Plugins App: Switch to resource authorizer (#115019)

pkg/registry/apps/plugins/register.go

@@ -6,12 +6,12 @@ import (
 
 	authlib "github.com/grafana/authlib/types"
 	appsdkapiserver "github.com/grafana/grafana-app-sdk/k8s/apiserver"
-	"k8s.io/apiserver/pkg/authorization/authorizer"
 
 	pluginsapp "github.com/grafana/grafana/apps/plugins/pkg/app"
 	"github.com/grafana/grafana/apps/plugins/pkg/app/meta"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/apiserver/appinstaller"
+	grafanaauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 )
 
 var (
@@ -37,18 +37,13 @@ func ProvideAppInstaller(accessControlService accesscontrol.Service, accessClien
 	cloudProvider := meta.NewCatalogProvider(grafanaComAPIURL)
 	metaProviderManager := meta.NewProviderManager(coreProvider, cloudProvider)
 
-	i, err := pluginsapp.ProvideAppInstaller(metaProviderManager)
+	authorizer := grafanaauthorizer.NewResourceAuthorizer(accessClient)
+	i, err := pluginsapp.ProvideAppInstaller(authorizer, metaProviderManager)
 	if err != nil {
 		return nil, err
 	}
 
-	i.WithAccessChecker(accessClient)
-
 	return &AppInstaller{
 		PluginAppInstaller: i,
 	}, nil
 }
-
-func (a *AppInstaller) GetAuthorizer() authorizer.Authorizer {
-	return pluginsapp.GetAuthorizer()
-}

pkg/registry/backgroundsvcs/adapter/service_test.go

@@ -55,15 +55,9 @@ func TestServiceAdapter_ErrorHandling(t *testing.T) {
 
 		adapter := asNamedService(mockSvc)
 
-		t.Cleanup(func() {
-			adapter.StopAsync()
-			err := adapter.AwaitTerminated(context.Background())
-			require.ErrorIs(t, err, expectedErr)
-		})
-
 		err := adapter.StartAsync(context.Background())
 		require.NoError(t, err)
-		err = adapter.AwaitRunning(context.Background())
+		err = adapter.AwaitTerminated(context.Background())
 		require.ErrorIs(t, err, expectedErr)
 		require.True(t, mockSvc.runCalled)
 	})
@@ -95,14 +89,9 @@ func TestServiceAdapter_ErrorHandling(t *testing.T) {
 
 		adapter := asNamedService(mockSvc)
 
-		t.Cleanup(func() {
-			adapter.StopAsync()
-			err := adapter.AwaitTerminated(context.Background())
-			require.ErrorIs(t, err, expectedErr)
-		})
 		err := adapter.StartAsync(context.Background())
 		require.NoError(t, err)
-		err = adapter.AwaitRunning(context.Background())
+		err = adapter.AwaitTerminated(context.Background())
 		require.ErrorIs(t, err, expectedErr)
 		require.True(t, mockSvc.runCalled)
 	})

pkg/services/apiserver/auth/authorizer/resource.go

@@ -9,13 +9,13 @@ import (
 	claims "github.com/grafana/authlib/types"
 )
 
-func NewResourceAuthorizer(c claims.AccessClient) authorizer.Authorizer {
+func NewResourceAuthorizer(c claims.AccessChecker) authorizer.Authorizer {
 	return ResourceAuthorizer{c}
 }
 
 // ResourceAuthorizer is used to translate authorizer.Authorizer calls to claims.AccessClient calls
 type ResourceAuthorizer struct {
-	c claims.AccessClient
+	c claims.AccessChecker
 }
 
 func (r ResourceAuthorizer) Authorize(ctx context.Context, attr authorizer.Attributes) (authorizer.Decision, string, error) {