From d7a3d61726d5f376d74251a6c74757dd60d13a0c Mon Sep 17 00:00:00 2001
From: Gabriel Mabille <gabriel.mabille@grafana.com>
Date: Thu, 8 Jan 2026 17:07:32 +0100
Subject: [PATCH] Add debug logs, because I'm blind

---
 .../iam/authorizer/resource_permissions.go    | 39 +++++++++++++------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/pkg/registry/apis/iam/authorizer/resource_permissions.go b/pkg/registry/apis/iam/authorizer/resource_permissions.go
index 0fbf413adac..f52ea223b25 100644
--- a/pkg/registry/apis/iam/authorizer/resource_permissions.go
+++ b/pkg/registry/apis/iam/authorizer/resource_permissions.go
@@ -173,39 +173,47 @@ func (r *ResourcePermissionsAuthorizer) FilterList(ctx context.Context, list run
 
 	switch l := list.(type) {
 	case *iamv0.ResourcePermissionList:
+
+		r.logger.Debug("filtering list of length", "length", len(l.Items))
 		var (
 			filteredItems []iamv0.ResourcePermission
 			err           error
 			canViewFuncs  = map[schema.GroupResource]types.ItemChecker{}
 		)
 		for _, item := range l.Items {
-			gr := schema.GroupResource{
-				Group:    item.Spec.Resource.ApiGroup,
-				Resource: item.Spec.Resource.Resource,
-			}
+			target := item.Spec.Resource
+			targetGR := schema.GroupResource{Group: target.ApiGroup, Resource: target.Resource}
+
+			r.logger.Debug("target resource",
+				"group", target.ApiGroup,
+				"resource", target.Resource,
+				"name", target.Name,
+			)
 
 			// Reuse the same canView for items with the same resource
-			canView, found := canViewFuncs[gr]
+			canView, found := canViewFuncs[targetGR]
 
 			if !found {
 				listReq := types.ListRequest{
 					Namespace: item.Namespace,
-					Group:     item.Spec.Resource.ApiGroup,
-					Resource:  item.Spec.Resource.Resource,
+					Group:     target.ApiGroup,
+					Resource:  target.Resource,
 					Verb:      utils.VerbGetPermissions,
 				}
-
+				r.logger.Debug("compiling list request",
+					"namespace", item.Namespace,
+					"group", target.ApiGroup,
+					"resource", target.Resource,
+					"verb", utils.VerbGetPermissions,
+				)
 				canView, _, err = r.accessClient.Compile(ctx, authInfo, listReq)
 				if err != nil {
 					return nil, err
 				}
 
-				canViewFuncs[gr] = canView
+				canViewFuncs[targetGR] = canView
 			}
 
-			target := item.Spec.Resource
-			targetGR := schema.GroupResource{Group: target.ApiGroup, Resource: target.Resource}
-
 			parent := ""
 			// Fetch the parent of the resource
 			// It's not efficient to do for every item in the list, but it's a good starting point.
@@ -223,6 +231,13 @@ func (r *ResourcePermissionsAuthorizer) FilterList(ctx context.Context, list run
 					)
 					continue
 				}
+				r.logger.Debug("fetched parent",
+					"parent", p,
+					"namespace", item.Namespace,
+					"group", target.ApiGroup,
+					"resource", target.Resource,
+					"name", target.Name,
+				)
 				parent = p
 			}