "serviceaccount")
+  string kind = 1;
+  // uid of the identity getting the permission
+  string name = 2;
+  // action set granted to the user (e.g. "admin" or "edit", "view")
+  string verb = 3;
 }
 
 message TupleKey {

pkg/services/authz/proto/v1/extention_grpc.pb.go

@@ -22,6 +22,7 @@ const (
 	AuthzExtentionService_BatchCheck_FullMethodName = "/authz.extention.v1.AuthzExtentionService/BatchCheck"
 	AuthzExtentionService_Read_FullMethodName       = "/authz.extention.v1.AuthzExtentionService/Read"
 	AuthzExtentionService_Write_FullMethodName      = "/authz.extention.v1.AuthzExtentionService/Write"
+	AuthzExtentionService_Mutate_FullMethodName     = "/authz.extention.v1.AuthzExtentionService/Mutate"
 )
 
 // AuthzExtentionServiceClient is the client API for AuthzExtentionService service.
@@ -31,6 +32,7 @@ type AuthzExtentionServiceClient interface {
 	BatchCheck(ctx context.Context, in *BatchCheckRequest, opts ...grpc.CallOption) (*BatchCheckResponse, error)
 	Read(ctx context.Context, in *ReadRequest, opts ...grpc.CallOption) (*ReadResponse, error)
 	Write(ctx context.Context, in *WriteRequest, opts ...grpc.CallOption) (*WriteResponse, error)
+	Mutate(ctx context.Context, in *MutateRequest, opts ...grpc.CallOption) (*MutateResponse, error)
 }
 
 type authzExtentionServiceClient struct {
@@ -71,6 +73,16 @@ func (c *authzExtentionServiceClient) Write(ctx context.Context, in *WriteReques
 	return out, nil
 }
 
+func (c *authzExtentionServiceClient) Mutate(ctx context.Context, in *MutateRequest, opts ...grpc.CallOption) (*MutateResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(MutateResponse)
+	err := c.cc.Invoke(ctx, AuthzExtentionService_Mutate_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // AuthzExtentionServiceServer is the server API for AuthzExtentionService service.
 // All implementations should embed UnimplementedAuthzExtentionServiceServer
 // for forward compatibility
@@ -78,6 +90,7 @@ type AuthzExtentionServiceServer interface {
 	BatchCheck(context.Context, *BatchCheckRequest) (*BatchCheckResponse, error)
 	Read(context.Context, *ReadRequest) (*ReadResponse, error)
 	Write(context.Context, *WriteRequest) (*WriteResponse, error)
+	Mutate(context.Context, *MutateRequest) (*MutateResponse, error)
 }
 
 // UnimplementedAuthzExtentionServiceServer should be embedded to have forward compatible implementations.
@@ -93,6 +106,9 @@ func (UnimplementedAuthzExtentionServiceServer) Read(context.Context, *ReadReque
 func (UnimplementedAuthzExtentionServiceServer) Write(context.Context, *WriteRequest) (*WriteResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Write not implemented")
 }
+func (UnimplementedAuthzExtentionServiceServer) Mutate(context.Context, *MutateRequest) (*MutateResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Mutate not implemented")
+}
 
 // UnsafeAuthzExtentionServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to AuthzExtentionServiceServer will
@@ -159,6 +175,24 @@ func _AuthzExtentionService_Write_Handler(srv interface{}, ctx context.Context,
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthzExtentionService_Mutate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MutateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthzExtentionServiceServer).Mutate(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthzExtentionService_Mutate_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthzExtentionServiceServer).Mutate(ctx, req.(*MutateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // AuthzExtentionService_ServiceDesc is the grpc.ServiceDesc for AuthzExtentionService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -178,6 +212,10 @@ var AuthzExtentionService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Write",
 			Handler:    _AuthzExtentionService_Write_Handler,
 		},
+		{
+			MethodName: "Mutate",
+			Handler:    _AuthzExtentionService_Mutate_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "extention.proto",