fix: support scoped namespace tokens for evaluation data api

build/testing/integration/snapshot/snapshot_test.go

@@ -15,51 +15,69 @@ import (
 func TestSnapshot(t *testing.T) {
 	integration.Harness(t, func(t *testing.T, opts integration.TestOpts) {
 		var (
-			httpClient = opts.HTTPClient(t, integration.WithRole("viewer")) // TODO: test other roles/namespace combinations
-			protocol   = opts.Protocol()
+			protocol = opts.Protocol()
 		)
 
 		if protocol == integration.ProtocolGRPC {
 			t.Skip("REST tests are not applicable for gRPC")
 		}
 
 		t.Run("Evaluation Data", func(t *testing.T) {
-			for _, namespace := range integration.Namespaces {
-				t.Run(fmt.Sprintf("namespace %q", namespace.Expected), func(t *testing.T) {
-					t.Logf("Get snapshot for namespace.")
+			for _, role := range []string{"admin", "editor", "viewer"} {
+				t.Run(fmt.Sprintf("role %q", role), func(t *testing.T) {
+					httpClient := opts.HTTPClient(t, integration.WithRole(role))
+					for _, namespace := range integration.Namespaces {
+						t.Run(fmt.Sprintf("namespace %q", namespace.Expected), func(t *testing.T) {
+							testSnapshotForNamespace(t, httpClient, opts.URL.String(), namespace.Expected)
+						})
+					}
+				})
+			}
 
-					resp, err := httpClient.Get(fmt.Sprintf("%s/internal/v1/evaluation/snapshot/namespace/%s", opts.URL, namespace))
+			t.Run("With Namespace Scoped Token", func(t *testing.T) {
+				for _, namespace := range integration.Namespaces {
+					t.Run(fmt.Sprintf("namespace %q", namespace.Expected), func(t *testing.T) {
+						clientOpts := []integration.ClientOpt{integration.WithNamespace(namespace.Expected), integration.WithRole("admin")}
+						httpClient := opts.HTTPClient(t, clientOpts...)
+						testSnapshotForNamespace(t, httpClient, opts.URL.String(), namespace.Expected)
+					})
+				}
+			})
+		})
+	})
+}
 
-					require.NoError(t, err)
-					require.NotNil(t, resp)
-					assert.Equal(t, http.StatusOK, resp.StatusCode)
+func testSnapshotForNamespace(t *testing.T, client *http.Client, url, namespace string) {
+	t.Logf("Get snapshot for namespace.")
 
-					// get etag from response
-					etag := resp.Header.Get("ETag")
-					assert.NotEmpty(t, etag)
+	resp, err := client.Get(fmt.Sprintf("%s/internal/v1/evaluation/snapshot/namespace/%s", url, namespace))
 
-					// read body
-					body, err := io.ReadAll(resp.Body)
-					require.NoError(t, err)
-					resp.Body.Close()
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
-					assert.NotEmpty(t, body)
+	// get etag from response
+	etag := resp.Header.Get("ETag")
+	assert.NotEmpty(t, etag)
 
-					t.Logf("Get snapshot for namespace with etag/if-none-match.")
+	// read body
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	resp.Body.Close()
 
-					req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/internal/v1/evaluation/snapshot/namespace/%s", opts.URL, namespace), nil)
-					req.Header.Set("If-None-Match", etag)
-					require.NoError(t, err)
+	assert.NotEmpty(t, body)
 
-					resp, err = httpClient.Do(req)
-					require.NoError(t, err)
-					require.NotNil(t, resp)
-					assert.Equal(t, http.StatusNotModified, resp.StatusCode)
-					if resp.Body != nil {
-						resp.Body.Close()
-					}
-				})
-			}
-		})
-	})
+	t.Logf("Get snapshot for namespace with etag/if-none-match.")
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/internal/v1/evaluation/snapshot/namespace/%s", url, namespace), nil)
+	req.Header.Set("If-None-Match", etag)
+	require.NoError(t, err)
+
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, http.StatusNotModified, resp.StatusCode)
+	if resp.Body != nil {
+		resp.Body.Close()
+	}
 }

internal/server/evaluation/data/server.go

@@ -41,6 +41,10 @@
 	evaluation.RegisterDataServiceServer(server, srv)
 }
 
+func (srv *Server) AllowsNamespaceScopedAuthentication(ctx context.Context) bool {
+	return true
+}
+
 func toEvaluationFlagType(f flipt.FlagType) evaluation.EvaluationFlagType {
 	switch f {
 	case flipt.FlagType_BOOLEAN_FLAG_TYPE:

rpc/flipt/evaluation/request.go

@@ -8,3 +8,7 @@ func (r *EvaluationNamespaceSnapshotRequest) Request() []flipt.Request {
 		flipt.NewRequest(flipt.ResourceSegment, flipt.ActionRead, flipt.WithNamespace(r.Key)),
 	}
 }
+
+func (r *EvaluationNamespaceSnapshotRequest) GetNamespaceKey() string {
+	return r.Key
+}