Playlists: Support get with None role (#115713)

pkg/services/apiserver/auth/authorizer/role.go

@@ -15,6 +15,8 @@ var _ authorizer.Authorizer = &roleAuthorizer{}
 
 var orgRoleNoneAsViewerAPIGroups = []string{
 	"productactivation.ext.grafana.com",
+	// playlist can be removed after this issue is resolved: https://github.com/grafana/grafana/issues/115712
+	"playlist.grafana.app",
 }
 
 type roleAuthorizer struct{}

pkg/tests/apis/playlist/playlist_test.go

@@ -426,6 +426,45 @@ func doPlaylistTests(t *testing.T, helper *apis.K8sTestHelper) *apis.K8sTestHelp
 		require.Equal(t, metav1.StatusReasonForbidden, rsp.Status.Reason)
 	})
 
+	t.Run("Check CRUD operations with None role", func(t *testing.T) {
+		// Create a playlist with admin user
+		clientAdmin := helper.GetResourceClient(apis.ResourceClientArgs{
+			User: helper.Org1.Admin,
+			GVR:  gvr,
+		})
+		created, err := clientAdmin.Resource.Create(context.Background(),
+			helper.LoadYAMLOrJSONFile("testdata/playlist-generate.yaml"),
+			metav1.CreateOptions{},
+		)
+		require.NoError(t, err)
+
+		clientNone := helper.GetResourceClient(apis.ResourceClientArgs{
+			User: helper.Org1.None,
+			GVR:  gvr,
+		})
+
+		// Now check if None user can perform a Get to start a playlist
+		_, err = clientNone.Resource.Get(context.Background(), created.GetName(), metav1.GetOptions{})
+		require.NoError(t, err)
+
+		// None role can get but can not create edit or delete a playlist
+		_, err = clientNone.Resource.Create(context.Background(),
+			helper.LoadYAMLOrJSONFile("testdata/playlist-generate.yaml"),
+			metav1.CreateOptions{},
+		)
+		require.Error(t, err)
+
+		_, err = clientNone.Resource.Update(context.Background(), created, metav1.UpdateOptions{})
+		require.Error(t, err)
+
+		err = clientNone.Resource.Delete(context.Background(), created.GetName(), metav1.DeleteOptions{})
+		require.Error(t, err)
+
+		// delete created resource
+		err = clientAdmin.Resource.Delete(context.Background(), created.GetName(), metav1.DeleteOptions{})
+		require.NoError(t, err)
+	})
+
 	t.Run("Check k8s client-go List from different org users", func(t *testing.T) {
 		// Check Org1 Viewer
 		client := helper.GetResourceClient(apis.ResourceClientArgs{