From 1daf1a64f8da63c16cfe45fb371f72299331a91b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Mon, 19 Jan 2026 11:13:50 +0400 Subject: [PATCH] Change membershipResolver.Profile to authz from membership MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Émile Ré --- CHANGELOG.md | 4 ++++ pkg/iam/account_service.go | 6 +++--- pkg/server/api/connect/v1/v1_resolver.go | 10 ++++------ 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 34aa5146e..d5a8bcc65 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file. ## Unreleased +### Changed + +- Membership Profile authz done from membership in membershipResolver (it's a 1:1 association) + ## [0.116.1] - 2026-01-18 ### Fixed diff --git a/pkg/iam/account_service.go b/pkg/iam/account_service.go index 6a008fd7e..b86d1292d 100644 --- a/pkg/iam/account_service.go +++ b/pkg/iam/account_service.go @@ -843,7 +843,7 @@ func (s AccountService) GetProfileForMembership(ctx context.Context, membershipI membership := &coredata.Membership{} err := membership.LoadByID(ctx, conn, scope, membershipID) if err != nil { - if err == coredata.ErrResourceNotFound { + if errors.Is(err, coredata.ErrResourceNotFound) { return NewMembershipNotFoundError(membershipID) } @@ -852,11 +852,11 @@ func (s AccountService) GetProfileForMembership(ctx context.Context, membershipI err = profile.LoadByMembershipID(ctx, conn, scope, membershipID) if err != nil { - if err == coredata.ErrResourceNotFound { + if errors.Is(err, coredata.ErrResourceNotFound) { return NewProfileNotFoundError(membershipID) } - return fmt.Errorf("cannot load identity profile: %w", err) + return fmt.Errorf("cannot load membership profile: %w", err) } return nil diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go index c81e1b100..6ce6c5953 100644 --- a/pkg/server/api/connect/v1/v1_resolver.go +++ b/pkg/server/api/connect/v1/v1_resolver.go @@ -246,23 +246,21 @@ func (r *membershipResolver) Identity(ctx context.Context, obj *types.Membership // Profile is the resolver for the profile field. func (r *membershipResolver) Profile(ctx context.Context, obj *types.Membership) (*types.MembershipProfile, error) { - // TODO: PorfileID must leave on membership to allow perform the ACL lookup first and load after. + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil { + return nil, err + } profile, err := r.iam.AccountService.GetProfileForMembership(ctx, obj.ID) if err != nil { var errProfileNotFound *iam.ErrProfileNotFound if errors.As(err, &errProfileNotFound) { - return nil, nil + return nil, gqlutils.NotFound(ctx, err) } r.logger.ErrorCtx(ctx, "cannot get profile for membership", log.Error(err)) return nil, gqlutils.Internal(ctx) } - if err := r.authorize(ctx, profile.ID, iam.ActionMembershipProfileGet); err != nil { - return nil, err - } - return types.NewMembershipProfile(profile), nil }