From cfc8989d24f975510c509e55d90ce845978589e4 Mon Sep 17 00:00:00 2001
From: Alexander Zobnin <alexanderzobnin@gmail.com>
Date: Fri, 31 Oct 2025 16:15:45 +0100
Subject: [PATCH] Zanzana: Inject client into standalone AuthZ client (#113293)

---
 pkg/services/authz/rbac.go    | 24 +++++++++++++++++++++++-
 pkg/services/authz/zanzana.go | 18 ++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/pkg/services/authz/rbac.go b/pkg/services/authz/rbac.go
index 349fd0d4013..23de10511a2 100644
--- a/pkg/services/authz/rbac.go
+++ b/pkg/services/authz/rbac.go
@@ -149,12 +149,34 @@ func ProvideStandaloneAuthZClient(
 		return nil, nil
 	}
 
+	//nolint:staticcheck // not yet migrated to OpenFeature
+	zanzanaEnabled := features.IsEnabledGlobally(featuremgmt.FlagZanzana)
+
+	zanzanaClient, err := ProvideStandaloneZanzanaClient(cfg, features)
+	if err != nil {
+		return nil, err
+	}
+
+	//nolint:staticcheck // not yet migrated to OpenFeature
+	if zanzanaEnabled && features.IsEnabledGlobally(featuremgmt.FlagZanzanaNoLegacyClient) {
+		return zanzanaClient, nil
+	}
+
 	authCfg, err := readAuthzClientSettings(cfg)
 	if err != nil {
 		return nil, err
 	}
 
-	return newRemoteRBACClient(authCfg, tracer, reg)
+	remoteRBACClient, err := newRemoteRBACClient(authCfg, tracer, reg)
+	if err != nil {
+		return nil, err
+	}
+
+	if zanzanaEnabled {
+		return zClient.WithShadowClient(remoteRBACClient, zanzanaClient, reg)
+	}
+
+	return remoteRBACClient, nil
 }
 
 func newRemoteRBACClient(clientCfg *authzClientSettings, tracer trace.Tracer, reg prometheus.Registerer) (authlib.AccessClient, error) {
diff --git a/pkg/services/authz/zanzana.go b/pkg/services/authz/zanzana.go
index 37fa8c7b59d..21199b502cb 100644
--- a/pkg/services/authz/zanzana.go
+++ b/pkg/services/authz/zanzana.go
@@ -95,6 +95,24 @@ func ProvideZanzanaClient(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, fea
 	}
 }
 
+// ProvideStandaloneZanzanaClient provides a standalone Zanzana client, without registering the Zanzana service.
+// Client connects to a remote Zanzana server specified in the configuration.
+func ProvideStandaloneZanzanaClient(cfg *setting.Cfg, features featuremgmt.FeatureToggles) (zanzana.Client, error) {
+	//nolint:staticcheck // not yet migrated to OpenFeature
+	if !features.IsEnabledGlobally(featuremgmt.FlagZanzana) {
+		return zClient.NewNoopClient(), nil
+	}
+
+	zanzanaConfig := ZanzanaClientConfig{
+		URL:              cfg.ZanzanaClient.Addr,
+		Token:            cfg.ZanzanaClient.Token,
+		TokenExchangeURL: cfg.ZanzanaClient.TokenExchangeURL,
+		ServerCertFile:   cfg.ZanzanaClient.ServerCertFile,
+	}
+
+	return NewRemoteZanzanaClient(fmt.Sprintf("stacks-%s", cfg.StackID), zanzanaConfig)
+}
+
 type ZanzanaClientConfig struct {
 	URL              string
 	Token            string