Internal evaluation data API does not skip auth when evaluation is marked as excluded

[GeorgeMac]

Currently, when you mark the evaluation section of the API as excluded from authentication, it does not apply to the internal evaluation data API. This API is used to feed client-side evaluation with state. Meaning, you cannot publically expose evaluation state to client-side SDKs in this way.

flipt/internal/cmd/grpc.go

Lines 207 to 229 in 2490bb5

	var (
	fliptsrv = fliptserver.New(logger, store)
	metasrv = metadata.New(cfg, info)
	evalsrv = evaluation.New(logger, store)
	evalDataSrv = evaluationdata.New(logger, store)
	healthsrv = health.NewServer()
	)
	var (
	// authOpts is a slice of options that will be passed to the authentication service.
	// it's initialized with the default option of skipping authentication for the health service which should never require authentication.
	authOpts = []containers.Option[authmiddlewaregrpc.InterceptorOptions]{
	authmiddlewaregrpc.WithServerSkipsAuthentication(healthsrv),
	}
	skipAuthIfExcluded = func(server any, excluded bool) {
	if excluded {
	authOpts = append(authOpts, authmiddlewaregrpc.WithServerSkipsAuthentication(server))
	}
	}
	)
	skipAuthIfExcluded(fliptsrv, cfg.Authentication.Exclude.Management)
	skipAuthIfExcluded(evalsrv, cfg.Authentication.Exclude.Evaluation)

We should update this skip check to also apply auth skipping to the internal data API.

[markphelps]

We should probably do a bug fix release off of the last release tag