From f7d9d22963a8eb0028133880b22eb1cb54344854 Mon Sep 17 00:00:00 2001
From: Gabriel MABILLE <gamab@users.noreply.github.com>
Date: Wed, 3 Dec 2025 19:16:37 +0100
Subject: [PATCH] `grafana-iam`: standalone rely on storage layer resource
 permissions authorization  (#114785)

* : standalone resource permissions authorization done at storage layer

* instantiate the accessclient
---
 pkg/registry/apis/iam/register.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/registry/apis/iam/register.go b/pkg/registry/apis/iam/register.go
index 741419b30b0..d88d3b29912 100644
--- a/pkg/registry/apis/iam/register.go
+++ b/pkg/registry/apis/iam/register.go
@@ -39,7 +39,6 @@ import (
 	"github.com/grafana/grafana/pkg/registry/apis/iam/teambinding"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/user"
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
-	gfauthorizer "github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer"
 	"github.com/grafana/grafana/pkg/services/apiserver/auth/authorizer/storewrapper"
 	"github.com/grafana/grafana/pkg/services/apiserver/builder"
 	"github.com/grafana/grafana/pkg/services/authz/zanzana"
@@ -123,7 +122,6 @@ func NewAPIService(
 ) *IdentityAccessManagementAPIBuilder {
 	store := legacy.NewLegacySQLStores(dbProvider)
 	resourcePermissionsStorage := resourcepermission.ProvideStorageBackend(dbProvider)
-	resourceAuthorizer := gfauthorizer.NewResourceAuthorizer(accessClient)
 	registerMetrics(reg)
 	return &IdentityAccessManagementAPIBuilder{
 		store:                      store,
@@ -131,6 +129,7 @@ func NewAPIService(
 		resourcePermissionsStorage: resourcePermissionsStorage,
 		logger:                     log.New("iam.apis"),
 		features:                   features,
+		accessClient:               accessClient,
 		zClient:                    zClient,
 		zTickets:                   make(chan bool, MaxConcurrentZanzanaWrites),
 		reg:                        reg,
@@ -138,7 +137,8 @@ func NewAPIService(
 			func(ctx context.Context, a authorizer.Attributes) (authorizer.Decision, string, error) {
 				// For now only authorize resourcepermissions resource
 				if a.GetResource() == "resourcepermissions" {
-					return resourceAuthorizer.Authorize(ctx, a)
+					// Authorization is handled at the storage layer
+					return authorizer.DecisionAllow, "", nil
 				}
 
 				user, err := identity.GetRequester(ctx)