From 8a5b6804dd1e63f71bd32d395b79392c6287b866 Mon Sep 17 00:00:00 2001
From: Dafydd <dafydd.thomas@grafana.com>
Date: Tue, 2 Dec 2025 10:44:43 +0000
Subject: [PATCH] wip: add separate authorization logic for datasources

---
 pkg/registry/apis/collections/register.go | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkg/registry/apis/collections/register.go b/pkg/registry/apis/collections/register.go
index f636331fa78..9bbf7e0e70c 100644
--- a/pkg/registry/apis/collections/register.go
+++ b/pkg/registry/apis/collections/register.go
@@ -1,6 +1,7 @@
 package collections
 
 import (
+	"context"
 	"fmt"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -124,7 +125,16 @@ func (b *APIBuilder) UpdateAPIGroupInfo(apiGroupInfo *genericapiserver.APIGroupI
 }
 
 func (b *APIBuilder) GetAuthorizer() authorizer.Authorizer {
-	return b.authorizer
+
+	return authorizer.AuthorizerFunc(
+		func(ctx context.Context, attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
+			if attr.GetResource() == "stars" {
+				return b.authorizer.Authorize(ctx, attr)
+			}
+
+			return authorizer.DecisionAllow, "", nil
+
+		})
 }
 
 func (b *APIBuilder) GetOpenAPIDefinitions() common.GetOpenAPIDefinitions {