From e347d500d0aebf82194395a9ce5f2da5a9c00503 Mon Sep 17 00:00:00 2001
From: Jocelyn Collado-Kuri <jcolladokuri@icloud.com>
Date: Wed, 7 Jan 2026 13:34:09 -0800
Subject: [PATCH] grab team headers from JSON data in datasource instance
 settings

---
 pkg/tsdb/tempo/search_stream.go  |  1 +
 pkg/tsdb/tempo/stream_handler.go | 32 +++++++++++++++++++++++---------
 2 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/pkg/tsdb/tempo/search_stream.go b/pkg/tsdb/tempo/search_stream.go
index 6740d2da40a..ac5700f56ed 100644
--- a/pkg/tsdb/tempo/search_stream.go
+++ b/pkg/tsdb/tempo/search_stream.go
@@ -67,6 +67,7 @@ func (s *Service) runSearchStream(ctx context.Context, req *backend.RunStreamReq
 	// Ideally this would be pushed higher, so it's set once for all rpc calls, but we have only one now.
 	ctx = metadata.AppendToOutgoingContext(ctx, "User-Agent", backend.UserAgentFromContext(ctx).String())
 	// append the rest of the headers
+	backend.Logger.Warn("Headers:", "headers", req.Headers)
 	for key, value := range req.Headers {
 		ctx = metadata.AppendToOutgoingContext(ctx, key, value)
 	}
diff --git a/pkg/tsdb/tempo/stream_handler.go b/pkg/tsdb/tempo/stream_handler.go
index 7f9690ba204..f1c4db3ec02 100644
--- a/pkg/tsdb/tempo/stream_handler.go
+++ b/pkg/tsdb/tempo/stream_handler.go
@@ -6,6 +6,8 @@ import (
 	"strings"
 
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana/pkg/components/simplejson"
+	"github.com/grafana/grafana/pkg/services/datasources"
 )
 
 func (s *Service) SubscribeStream(_ context.Context, req *backend.SubscribeStreamRequest) (*backend.SubscribeStreamResponse, error) {
@@ -39,19 +41,31 @@ func (s *Service) PublishStream(_ context.Context, _ *backend.PublishStreamReque
 
 func (s *Service) RunStream(ctx context.Context, request *backend.RunStreamRequest, sender *backend.StreamSender) error {
 	s.logger.Debug("New stream call", "path", request.Path)
-	tempoDatasource, err := s.getDSInfo(ctx, request.PluginContext)
+	tempoDatasource, dsInfoErr := s.getDSInfo(ctx, request.PluginContext)
+
+	// get team http headers.
 	plugin := backend.PluginConfigFromContext(ctx)
-	opts, err := plugin.DataSourceInstanceSettings.HTTPClientOptions(ctx)
 	headers := map[string]string{}
-	for name, values := range opts.Header {
-		for _, value := range values {
-			headers[name] = value
+	b := plugin.DataSourceInstanceSettings.JSONData
+	js, err := simplejson.NewJson(b)
+	if err != nil {
+		return err
+	}
+	teamHttpHeaders, err := datasources.GetTeamHTTPHeaders(js)
+	if err != nil {
+		return err
+	}
+
+	for _, ruleValue := range teamHttpHeaders.Headers {
+		for _, accessRule := range ruleValue {
+			headers[accessRule.Header] = accessRule.LBACRule
 		}
 	}
+	backend.Logger.Warn("Team HTTP Headers: %v", headers)
 	request.Headers = headers
 	if strings.HasPrefix(request.Path, SearchPathPrefix) {
-		if err != nil {
-			return backend.DownstreamErrorf("failed to get datasource information: %w", err)
+		if dsInfoErr != nil {
+			return backend.DownstreamErrorf("failed to get datasource information: %w", dsInfoErr)
 		}
 		if err = s.runSearchStream(ctx, request, sender, tempoDatasource); err != nil {
 			return sendError(err, sender)
@@ -60,8 +74,8 @@ func (s *Service) RunStream(ctx context.Context, request *backend.RunStreamReque
 		}
 	}
 	if strings.HasPrefix(request.Path, MetricsPathPrefix) {
-		if err != nil {
-			return backend.DownstreamErrorf("failed to get datasource information: %w", err)
+		if dsInfoErr != nil {
+			return backend.DownstreamErrorf("failed to get datasource information: %w", dsInfoErr)
 		}
 		if err = s.runMetricsStream(ctx, request, sender, tempoDatasource); err != nil {
 			return sendError(err, sender)