Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-03-20 18:16:32 +01:00
parent 3b5122da5e
commit 3bb27fe8f1
3 changed files with 19 additions and 6 deletions

View File

@@ -303,7 +303,9 @@ func (a *Authorizer) recordAuditLog(
orgID, err := gid.ParseGID(orgIDStr)
if err != nil {
a.logger.ErrorCtx(ctx, "cannot parse organization id for audit log",
a.logger.ErrorCtx(
ctx,
"cannot parse organization id for audit log",
log.Error(err),
)
return
@@ -320,7 +322,9 @@ func (a *Authorizer) recordAuditLog(
metadata, err := json.Marshal(map[string]any{})
if err != nil {
a.logger.ErrorCtx(ctx, "cannot marshal audit log metadata",
a.logger.ErrorCtx(
ctx,
"cannot marshal audit log metadata",
log.Error(err),
)
return
@@ -341,7 +345,9 @@ func (a *Authorizer) recordAuditLog(
scope := coredata.NewScope(orgID.TenantID())
if err := entry.Insert(ctx, conn, scope); err != nil {
a.logger.ErrorCtx(ctx, "cannot insert audit log entry",
a.logger.ErrorCtx(
ctx,
"cannot insert audit log entry",
log.Error(err),
log.String("action", params.Action),
log.String("resource_id", params.Resource.String()),

View File

@@ -316,7 +316,9 @@ var IAMAdminPolicy = policy.NewPolicy(
ActionAuditLogEntryList,
).
WithSID("audit-log-entry-admin-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")),
When(
policy.Equals("principal.organization_id", "resource.organization_id"),
),
).
WithDescription("IAM admin access - can manage members but cannot delete organization or manage SAML/SCIM")
@@ -358,6 +360,8 @@ var IAMViewerPolicy = policy.NewPolicy(
ActionAuditLogEntryList,
).
WithSID("audit-log-entry-viewer-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")),
When(
policy.Equals("principal.organization_id", "resource.organization_id"),
),
).
WithDescription("Read-only IAM access for organization viewers")

View File

@@ -123,7 +123,10 @@ func NewService(
svc.AuthService = NewAuthService(svc)
svc.APIKeyService = NewAPIKeyService(svc)
svc.Authorizer = NewAuthorizer(pgClient, cfg.Logger.Named("authorizer"))
svc.Authorizer = NewAuthorizer(
pgClient,
cfg.Logger.Named("authorizer"),
)
svc.Authorizer.RegisterPolicySet(IAMPolicySet())
samlService, err := saml.NewService(svc.pg, svc.baseURL, svc.certificate, svc.privateKey, cfg.Logger)