rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Style

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-03-20 18:16:32 +01:00
parent 3b5122da5e
commit 3bb27fe8f1
3 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/iam/authorizer.go
View File

@@ -303,7 +303,9 @@ func (a *Authorizer) recordAuditLog(
orgID, err := gid.ParseGID(orgIDStr) orgID, err := gid.ParseGID(orgIDStr)
if err != nil { if err != nil {
a.logger.ErrorCtx(ctx, "cannot parse organization id for audit log", a.logger.ErrorCtx(
ctx,
"cannot parse organization id for audit log",
log.Error(err), log.Error(err),
) )
return return
@@ -320,7 +322,9 @@ func (a *Authorizer) recordAuditLog(
metadata, err := json.Marshal(map[string]any{}) metadata, err := json.Marshal(map[string]any{})
if err != nil { if err != nil {
a.logger.ErrorCtx(ctx, "cannot marshal audit log metadata", a.logger.ErrorCtx(
ctx,
"cannot marshal audit log metadata",
log.Error(err), log.Error(err),
) )
return return
@@ -341,7 +345,9 @@ func (a *Authorizer) recordAuditLog(
scope := coredata.NewScope(orgID.TenantID()) scope := coredata.NewScope(orgID.TenantID())
if err := entry.Insert(ctx, conn, scope); err != nil { if err := entry.Insert(ctx, conn, scope); err != nil {
a.logger.ErrorCtx(ctx, "cannot insert audit log entry", a.logger.ErrorCtx(
ctx,
"cannot insert audit log entry",
log.Error(err), log.Error(err),
log.String("action", params.Action), log.String("action", params.Action),
log.String("resource_id", params.Resource.String()), log.String("resource_id", params.Resource.String()),

8
pkg/iam/iam_policies.go
View File

@@ -316,7 +316,9 @@ var IAMAdminPolicy = policy.NewPolicy(
ActionAuditLogEntryList, ActionAuditLogEntryList,
). ).
WithSID("audit-log-entry-admin-access"). WithSID("audit-log-entry-admin-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")), When(
policy.Equals("principal.organization_id", "resource.organization_id"),
),
). ).
WithDescription("IAM admin access - can manage members but cannot delete organization or manage SAML/SCIM") WithDescription("IAM admin access - can manage members but cannot delete organization or manage SAML/SCIM")
@@ -358,6 +360,8 @@ var IAMViewerPolicy = policy.NewPolicy(
ActionAuditLogEntryList, ActionAuditLogEntryList,
). ).
WithSID("audit-log-entry-viewer-access"). WithSID("audit-log-entry-viewer-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")), When(
policy.Equals("principal.organization_id", "resource.organization_id"),
),
). ).
WithDescription("Read-only IAM access for organization viewers") WithDescription("Read-only IAM access for organization viewers")

5
pkg/iam/service.go
View File

@@ -123,7 +123,10 @@ func NewService(
svc.AuthService = NewAuthService(svc) svc.AuthService = NewAuthService(svc)
svc.APIKeyService = NewAPIKeyService(svc) svc.APIKeyService = NewAPIKeyService(svc)
svc.Authorizer = NewAuthorizer(pgClient, cfg.Logger.Named("authorizer")) svc.Authorizer = NewAuthorizer(
pgClient,
cfg.Logger.Named("authorizer"),
)
svc.Authorizer.RegisterPolicySet(IAMPolicySet()) svc.Authorizer.RegisterPolicySet(IAMPolicySet())
samlService, err := saml.NewService(svc.pg, svc.baseURL, svc.certificate, svc.privateKey, cfg.Logger) samlService, err := saml.NewService(svc.pg, svc.baseURL, svc.certificate, svc.privateKey, cfg.Logger)