From 2615a1eed57ae5408bdc3b0aab0a9163c6527d1f Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Tue, 23 Dec 2025 19:29:50 +0100 Subject: [PATCH] Add permission query Signed-off-by: Bryan Frimin --- pkg/iam/authorizer.go | 2 +- pkg/server/api/connect/v1/schema.graphql | 5 + pkg/server/api/connect/v1/schema/schema.go | 148 ++++++++++++++++++ pkg/server/api/connect/v1/types/types.go | 1 + pkg/server/api/connect/v1/v1_resolver.go | 17 ++ .../{v1_resolver.go => schema.resolvers.go} | 0 6 files changed, 172 insertions(+), 1 deletion(-) rename pkg/server/api/mcp/v1/{v1_resolver.go => schema.resolvers.go} (100%) diff --git a/pkg/iam/authorizer.go b/pkg/iam/authorizer.go index 14471cecb..8174857cd 100644 --- a/pkg/iam/authorizer.go +++ b/pkg/iam/authorizer.go @@ -109,7 +109,7 @@ func (a *Authorizer) loadRolePolicies(ctx context.Context, principalID gid.GID, var roleName string err := a.pg.WithConn(ctx, func(conn pg.Conn) error { - scope := coredata.NewScope(resourceID.TenantID()) + scope := coredata.NewScopeFromObjectID(resourceID) var m coredata.Membership if err := m.LoadRoleByIdentityAndEntityID(ctx, conn, scope, principalID, resourceID); err != nil { diff --git a/pkg/server/api/connect/v1/schema.graphql b/pkg/server/api/connect/v1/schema.graphql index c47ef4803..ac86c600c 100644 --- a/pkg/server/api/connect/v1/schema.graphql +++ b/pkg/server/api/connect/v1/schema.graphql @@ -165,6 +165,11 @@ type Identity implements Node { last: Int before: CursorKey ): PersonalAPIKeyConnection @goField(forceResolver: true) @isViewer + + permission(action: String!, id: ID!): Boolean! + @goField(forceResolver: true) + @session(required: PRESENT) + @isViewer } type MembershipProfile implements Node { diff --git a/pkg/server/api/connect/v1/schema/schema.go b/pkg/server/api/connect/v1/schema/schema.go index 3f15f646e..918d5f99a 100644 --- a/pkg/server/api/connect/v1/schema/schema.go +++ b/pkg/server/api/connect/v1/schema/schema.go @@ -135,6 +135,7 @@ type ComplexityRoot struct { ID func(childComplexity int) int Memberships func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MembershipOrderBy) int PendingInvitations func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrderBy) int + Permission func(childComplexity int, action string, id gid.GID) int PersonalAPIKeys func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int Sessions func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) int UpdatedAt func(childComplexity int) int @@ -420,6 +421,7 @@ type IdentityResolver interface { PendingInvitations(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrderBy) (*types.InvitationConnection, error) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) + Permission(ctx context.Context, obj *types.Identity, action string, id gid.GID) (bool, error) } type InvitationResolver interface { Organization(ctx context.Context, obj *types.Invitation) (*types.Organization, error) @@ -692,6 +694,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin } return e.complexity.Identity.PendingInvitations(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.InvitationOrderBy)), true + case "Identity.permission": + if e.complexity.Identity.Permission == nil { + break + } + + args, err := ec.field_Identity_permission_args(ctx, rawArgs) + if err != nil { + return 0, false + } + + return e.complexity.Identity.Permission(childComplexity, args["action"].(string), args["id"].(gid.GID)), true case "Identity.personalAPIKeys": if e.complexity.Identity.PersonalAPIKeys == nil { break @@ -2130,6 +2143,11 @@ type Identity implements Node { last: Int before: CursorKey ): PersonalAPIKeyConnection @goField(forceResolver: true) @isViewer + + permission(action: String!, id: ID!): Boolean! + @goField(forceResolver: true) + @session(required: PRESENT) + @isViewer } type MembershipProfile implements Node { @@ -2819,6 +2837,22 @@ func (ec *executionContext) field_Identity_pendingInvitations_args(ctx context.C return args, nil } +func (ec *executionContext) field_Identity_permission_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) { + var err error + args := map[string]any{} + arg0, err := graphql.ProcessArgField(ctx, rawArgs, "action", ec.unmarshalNString2string) + if err != nil { + return nil, err + } + args["action"] = arg0 + arg1, err := graphql.ProcessArgField(ctx, rawArgs, "id", ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID) + if err != nil { + return nil, err + } + args["id"] = arg1 + return args, nil +} + func (ec *executionContext) field_Identity_personalAPIKeys_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) { var err error args := map[string]any{} @@ -4370,6 +4404,72 @@ func (ec *executionContext) fieldContext_Identity_personalAPIKeys(ctx context.Co return fc, nil } +func (ec *executionContext) _Identity_permission(ctx context.Context, field graphql.CollectedField, obj *types.Identity) (ret graphql.Marshaler) { + return graphql.ResolveField( + ctx, + ec.OperationContext, + field, + ec.fieldContext_Identity_permission, + func(ctx context.Context) (any, error) { + fc := graphql.GetFieldContext(ctx) + return ec.resolvers.Identity().Permission(ctx, obj, fc.Args["action"].(string), fc.Args["id"].(gid.GID)) + }, + func(ctx context.Context, next graphql.Resolver) graphql.Resolver { + directive0 := next + + directive1 := func(ctx context.Context) (any, error) { + required, err := ec.unmarshalNSessionRequirement2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconnectᚋv1ᚋtypesᚐSessionRequirement(ctx, "PRESENT") + if err != nil { + var zeroVal bool + return zeroVal, err + } + if ec.directives.Session == nil { + var zeroVal bool + return zeroVal, errors.New("directive session is not implemented") + } + return ec.directives.Session(ctx, obj, directive0, required) + } + directive2 := func(ctx context.Context) (any, error) { + if ec.directives.IsViewer == nil { + var zeroVal bool + return zeroVal, errors.New("directive isViewer is not implemented") + } + return ec.directives.IsViewer(ctx, obj, directive1) + } + + next = directive2 + return next + }, + ec.marshalNBoolean2bool, + true, + true, + ) +} + +func (ec *executionContext) fieldContext_Identity_permission(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) { + fc = &graphql.FieldContext{ + Object: "Identity", + Field: field, + IsMethod: true, + IsResolver: true, + Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) { + return nil, errors.New("field of type Boolean does not have child fields") + }, + } + defer func() { + if r := recover(); r != nil { + err = ec.Recover(ctx, r) + ec.Error(ctx, err) + } + }() + ctx = graphql.WithFieldContext(ctx, fc) + if fc.Args, err = ec.field_Identity_permission_args(ctx, field.ArgumentMap(ec.Variables)); err != nil { + ec.Error(ctx, err) + return fc, err + } + return fc, nil +} + func (ec *executionContext) _Invitation_id(ctx context.Context, field graphql.CollectedField, obj *types.Invitation) (ret graphql.Marshaler) { return graphql.ResolveField( ctx, @@ -4948,6 +5048,8 @@ func (ec *executionContext) fieldContext_Membership_identity(_ context.Context, return ec.fieldContext_Identity_sessions(ctx, field) case "personalAPIKeys": return ec.fieldContext_Identity_personalAPIKeys(ctx, field) + case "permission": + return ec.fieldContext_Identity_permission(ctx, field) } return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name) }, @@ -8608,6 +8710,8 @@ func (ec *executionContext) fieldContext_Query_viewer(_ context.Context, field g return ec.fieldContext_Identity_sessions(ctx, field) case "personalAPIKeys": return ec.fieldContext_Identity_personalAPIKeys(ctx, field) + case "permission": + return ec.fieldContext_Identity_permission(ctx, field) } return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name) }, @@ -9889,6 +9993,8 @@ func (ec *executionContext) fieldContext_Session_identity(_ context.Context, fie return ec.fieldContext_Identity_sessions(ctx, field) case "personalAPIKeys": return ec.fieldContext_Identity_personalAPIKeys(ctx, field) + case "permission": + return ec.fieldContext_Identity_permission(ctx, field) } return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name) }, @@ -10262,6 +10368,8 @@ func (ec *executionContext) fieldContext_SignInPayload_identity(_ context.Contex return ec.fieldContext_Identity_sessions(ctx, field) case "personalAPIKeys": return ec.fieldContext_Identity_personalAPIKeys(ctx, field) + case "permission": + return ec.fieldContext_Identity_permission(ctx, field) } return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name) }, @@ -10387,6 +10495,8 @@ func (ec *executionContext) fieldContext_SignUpFromInvitationPayload_identity(_ return ec.fieldContext_Identity_sessions(ctx, field) case "personalAPIKeys": return ec.fieldContext_Identity_personalAPIKeys(ctx, field) + case "permission": + return ec.fieldContext_Identity_permission(ctx, field) } return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name) }, @@ -10438,6 +10548,8 @@ func (ec *executionContext) fieldContext_SignUpPayload_identity(_ context.Contex return ec.fieldContext_Identity_sessions(ctx, field) case "personalAPIKeys": return ec.fieldContext_Identity_personalAPIKeys(ctx, field) + case "permission": + return ec.fieldContext_Identity_permission(ctx, field) } return nil, fmt.Errorf("no field named %q was found under type Identity", field.Name) }, @@ -13997,6 +14109,42 @@ func (ec *executionContext) _Identity(ctx context.Context, sel ast.SelectionSet, continue } + out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) }) + case "permission": + field := field + + innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) { + defer func() { + if r := recover(); r != nil { + ec.Error(ctx, ec.Recover(ctx, r)) + } + }() + res = ec._Identity_permission(ctx, field, obj) + if res == graphql.Null { + atomic.AddUint32(&fs.Invalids, 1) + } + return res + } + + if field.Deferrable != nil { + dfs, ok := deferred[field.Deferrable.Label] + di := 0 + if ok { + dfs.AddField(field) + di = len(dfs.Values) - 1 + } else { + dfs = graphql.NewFieldSet([]graphql.CollectedField{field}) + deferred[field.Deferrable.Label] = dfs + } + dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler { + return innerFunc(ctx, dfs) + }) + + // don't run the out.Concurrently() call below + out.Values[i] = graphql.Null + continue + } + out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) }) default: panic("unknown field " + strconv.Quote(field.Name)) diff --git a/pkg/server/api/connect/v1/types/types.go b/pkg/server/api/connect/v1/types/types.go index c63136ae3..0fbf3710b 100644 --- a/pkg/server/api/connect/v1/types/types.go +++ b/pkg/server/api/connect/v1/types/types.go @@ -159,6 +159,7 @@ type Identity struct { PendingInvitations *InvitationConnection `json:"pendingInvitations,omitempty"` Sessions *SessionConnection `json:"sessions,omitempty"` PersonalAPIKeys *PersonalAPIKeyConnection `json:"personalAPIKeys,omitempty"` + Permission bool `json:"permission"` } func (Identity) IsNode() {} diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go index e883aeab1..11e29db17 100644 --- a/pkg/server/api/connect/v1/v1_resolver.go +++ b/pkg/server/api/connect/v1/v1_resolver.go @@ -136,6 +136,23 @@ func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Ident return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil } +// Permission is the resolver for the permission field. +func (r *identityResolver) Permission(ctx context.Context, obj *types.Identity, action string, id gid.GID) (bool, error) { + err := r.iam.Authorizer.Authorize( + ctx, + iam.AuthorizeParams{ + Principal: obj.ID, + Resource: id, + Action: action, + }, + ) + if err != nil { + return false, nil + } + + return true, nil +} + // Organization is the resolver for the organization field. func (r *invitationResolver) Organization(ctx context.Context, obj *types.Invitation) (*types.Organization, error) { if gqlutils.OnlyIDSelected(ctx) { diff --git a/pkg/server/api/mcp/v1/v1_resolver.go b/pkg/server/api/mcp/v1/schema.resolvers.go similarity index 100% rename from pkg/server/api/mcp/v1/v1_resolver.go rename to pkg/server/api/mcp/v1/schema.resolvers.go