rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Confine trust center reads and signatures to the page's tenant

Browse Source 
The public trust API derived its authorization scope from client-supplied
global IDs, so a visitor on one trust center could resolve nodes, export
audit-report PDFs, and read or mutate electronic signatures belonging to
another organization (cross-tenant access).

Every trust API resolver now derives its scope from the active compliance
page's organization via compliancepage.ScopeFromContext, so reads are always
confined to the page's tenant. Cross-tenant or unknown IDs surface as
not-found instead of leaking data or returning a 500. Active/presence is
enforced upstream by the id and presence middlewares.

esign's signature operations (GetSignatureByID, AcceptSignature, RecordEvent)
now take a caller-provided scope instead of deriving one from the requested
ID, so signature reads and mutations are tenant-scoped at the source. This
removes the need for a resolver-level authorization helper; RecordEvent also
verifies signature ownership within scope before recording, since the event
foreign key is not tenant-composite.

Adds e2e non-regression tests covering owning vs. foreign trust center report
export and the generic node(id:) resolver.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>
This commit is contained in:
Sacha Al Himdani
2026-07-06 14:33:19 +02:00
parent bbb3a24286
commit 180a6a0420
9 changed files with 452 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
pkg/esign/service.go
View File

@@ -236,6 +236,7 @@ func (s *Service) CreateAndAcceptSignature(
if err := s.recordEvent(
ctx,
conn,
scope,
&RecordEventRequest{
SignatureID: sig.ID,
EventType: coredata.ElectronicSignatureEventTypeSignatureAccepted,
@@ -309,9 +310,8 @@ func (s *Service) createStampedDocument(
return stampedFile.ID, nil
}
func (s *Service) AcceptSignature(ctx context.Context, req *AcceptSignatureRequest) (*coredata.ElectronicSignature, error) {
func (s *Service) AcceptSignature(ctx context.Context, scope coredata.Scoper, req *AcceptSignatureRequest) (*coredata.ElectronicSignature, error) {
var (
scope = coredata.NewScopeFromObjectID(req.SignatureID)
now = time.Now()
signature = coredata.ElectronicSignature{}
)
@@ -320,6 +320,10 @@ func (s *Service) AcceptSignature(ctx context.Context, req *AcceptSignatureReque
ctx,
func(ctx context.Context, tx pg.Tx) error {
if err := signature.LoadByID(ctx, tx, scope, req.SignatureID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrElectronicSignatureNotFound
}
return fmt.Errorf("cannot load electronic signature: %w", err)
}
@@ -347,6 +351,7 @@ func (s *Service) AcceptSignature(ctx context.Context, req *AcceptSignatureReque
if err := s.recordEvent(
ctx,
tx,
scope,
&RecordEventRequest{
SignatureID: signature.ID,
EventType: coredata.ElectronicSignatureEventTypeSignatureAccepted,
@@ -369,20 +374,26 @@ func (s *Service) AcceptSignature(ctx context.Context, req *AcceptSignatureReque
return &signature, nil
}
func (s *Service) RecordEvent(ctx context.Context, req *RecordEventRequest) error {
func (s *Service) RecordEvent(ctx context.Context, scope coredata.Scoper, req *RecordEventRequest) error {
return s.pg.WithTx(
ctx,
func(ctx context.Context, tx pg.Tx) error {
return s.recordEvent(ctx, tx, req)
signature := coredata.ElectronicSignature{}
if err := signature.LoadByID(ctx, tx, scope, req.SignatureID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return ErrElectronicSignatureNotFound
}
return fmt.Errorf("cannot load electronic signature: %w", err)
}
return s.recordEvent(ctx, tx, scope, req)
},
)
}
func (s *Service) recordEvent(ctx context.Context, tx pg.Tx, req *RecordEventRequest) error {
var (
now = time.Now()
scope = coredata.NewScopeFromObjectID(req.SignatureID)
)
func (s *Service) recordEvent(ctx context.Context, tx pg.Tx, scope coredata.Scoper, req *RecordEventRequest) error {
now := time.Now()
event := coredata.ElectronicSignatureEvent{
ID: gid.New(scope.GetTenantID(), coredata.ElectronicSignatureEventEntityType),
@@ -403,11 +414,8 @@ func (s *Service) recordEvent(ctx context.Context, tx pg.Tx, req *RecordEventReq
return nil
}
func (s *Service) GetSignatureByID(ctx context.Context, id gid.GID) (*coredata.ElectronicSignature, error) {
var (
scope = coredata.NewScopeFromObjectID(id)
signature = coredata.ElectronicSignature{}
)
func (s *Service) GetSignatureByID(ctx context.Context, scope coredata.Scoper, id gid.GID) (*coredata.ElectronicSignature, error) {
signature := coredata.ElectronicSignature{}
err := s.pg.WithConn(
ctx,