use app installer authorizer instead of default

apps/plugins/pkg/app/app.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"fmt"
+	"sync"
 
 	"github.com/grafana/grafana-app-sdk/app"
 	"github.com/grafana/grafana-app-sdk/k8s"
@@ -17,6 +18,7 @@ import (
 	"k8s.io/klog/v2"
 
 	authlib "github.com/grafana/authlib/types"
+
 	pluginsappapis "github.com/grafana/grafana/apps/plugins/pkg/apis"
 	pluginsv0alpha1 "github.com/grafana/grafana/apps/plugins/pkg/apis/plugins/v0alpha1"
 	"github.com/grafana/grafana/apps/plugins/pkg/app/meta"
@@ -106,12 +108,15 @@ type PluginAppInstaller struct {
 	// restConfig is set during InitializeApp and used by the client factory
 	restConfig *restclient.Config
 	ready      chan struct{}
+	readyOnce  sync.Once
 }
 
 func (p *PluginAppInstaller) InitializeApp(restConfig restclient.Config) error {
 	if p.restConfig == nil {
 		p.restConfig = &restConfig
-		close(p.ready)
+		p.readyOnce.Do(func() {
+			close(p.ready)
+		})
 	}
 	return p.AppInstaller.InitializeApp(restConfig)
 }

apps/plugins/pkg/app/authorizer.go

@@ -1,32 +0,0 @@
-package app
-
-import (
-	"context"
-
-	"k8s.io/apiserver/pkg/authorization/authorizer"
-
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
-)
-
-func GetAuthorizer() authorizer.Authorizer {
-	return authorizer.AuthorizerFunc(func(
-		ctx context.Context, attr authorizer.Attributes,
-	) (authorized authorizer.Decision, reason string, err error) {
-		if !attr.IsResourceRequest() {
-			return authorizer.DecisionNoOpinion, "", nil
-		}
-
-		// require a user
-		u, err := identity.GetRequester(ctx)
-		if err != nil {
-			return authorizer.DecisionDeny, "valid user is required", err
-		}
-
-		// check if is admin
-		if u.HasRole(identity.RoleAdmin) {
-			return authorizer.DecisionAllow, "", nil
-		}
-
-		return authorizer.DecisionDeny, "forbidden", nil
-	})
-}

pkg/registry/apps/plugins/register.go

@@ -50,5 +50,5 @@ func ProvideAppInstaller(accessControlService accesscontrol.Service, accessClien
 }
 
 func (a *AppInstaller) GetAuthorizer() authorizer.Authorizer {
-	return pluginsapp.GetAuthorizer()
+	return a.PluginAppInstaller.GetAuthorizer()
 }