From 9c3cdd4814929a29df18b7325eedbdbda0feddc8 Mon Sep 17 00:00:00 2001
From: Ezequiel Victorero <ezequiel.victorero@grafana.com>
Date: Tue, 30 Dec 2025 08:46:43 -0300
Subject: [PATCH] Playlists: Support get with None role (#115713)

---
 .../apiserver/auth/authorizer/role.go         |  2 +
 pkg/tests/apis/playlist/playlist_test.go      | 39 +++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/pkg/services/apiserver/auth/authorizer/role.go b/pkg/services/apiserver/auth/authorizer/role.go
index e8e70dd01c8..63313352571 100644
--- a/pkg/services/apiserver/auth/authorizer/role.go
+++ b/pkg/services/apiserver/auth/authorizer/role.go
@@ -15,6 +15,8 @@ var _ authorizer.Authorizer = &roleAuthorizer{}
 
 var orgRoleNoneAsViewerAPIGroups = []string{
 	"productactivation.ext.grafana.com",
+	// playlist can be removed after this issue is resolved: https://github.com/grafana/grafana/issues/115712
+	"playlist.grafana.app",
 }
 
 type roleAuthorizer struct{}
diff --git a/pkg/tests/apis/playlist/playlist_test.go b/pkg/tests/apis/playlist/playlist_test.go
index 2611624debb..da9a6530e5b 100644
--- a/pkg/tests/apis/playlist/playlist_test.go
+++ b/pkg/tests/apis/playlist/playlist_test.go
@@ -426,6 +426,45 @@ func doPlaylistTests(t *testing.T, helper *apis.K8sTestHelper) *apis.K8sTestHelp
 		require.Equal(t, metav1.StatusReasonForbidden, rsp.Status.Reason)
 	})
 
+	t.Run("Check CRUD operations with None role", func(t *testing.T) {
+		// Create a playlist with admin user
+		clientAdmin := helper.GetResourceClient(apis.ResourceClientArgs{
+			User: helper.Org1.Admin,
+			GVR:  gvr,
+		})
+		created, err := clientAdmin.Resource.Create(context.Background(),
+			helper.LoadYAMLOrJSONFile("testdata/playlist-generate.yaml"),
+			metav1.CreateOptions{},
+		)
+		require.NoError(t, err)
+
+		clientNone := helper.GetResourceClient(apis.ResourceClientArgs{
+			User: helper.Org1.None,
+			GVR:  gvr,
+		})
+
+		// Now check if None user can perform a Get to start a playlist
+		_, err = clientNone.Resource.Get(context.Background(), created.GetName(), metav1.GetOptions{})
+		require.NoError(t, err)
+
+		// None role can get but can not create edit or delete a playlist
+		_, err = clientNone.Resource.Create(context.Background(),
+			helper.LoadYAMLOrJSONFile("testdata/playlist-generate.yaml"),
+			metav1.CreateOptions{},
+		)
+		require.Error(t, err)
+
+		_, err = clientNone.Resource.Update(context.Background(), created, metav1.UpdateOptions{})
+		require.Error(t, err)
+
+		err = clientNone.Resource.Delete(context.Background(), created.GetName(), metav1.DeleteOptions{})
+		require.Error(t, err)
+
+		// delete created resource
+		err = clientAdmin.Resource.Delete(context.Background(), created.GetName(), metav1.DeleteOptions{})
+		require.NoError(t, err)
+	})
+
 	t.Run("Check k8s client-go List from different org users", func(t *testing.T) {
 		// Check Org1 Viewer
 		client := helper.GetResourceClient(apis.ResourceClientArgs{