From da14be859e6287a17099649e010f1b09307f65b4 Mon Sep 17 00:00:00 2001
From: Charandas <542168+charandas@users.noreply.github.com>
Date: Wed, 10 Dec 2025 13:01:34 -0800
Subject: [PATCH] Authorization: panic when specific authorizer returns nil
 (#114982)

---
 pkg/registry/apis/service/register.go                | 3 ++-
 pkg/services/apiserver/appinstaller/installer.go     | 3 +++
 pkg/services/apiserver/auth/authorizer/authorizer.go | 4 +++-
 pkg/services/apiserver/auth/authorizer/role.go       | 2 +-
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkg/registry/apis/service/register.go b/pkg/registry/apis/service/register.go
index 7f51ad844e0..1002bff5bf6 100644
--- a/pkg/registry/apis/service/register.go
+++ b/pkg/registry/apis/service/register.go
@@ -12,6 +12,7 @@ import (
 
 	service "github.com/grafana/grafana/pkg/apis/service/v0alpha1"
 	grafanaregistry "github.com/grafana/grafana/pkg/apiserver/registry/generic"
+	roleauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 	"github.com/grafana/grafana/pkg/services/apiserver/builder"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 )
@@ -37,7 +38,7 @@ func RegisterAPIService(features featuremgmt.FeatureToggles, apiregistration bui
 }
 
 func (b *ServiceAPIBuilder) GetAuthorizer() authorizer.Authorizer {
-	return nil // default authorizer is fine
+	return roleauthorizer.NewRoleAuthorizer()
 }
 
 func (b *ServiceAPIBuilder) GetGroupVersion() schema.GroupVersion {
diff --git a/pkg/services/apiserver/appinstaller/installer.go b/pkg/services/apiserver/appinstaller/installer.go
index b6e9145ff15..c7b926bd5f3 100644
--- a/pkg/services/apiserver/appinstaller/installer.go
+++ b/pkg/services/apiserver/appinstaller/installer.go
@@ -108,6 +108,9 @@ func RegisterAuthorizers(
 		if authorizerProvider, ok := installer.(AuthorizerProvider); ok {
 			authorizer := authorizerProvider.GetAuthorizer()
 			for _, gv := range installer.GroupVersions() {
+				if authorizer == nil {
+					panic("authorizer cannot be nil for api group: " + gv.String())
+				}
 				registrar.Register(gv, authorizer)
 				logger.Debug("Registered authorizer", "group", gv.Group, "version", gv.Version, "app")
 			}
diff --git a/pkg/services/apiserver/auth/authorizer/authorizer.go b/pkg/services/apiserver/auth/authorizer/authorizer.go
index 54ea8c081d7..f58c1d14bf8 100644
--- a/pkg/services/apiserver/auth/authorizer/authorizer.go
+++ b/pkg/services/apiserver/auth/authorizer/authorizer.go
@@ -42,7 +42,9 @@ func NewGrafanaBuiltInSTAuthorizer(cfg *setting.Cfg) *GrafanaAuthorizer {
 
 	// org role is last -- and will return allow for verbs that match expectations
 	// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
-	authorizers = append(authorizers, newRoleAuthorizer())
+	// NOTE: role authorizer is now used by some api groups as their specific authorizer
+	// but there are still some apis not directly registered in the embedded delegate that benefit from including it here
+	authorizers = append(authorizers, NewRoleAuthorizer())
 	return &GrafanaAuthorizer{
 		apis: apis,
 		auth: union.New(authorizers...),
diff --git a/pkg/services/apiserver/auth/authorizer/role.go b/pkg/services/apiserver/auth/authorizer/role.go
index 39b3b440665..23164dbf556 100644
--- a/pkg/services/apiserver/auth/authorizer/role.go
+++ b/pkg/services/apiserver/auth/authorizer/role.go
@@ -19,7 +19,7 @@ var orgRoleNoneAsViewerAPIGroups = []string{
 
 type roleAuthorizer struct{}
 
-func newRoleAuthorizer() *roleAuthorizer {
+func NewRoleAuthorizer() *roleAuthorizer {
 	return &roleAuthorizer{}
 }