Add comments.

Signed-off-by: xuezhaojun <zxue@redhat.com>

Author: xuezhaojun

pkg/server/grpc/authn/interface.go

@@ -11,11 +11,20 @@ const (
 	ContextGroupsKey contextKey = "groups"
 )
 
-// Authenticator is the interface to authenticate for grpc server
+// Authenticator defines the interface for authenticating gRPC requests.
+// Implementations should validate user credentials and return an enriched context
+// containing user identity information for downstream processing.
 type Authenticator interface {
+	// Authenticate validates the incoming request context and returns an enriched context
+	// containing user identity information (user and groups) or an error if authentication fails.
+	// The returned context should include user identity using newContextWithIdentity function.
 	Authenticate(ctx context.Context) (context.Context, error)
 }
 
+// newContextWithIdentity creates a new context with user identity information.
+// It adds the user name and groups to the context using predefined context keys.
+// This function is typically used by Authenticator implementations to enrich
+// the context with authenticated user information.
 func newContextWithIdentity(ctx context.Context, user string, groups []string) context.Context {
 	ctx = context.WithValue(ctx, ContextUserKey, user)
 	return context.WithValue(ctx, ContextGroupsKey, groups)

pkg/server/grpc/authz/interface.go

@@ -6,10 +6,23 @@ import (
 	"google.golang.org/grpc"
 )
 
+// UnaryAuthorizer defines the interface for authorizing unary gRPC requests.
+// Implementations should validate whether the authenticated user has permission
+// to perform the requested operation based on the context and request.
 type UnaryAuthorizer interface {
+	// AuthorizeRequest validates whether the user in the context is authorized
+	// to perform the operation represented by the request. Returns an error
+	// if authorization fails, or nil if the request is authorized.
 	AuthorizeRequest(ctx context.Context, req any) error
 }
 
+// StreamAuthorizer defines the interface for authorizing streaming gRPC requests.
+// Implementations should validate whether the authenticated user has permission
+// to establish and maintain the streaming connection.
 type StreamAuthorizer interface {
+	// AuthorizeStream validates whether the user in the context is authorized
+	// to establish the streaming connection. Returns a potentially wrapped ServerStream
+	// and an error if authorization fails, or the original/wrapped stream and nil if authorized.
+	// The returned ServerStream can be used to intercept and authorize individual messages.
 	AuthorizeStream(ctx context.Context, ss grpc.ServerStream, info *grpc.StreamServerInfo) (grpc.ServerStream, error)
 }