fix: Add panic for nil authorizer in installer (#115186)

pkg/services/apiserver/auth/authorizer/authorizer.go

@@ -38,12 +38,12 @@ func NewGrafanaBuiltInSTAuthorizer(cfg *setting.Cfg) *GrafanaAuthorizer {
 
 	// Individual services may have explicit implementations
 	apis := make(map[string]authorizer.Authorizer)
+	// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
 	authorizers = append(authorizers, &authorizerForAPI{apis})
 
-	// org role is last -- and will return allow for verbs that match expectations
-	// The apiVersion flavors will run first and can return early when FGAC has appropriate rules
-	// NOTE: role authorizer is now used by some api groups as their specific authorizer
-	// but there are still some apis not directly registered in the embedded delegate that benefit from including it here
+	// org role authorizer is last -- and will return allow for verbs that match expectations
+	// it is only helpful here for remote APIs in some cloud use-cases.
+	//nolint:staticcheck // remove once build handler chains are untangled between local and remote APIs handling
 	authorizers = append(authorizers, NewRoleAuthorizer())
 	return &GrafanaAuthorizer{
 		apis: apis,

pkg/services/apiserver/auth/authorizer/role.go

@@ -19,6 +19,7 @@ var orgRoleNoneAsViewerAPIGroups = []string{
 
 type roleAuthorizer struct{}
 
+// Deprecated: NewRoleAuthorizer exists for apps that were launched with simplistic authorization requirements. Consider using NewResourceAuthorizer instead.
 func NewRoleAuthorizer() *roleAuthorizer {
 	return &roleAuthorizer{}
 }