IAM: Use the new way to authorize resources (#116061)

* Use name for authz for User, SA, Team

* Use VerbList

pkg/registry/apis/iam/team/rest_members.go

@@ -2,14 +2,20 @@ package team
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/registry/rest"
 
 	claims "github.com/grafana/authlib/types"
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/api/dtos"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	iamv0 "github.com/grafana/grafana/pkg/apis/iam/v0alpha1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+
 	"github.com/grafana/grafana/pkg/registry/apis/iam/common"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
@@ -23,12 +29,13 @@ var (
 	_ rest.Connecter       = (*LegacyTeamMemberREST)(nil)
 )
 
-func NewLegacyTeamMemberREST(store legacy.LegacyIdentityStore) *LegacyTeamMemberREST {
-	return &LegacyTeamMemberREST{store}
+func NewLegacyTeamMemberREST(store legacy.LegacyIdentityStore, ac claims.AccessClient) *LegacyTeamMemberREST {
+	return &LegacyTeamMemberREST{store: store, ac: ac}
 }
 
 type LegacyTeamMemberREST struct {
 	store legacy.LegacyIdentityStore
+	ac    claims.AccessClient
 }
 
 // New implements rest.Storage.
@@ -62,6 +69,30 @@ func (s *LegacyTeamMemberREST) Connect(ctx context.Context, name string, options
 	}
 
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ident, err := identity.GetRequester(ctx)
+		if err != nil {
+			responder.Error(err)
+			return
+		}
+
+		checkResp, err := s.ac.Check(ctx, ident, claims.CheckRequest{
+			Group:     iamv0alpha1.TeamResourceInfo.GroupResource().Group,
+			Resource:  iamv0alpha1.TeamResourceInfo.GroupResource().Resource,
+			Name:      name,
+			Namespace: ns.Value,
+			Verb:      utils.VerbGetPermissions,
+		}, "")
+
+		if err != nil {
+			responder.Error(err)
+			return
+		}
+
+		if !checkResp.Allowed {
+			responder.Error(apierrors.NewForbidden(iamv0alpha1.TeamResourceInfo.GroupResource(), name, fmt.Errorf("permission denied")))
+			return
+		}
+
 		res, err := s.store.ListTeamMembers(ctx, ns, legacy.ListTeamMembersQuery{
 			UID:        name,
 			Pagination: common.PaginationFromListQuery(r.URL.Query()),

pkg/registry/apis/iam/team/store.go

@@ -174,7 +174,7 @@ func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOpt
 
 	res, err := common.List(
 		ctx, resource, s.ac, common.PaginationFromListOptions(options),
-		func(ctx context.Context, ns claims.NamespaceInfo, p common.Pagination) (*common.ListResponse[iamv0alpha1.Team], error) {
+		func(ctx context.Context, ns claims.NamespaceInfo, p common.Pagination) (*common.ListResponse[*iamv0alpha1.Team], error) {
 			found, err := s.store.ListTeams(ctx, ns, legacy.ListTeamQuery{
 				Pagination: p,
 			})
@@ -183,12 +183,13 @@ func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOpt
 				return nil, err
 			}
 
-			teams := make([]iamv0alpha1.Team, 0, len(found.Teams))
+			teams := make([]*iamv0alpha1.Team, 0, len(found.Teams))
 			for _, t := range found.Teams {
-				teams = append(teams, toTeamObject(t, ns))
+				team := toTeamObject(t, ns)
+				teams = append(teams, &team)
 			}
 
-			return &common.ListResponse[iamv0alpha1.Team]{
+			return &common.ListResponse[*iamv0alpha1.Team]{
 				Items:    teams,
 				RV:       found.RV,
 				Continue: found.Continue,
@@ -200,7 +201,12 @@ func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOpt
 		return nil, fmt.Errorf("failed to list teams: %w", err)
 	}
 
-	list := &iamv0alpha1.TeamList{Items: res.Items}
+	items := make([]iamv0alpha1.Team, len(res.Items))
+	for i, t := range res.Items {
+		items[i] = *t
+	}
+
+	list := &iamv0alpha1.TeamList{Items: items}
 	list.Continue = common.OptionalFormatInt(res.Continue)
 	list.ResourceVersion = common.OptionalFormatInt(res.RV)