PMM-14880 anonymous role

[fabio-silva]

PMM-14880

Allow org roles to anonymous users

Tied to percona/grafana#886

Note: we fallback to "Viewer" if any other org_role is used on anon mode, due to this deprecation notice:
https://github.com/grafana/grafana/pull/101411/changes

[codecov]

Codecov Report

❌ Patch coverage is 68.23529% with 54 lines in your changes missing coverage. Please review.
✅ Project coverage is 43.45%. Comparing base (b632bbc) to head (55f3fab).

Files with missing lines	Patch %	Lines
managed/services/grafana/client.go	75.00%	15 Missing and 15 partials ⚠️
managed/services/user/current_http.go	58.53%	11 Missing and 6 partials ⚠️
managed/cmd/pmm-managed/main.go	0.00%	5 Missing ⚠️
managed/services/grafana/auth_server.go	50.00%	2 Missing ⚠️

Additional details and impacted files

@@                    Coverage Diff                     @@
##           PMM-14880-rta-pmm-demo    #5170      +/-   ##
==========================================================
+ Coverage                   42.11%   43.45%   +1.33%     
==========================================================
  Files                         410      411       +1     
  Lines                       41919    42051     +132     
==========================================================
+ Hits                        17656    18272     +616     
+ Misses                      22472    21946     -526     
- Partials                     1791     1833      +42     

Flag	Coverage Δ
managed	40.92% <68.23%> (+0.17%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[fabio-silva]

We need profiling on this one.
CC @maxkondr

[Copilot]

Pull request overview

Enables “anonymous mode” users to receive an organization role (clamped to Viewer when Grafana is configured with a higher anonymous role), and updates PMM UI/back-end wiring to use new PMM-managed “current user” endpoints rather than calling Grafana’s user endpoints directly.

Changes:

• Added /v1/users/current and /v1/users/current/orgs HTTP endpoints in pmm-managed that proxy/normalize Grafana “current user” payloads and support anonymous fallback.
• Extended Grafana client/auth logic to detect anonymous mode via /api/frontend/settings and clamp anonymous org role to Viewer.
• Updated PMM UI user loading and feature gating to support anonymous users (new isAnonymous field, updated HA/settings enablement, updated API calls).

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
ui/docker-compose.yml	Adds developer guidance for mounting/building/swapping Grafana backend locally.
ui/apps/pmm/src/utils/testStubs.ts	Updates test user stub to include isAnonymous.
ui/apps/pmm/src/types/user.types.ts	Adds isAnonymous to User and GetUserResponse types.
ui/apps/pmm/src/hooks/api/useHA.ts	Allows useHaInfo to accept query options (e.g., enabled).
ui/apps/pmm/src/contexts/user/user.utils.ts	Plumbs isAnonymous into the derived PMM User.
ui/apps/pmm/src/contexts/user/user.provider.tsx	Fetches current user/orgs regardless of login state and synthesizes minimal info/preferences for anonymous users.
ui/apps/pmm/src/contexts/settings/settings.provider.tsx	Prevents settings queries from running for anonymous users.
ui/apps/pmm/src/contexts/navigation/navigation.provider.tsx	Disables HA info fetching for anonymous users; adjusts service-types fetching behavior.
ui/apps/pmm/src/api/user.ts	Switches current-user API calls from Grafana API to PMM-managed /v1/users/current* endpoints.
ui/apps/pmm/src/App.tsx	Disables React Query retries globally.
ui/Makefile	Adds helper targets to build/swap Grafana backend binary inside the dev container.
managed/services/user/current_http.go	New HTTP handler serving /v1/users/current and /v1/users/current/orgs.
managed/services/grafana/client_test.go	Adds unit tests for anonymous fallback behavior in Grafana client methods.
managed/services/grafana/client.go	Implements anonymous-role resolution/clamping and exposes “current user/orgs” methods with anonymous fallback.
managed/services/grafana/auth_server.go	Allows unauthenticated access to the new endpoints and skips LBAC filters for anonymous users.
managed/cmd/pmm-managed/main.go	Wires the new current-user HTTP handler into the HTTP/1 server mux.