Zanzana: Evaluate permissions alongside with RBAC engine (#90064)

* Zanzana: Evaluate permissions if feature flag enabled

* Fix tests

* adjust logs

* fix spelling

* remove unused

* only evaluate implemented resources

* refactor

pkg/services/accesscontrol/evaluator.go

@@ -11,9 +11,13 @@ import (
 
 var logger = log.New("accesscontrol.evaluator")
 
+type CheckerFn func(action string, scope string) (bool, error)
+
 type Evaluator interface {
 	// Evaluate permissions that are grouped by action
 	Evaluate(permissions map[string][]string) bool
+	// EvaluateCustom allows to perform evaluation with custom check function
+	EvaluateCustom(fn CheckerFn) (bool, error)
 	// MutateScopes executes a sequence of ScopeModifier functions on all embedded scopes of an evaluator and returns a new Evaluator
 	MutateScopes(ctx context.Context, mutate ScopeAttributeMutator) (Evaluator, error)
 	// String returns a string representation of permission required by the evaluator
@@ -80,6 +84,25 @@ func match(scope, target string) bool {
 	return scope == target
 }
 
+func (p permissionEvaluator) EvaluateCustom(fn CheckerFn) (bool, error) {
+	if len(p.Scopes) == 0 {
+		return fn(p.Action, "")
+	}
+
+	for _, target := range p.Scopes {
+		matches, err := fn(p.Action, target)
+		if err != nil {
+			return false, err
+		}
+
+		if matches {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
 func (p permissionEvaluator) MutateScopes(ctx context.Context, mutate ScopeAttributeMutator) (Evaluator, error) {
 	if p.Scopes == nil {
 		return EvalPermission(p.Action), nil
@@ -135,6 +158,19 @@ func (a allEvaluator) Evaluate(permissions map[string][]string) bool {
 	return true
 }
 
+func (a allEvaluator) EvaluateCustom(fn CheckerFn) (bool, error) {
+	for _, e := range a.allOf {
+		allowed, err := e.EvaluateCustom(fn)
+		if err != nil {
+			return false, err
+		}
+		if !allowed {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
 func (a allEvaluator) MutateScopes(ctx context.Context, mutate ScopeAttributeMutator) (Evaluator, error) {
 	resolved := false
 	modified := make([]Evaluator, 0, len(a.allOf))
@@ -195,6 +231,19 @@ func (a anyEvaluator) Evaluate(permissions map[string][]string) bool {
 	return false
 }
 
+func (a anyEvaluator) EvaluateCustom(fn CheckerFn) (bool, error) {
+	for _, e := range a.anyOf {
+		allowed, err := e.EvaluateCustom(fn)
+		if err != nil {
+			return false, err
+		}
+		if allowed {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 func (a anyEvaluator) MutateScopes(ctx context.Context, mutate ScopeAttributeMutator) (Evaluator, error) {
 	resolved := false
 	modified := make([]Evaluator, 0, len(a.anyOf))