rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change membershipResolver.Profile to authz from membership

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-19 11:13:50 +04:00
parent 0bf921745a
commit 1daf1a64f8
3 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG.md
View File

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
## Unreleased ## Unreleased
### Changed
- Membership Profile authz done from membership in membershipResolver (it's a 1:1 association)
## [0.116.1] - 2026-01-18 ## [0.116.1] - 2026-01-18
### Fixed ### Fixed

6
pkg/iam/account_service.go
View File

@@ -843,7 +843,7 @@ func (s AccountService) GetProfileForMembership(ctx context.Context, membershipI
membership := &coredata.Membership{} membership := &coredata.Membership{}
err := membership.LoadByID(ctx, conn, scope, membershipID) err := membership.LoadByID(ctx, conn, scope, membershipID)
if err != nil { if err != nil {
if err == coredata.ErrResourceNotFound { if errors.Is(err, coredata.ErrResourceNotFound) {
return NewMembershipNotFoundError(membershipID) return NewMembershipNotFoundError(membershipID)
} }
@@ -852,11 +852,11 @@ func (s AccountService) GetProfileForMembership(ctx context.Context, membershipI
err = profile.LoadByMembershipID(ctx, conn, scope, membershipID) err = profile.LoadByMembershipID(ctx, conn, scope, membershipID)
if err != nil { if err != nil {
if err == coredata.ErrResourceNotFound { if errors.Is(err, coredata.ErrResourceNotFound) {
return NewProfileNotFoundError(membershipID) return NewProfileNotFoundError(membershipID)
} }
return fmt.Errorf("cannot load identity profile: %w", err) return fmt.Errorf("cannot load membership profile: %w", err)
} }
return nil return nil

10
pkg/server/api/connect/v1/v1_resolver.go
View File

@@ -246,23 +246,21 @@ func (r *membershipResolver) Identity(ctx context.Context, obj *types.Membership
// Profile is the resolver for the profile field. // Profile is the resolver for the profile field.
func (r *membershipResolver) Profile(ctx context.Context, obj *types.Membership) (*types.MembershipProfile, error) { func (r *membershipResolver) Profile(ctx context.Context, obj *types.Membership) (*types.MembershipProfile, error) {
// TODO: PorfileID must leave on membership to allow perform the ACL lookup first and load after. if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
profile, err := r.iam.AccountService.GetProfileForMembership(ctx, obj.ID) profile, err := r.iam.AccountService.GetProfileForMembership(ctx, obj.ID)
if err != nil { if err != nil {
var errProfileNotFound *iam.ErrProfileNotFound var errProfileNotFound *iam.ErrProfileNotFound
if errors.As(err, &errProfileNotFound) { if errors.As(err, &errProfileNotFound) {
return nil, nil return nil, gqlutils.NotFound(ctx, err)
} }
r.logger.ErrorCtx(ctx, "cannot get profile for membership", log.Error(err)) r.logger.ErrorCtx(ctx, "cannot get profile for membership", log.Error(err))
return nil, gqlutils.Internal(ctx) return nil, gqlutils.Internal(ctx)
} }
if err := r.authorize(ctx, profile.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}
return types.NewMembershipProfile(profile), nil return types.NewMembershipProfile(profile), nil
} }