Team LBAC: Add teamHeaders for datasource proxy requests (#76339)

* Add teamHeaders for datasource proxy requests

* adds validation for the teamHeaders

* added tests for applying teamHeaders

* remove previous implementation

* validation for header values being set to authproxy

* removed unnecessary checks

* newline

* Add middleware for injecting headers on the data source backend

* renamed feature toggle

* Get user teams from context

* Fix feature toggle name

* added test for validation of the auth headers and fixed evaluation to cover headers

* renaming of teamHeaders to teamHTTPHeaders

* use of header set for non-existing header and add for existing headers

* moves types into datasources

* fixed unchecked errors

* Refactor

* Add tests for data model

* Update pkg/api/datasources.go

Co-authored-by: Victor Cinaglia <victor@grafana.com>

* Update pkg/api/datasources.go

Co-authored-by: Victor Cinaglia <victor@grafana.com>

---------

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
Co-authored-by: Victor Cinaglia <victor@grafana.com>

pkg/util/proxyutil/proxyutil.go

@@ -5,9 +5,11 @@ import (
 	"net"
 	"net/http"
 	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/grafana/grafana/pkg/services/auth/identity"
+	"github.com/grafana/grafana/pkg/services/datasources"
 )
 
 const (
@@ -130,3 +132,58 @@ func ApplyForwardIDHeader(req *http.Request, user identity.Requester) {
 		req.Header.Set(IDHeaderName, token)
 	}
 }
+
+func ApplyTeamHTTPHeaders(req *http.Request, ds *datasources.DataSource, teams []int64) error {
+	headers, err := GetTeamHTTPHeaders(ds, teams)
+	if err != nil {
+		return err
+	}
+
+	for header, value := range headers {
+		// check if headerv is already set in req.Header
+		if req.Header.Get(header) != "" {
+			req.Header.Add(header, value)
+		} else {
+			req.Header.Set(header, value)
+		}
+	}
+
+	return nil
+}
+
+func GetTeamHTTPHeaders(ds *datasources.DataSource, teams []int64) (map[string]string, error) {
+	teamHTTPHeadersMap := make(map[string]string)
+	teamHTTPHeaders, err := ds.TeamHTTPHeaders()
+	if err != nil {
+		return nil, err
+	}
+
+	for teamID, headers := range teamHTTPHeaders {
+		id, err := strconv.ParseInt(teamID, 10, 64)
+		if err != nil {
+			// FIXME: logging here
+			continue
+		}
+
+		if !contains(teams, id) {
+			continue
+		}
+
+		for _, header := range headers {
+			// TODO: handle multiple header values
+			// add tests for these cases
+			teamHTTPHeadersMap[header.Header] = header.Value
+		}
+	}
+
+	return teamHTTPHeadersMap, nil
+}
+
+func contains(slice []int64, value int64) bool {
+	for _, v := range slice {
+		if v == value {
+			return true
+		}
+	}
+	return false
+}