App Plugins: Allow to define experimental pages (#114232)

pkg/middleware/auth.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"context"
 	"errors"
 	"net/http"
 	"net/url"
@@ -21,6 +22,13 @@ import (
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/web"
+	"github.com/open-feature/go-sdk/openfeature"
+)
+
+var openfeatureClient = openfeature.NewDefaultClient()
+
+const (
+	pluginPageFeatureFlagPrefix = "plugin-page-visible."
 )
 
 type AuthOptions struct {
@@ -146,6 +154,12 @@ func RoleAppPluginAuth(accessControl ac.AccessControl, ps pluginstore.Store, log
 			return
 		}
 
+		if !PageIsFeatureToggleEnabled(c.Req.Context(), c.Req.URL.Path) {
+			logger.Debug("Forbidden experimental plugin page", "plugin", pluginID, "path", c.Req.URL.Path)
+			accessForbidden(c)
+			return
+		}
+
 		permitted := true
 		path := normalizeIncludePath(c.Req.URL.Path)
 		hasAccess := ac.HasAccess(accessControl, c)
@@ -294,3 +308,18 @@ func shouldForceLogin(c *contextmodel.ReqContext) bool {
 
 	return forceLogin
 }
+
+// PageIsFeatureToggleEnabled checks if a page is enabled via OpenFeature feature flags.
+// It returns false if the feature flag is set and set to false.
+// The feature flag key format is: "plugin-page-visible.<path>"
+func PageIsFeatureToggleEnabled(ctx context.Context, path string) bool {
+	flagKey := pluginPageFeatureFlagPrefix + filepath.Clean(path)
+	enabled := openfeatureClient.Boolean(
+		ctx,
+		flagKey,
+		true,
+		openfeature.TransactionContext(ctx),
+	)
+
+	return enabled
+}