rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create scope in Authorize

Browse Source 
Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-20 18:11:25 -07:00
parent 7f59a0d2ee
commit 4d1a98ffdb
45 changed files with 1480 additions and 1754 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/server/api/connect/v1/base_resolvers.go
View File

@@ -146,7 +146,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
return nil, fmt.Errorf("unsupported entity type: %d", id.EntityType())
}
if err := r.authorize(ctx, id, action); err != nil {
if _, err := r.authorize(ctx, id, action); err != nil {
return nil, err
}

8
pkg/server/api/connect/v1/identity_resolvers.go
View File

@@ -24,7 +24,7 @@ import (
// Profiles is the resolver for the profiles field.
func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err
}
@@ -68,7 +68,7 @@ func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, fi
// Sessions is the resolver for the sessions field.
func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
return nil, err
}
@@ -103,7 +103,7 @@ func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, fi
// PersonalAPIKeys is the resolver for the personalAPIKeys field.
func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
return nil, err
}
@@ -132,7 +132,7 @@ func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Ident
// SsoLoginURL is the resolver for the ssoLoginURL field.
func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
return nil, err
}

2
pkg/server/api/connect/v1/invitation_resolvers.go
View File

@@ -24,7 +24,7 @@ func (r *invitationResolver) Permission(ctx context.Context, obj *types.Invitati
// InviteUser is the resolver for the inviteUser field.
func (r *mutationResolver) InviteUser(ctx context.Context, input types.InviteUserInput) (*types.InviteUserPayload, error) {
if err := r.authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil {
if _, err := r.authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil {
return nil, err
}

6
pkg/server/api/connect/v1/membership_resolvers.go
View File

@@ -21,7 +21,7 @@ import (
// LastSession is the resolver for the lastSession field.
func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err
}
@@ -51,12 +51,12 @@ func (r *membershipResolver) Permission(ctx context.Context, obj *types.Membersh
// UpdateMembership is the resolver for the updateMembership field.
func (r *mutationResolver) UpdateMembership(ctx context.Context, input types.UpdateMembershipInput) (*types.UpdateMembershipPayload, error) {
if err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil {
if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil {
return nil, err
}
if input.Role == coredata.MembershipRoleOwner {
if err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil {
if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil {
return nil, err
}
}

18
pkg/server/api/connect/v1/organization_resolvers.go
View File

@@ -84,7 +84,7 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
// UpdateOrganization is the resolver for the updateOrganization field.
func (r *mutationResolver) UpdateOrganization(ctx context.Context, input types.UpdateOrganizationInput) (*types.UpdateOrganizationPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationUpdate); err != nil {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationUpdate); err != nil {
return nil, err
}
@@ -140,7 +140,7 @@ func (r *mutationResolver) UpdateOrganization(ctx context.Context, input types.U
// DeleteOrganization is the resolver for the deleteOrganization field.
func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.DeleteOrganizationInput) (*types.DeleteOrganizationPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationDelete); err != nil {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationDelete); err != nil {
return nil, err
}
@@ -160,7 +160,7 @@ func (r *mutationResolver) DeleteOrganizationHorizontalLogo(ctx context.Context,
// LogoURL is the resolver for the logoUrl field.
func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err
}
@@ -175,7 +175,7 @@ func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organizat
// HorizontalLogoURL is the resolver for the horizontalLogoUrl field.
func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil {
return nil, err
}
@@ -190,7 +190,7 @@ func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types
// Profiles is the resolver for the profiles field.
func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy) (*types.ProfileConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
return nil, err
}
@@ -228,7 +228,7 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
// SamlConfigurations is the resolver for the samlConfigurations field.
func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SAMLConfigurationConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil {
return nil, err
}
@@ -257,7 +257,7 @@ func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *type
// ScimConfiguration is the resolver for the scimConfiguration field.
func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types.Organization) (*types.SCIMConfiguration, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
return nil, err
}
@@ -291,7 +291,7 @@ func (r *organizationResolver) ScimBridgeTypes(ctx context.Context, obj *types.O
// AuditLogEntries is the resolver for the auditLogEntries field.
func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
return nil, err
}
@@ -339,7 +339,7 @@ func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.O
// Viewer is the resolver for the viewer field.
func (r *organizationResolver) Viewer(ctx context.Context, obj *types.Organization) (*types.Profile, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
return nil, err
}

8
pkg/server/api/connect/v1/personal_api_key_resolvers.go
View File

@@ -21,7 +21,7 @@ import (
func (r *mutationResolver) CreatePersonalAPIKey(ctx context.Context, input types.CreatePersonalAPIKeyInput) (*types.CreatePersonalAPIKeyPayload, error) {
identity := authn.IdentityFromContext(ctx)
if err := r.authorize(ctx, identity.ID, iam.ActionPersonalAPIKeyCreate); err != nil {
if _, err := r.authorize(ctx, identity.ID, iam.ActionPersonalAPIKeyCreate); err != nil {
return nil, err
}
@@ -44,7 +44,7 @@ func (r *mutationResolver) CreatePersonalAPIKey(ctx context.Context, input types
// RevokePersonalAPIKey is the resolver for the revokePersonalAPIKey field.
func (r *mutationResolver) RevokePersonalAPIKey(ctx context.Context, input types.RevokePersonalAPIKeyInput) (*types.RevokePersonalAPIKeyPayload, error) {
if err := r.authorize(ctx, input.PersonalAPIKeyID, iam.ActionPersonalAPIKeyDelete); err != nil {
if _, err := r.authorize(ctx, input.PersonalAPIKeyID, iam.ActionPersonalAPIKeyDelete); err != nil {
return nil, err
}
@@ -61,7 +61,7 @@ func (r *mutationResolver) RevokePersonalAPIKey(ctx context.Context, input types
// Token is the resolver for the token field.
func (r *personalAPIKeyResolver) Token(ctx context.Context, obj *types.PersonalAPIKey) (*string, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyGet); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyGet); err != nil {
return nil, err
}
@@ -85,7 +85,7 @@ func (r *personalAPIKeyResolver) Permission(ctx context.Context, obj *types.Pers
func (r *personalAPIKeyConnectionResolver) TotalCount(ctx context.Context, obj *types.PersonalAPIKeyConnection) (*int, error) {
switch obj.Resolver.(type) {
case *identityResolver:
if err := r.authorize(ctx, obj.ParentID, iam.ActionPersonalAPIKeyList); err != nil {
if _, err := r.authorize(ctx, obj.ParentID, iam.ActionPersonalAPIKeyList); err != nil {
return nil, err
}

16
pkg/server/api/connect/v1/profile_resolvers.go
View File

@@ -22,7 +22,7 @@ import (
// CreateUser is the resolver for the createUser field.
func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUserInput) (*types.CreateUserPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil {
return nil, err
}
@@ -57,7 +57,7 @@ func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUse
// DeactivateUser is the resolver for the deactivateUser field.
func (r *mutationResolver) DeactivateUser(ctx context.Context, input types.DeactivateUserInput) (*types.DeactivateUserPayload, error) {
if err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDeactivate); err != nil {
if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDeactivate); err != nil {
return nil, err
}
@@ -78,7 +78,7 @@ func (r *mutationResolver) DeactivateUser(ctx context.Context, input types.Deact
// UpdateUser is the resolver for the updateUser field.
func (r *mutationResolver) UpdateUser(ctx context.Context, input types.UpdateUserInput) (*types.UpdateUserPayload, error) {
if err := r.authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil {
if _, err := r.authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil {
return nil, err
}
@@ -106,7 +106,7 @@ func (r *mutationResolver) UpdateUser(ctx context.Context, input types.UpdateUse
// RemoveUser is the resolver for the removeUser field.
func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUserInput) (*types.RemoveUserPayload, error) {
if err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil {
if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil {
return nil, err
}
@@ -134,7 +134,7 @@ func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUse
// Identity is the resolver for the identity field.
func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*types.Identity, error) {
if err := r.authorize(
if _, err := r.authorize(
ctx,
obj.ID,
iam.ActionMembershipProfileGet,
@@ -159,7 +159,7 @@ func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*ty
// Organization is the resolver for the organization field.
func (r *profileResolver) Organization(ctx context.Context, obj *types.Profile) (*types.Organization, error) {
if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
if _, err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err
}
@@ -179,7 +179,7 @@ func (r *profileResolver) Organization(ctx context.Context, obj *types.Profile)
// Membership is the resolver for the membership field.
func (r *profileResolver) Membership(ctx context.Context, obj *types.Profile) (*types.Membership, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err
}
@@ -199,7 +199,7 @@ func (r *profileResolver) Membership(ctx context.Context, obj *types.Profile) (*
// PendingInvitations is the resolver for the pendingInvitations field.
func (r *profileResolver) PendingInvitations(ctx context.Context, obj *types.Profile, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrderBy) (*types.InvitationConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionInvitationList); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionInvitationList); err != nil {
return nil, err
}

3
pkg/server/api/connect/v1/resolver.go
View File

@@ -116,7 +116,8 @@ func NewMux(
}
func (r *Resolver) Permission(ctx context.Context, obj types.Node, action string) (bool, error) {
return r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) == nil, nil
_, err := r.authorize(ctx, obj.GetID(), action, authz.WithDryRun())
return err == nil, nil
}
func (r *Resolver) SSOLoginURL(samlConfigID gid.GID) string {

6
pkg/server/api/connect/v1/saml_resolvers.go
View File

@@ -19,7 +19,7 @@ import (
// CreateSAMLConfiguration is the resolver for the createSAMLConfiguration field.
func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input types.CreateSAMLConfigurationInput) (*types.CreateSAMLConfigurationPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationCreate); err != nil {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationCreate); err != nil {
return nil, err
}
@@ -63,7 +63,7 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
// UpdateSAMLConfiguration is the resolver for the updateSAMLConfiguration field.
func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input types.UpdateSAMLConfigurationInput) (*types.UpdateSAMLConfigurationPayload, error) {
if err := r.authorize(ctx, input.SamlConfigurationID, iam.ActionSAMLConfigurationUpdate); err != nil {
if _, err := r.authorize(ctx, input.SamlConfigurationID, iam.ActionSAMLConfigurationUpdate); err != nil {
return nil, err
}
@@ -100,7 +100,7 @@ func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input ty
// DeleteSAMLConfiguration is the resolver for the deleteSAMLConfiguration field.
func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input types.DeleteSAMLConfigurationInput) (*types.DeleteSAMLConfigurationPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationDelete); err != nil {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationDelete); err != nil {
return nil, err
}

20
pkg/server/api/connect/v1/scim_resolvers.go
View File

@@ -26,7 +26,7 @@ func (r *connectorResolver) Permission(ctx context.Context, obj *types.Connector
// CreateSCIMConfiguration is the resolver for the createSCIMConfiguration field.
func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input types.CreateSCIMConfigurationInput) (*types.CreateSCIMConfigurationPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil {
return nil, err
}
@@ -59,7 +59,7 @@ func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input ty
// DeleteSCIMConfiguration is the resolver for the deleteSCIMConfiguration field.
func (r *mutationResolver) DeleteSCIMConfiguration(ctx context.Context, input types.DeleteSCIMConfigurationInput) (*types.DeleteSCIMConfigurationPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil {
return nil, err
}
@@ -74,7 +74,7 @@ func (r *mutationResolver) DeleteSCIMConfiguration(ctx context.Context, input ty
// RegenerateSCIMToken is the resolver for the regenerateSCIMToken field.
func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types.RegenerateSCIMTokenInput) (*types.RegenerateSCIMTokenPayload, error) {
if err := r.authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil {
if _, err := r.authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil {
return nil, err
}
@@ -92,7 +92,7 @@ func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types.
// UpdateSCIMBridge is the resolver for the updateSCIMBridge field.
func (r *mutationResolver) UpdateSCIMBridge(ctx context.Context, input types.UpdateSCIMBridgeInput) (*types.UpdateSCIMBridgePayload, error) {
if err := r.authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil {
if _, err := r.authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil {
return nil, err
}
@@ -109,7 +109,7 @@ func (r *mutationResolver) UpdateSCIMBridge(ctx context.Context, input types.Upd
// ScimConfiguration is the resolver for the scimConfiguration field.
func (r *sCIMBridgeResolver) ScimConfiguration(ctx context.Context, obj *types.SCIMBridge) (*types.SCIMConfiguration, error) {
if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
if _, err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
return nil, err
}
@@ -138,7 +138,7 @@ func (r *sCIMBridgeResolver) Connector(ctx context.Context, obj *types.SCIMBridg
}
// Authorize based on the SCIM configuration (connector accessed via bridge is a sub-resource)
if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
if _, err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
return nil, err
}
@@ -170,7 +170,7 @@ func (r *sCIMConfigurationResolver) EndpointURL(ctx context.Context, obj *types.
// Organization is the resolver for the organization field.
func (r *sCIMConfigurationResolver) Organization(ctx context.Context, obj *types.SCIMConfiguration) (*types.Organization, error) {
if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet); err != nil {
if _, err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet); err != nil {
return nil, err
}
@@ -200,7 +200,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC
return nil, nil
}
if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
return nil, err
}
@@ -220,7 +220,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC
// Events is the resolver for the events field.
func (r *sCIMConfigurationResolver) Events(ctx context.Context, obj *types.SCIMConfiguration, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SCIMEventOrderBy) (*types.SCIMEventConnection, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil {
if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil {
return nil, err
}
@@ -256,7 +256,7 @@ func (r *sCIMEventResolver) Permission(ctx context.Context, obj *types.SCIMEvent
// TotalCount is the resolver for the totalCount field.
func (r *sCIMEventConnectionResolver) TotalCount(ctx context.Context, obj *types.SCIMEventConnection) (*int, error) {
if err := r.authorize(ctx, obj.ParentID, iam.ActionSCIMEventList); err != nil {
if _, err := r.authorize(ctx, obj.ParentID, iam.ActionSCIMEventList); err != nil {
return nil, err
}

4
pkg/server/api/connect/v1/session_resolvers.go
View File

@@ -416,7 +416,7 @@ func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input
// RevokeSession is the resolver for the revokeSession field.
func (r *mutationResolver) RevokeSession(ctx context.Context, input types.RevokeSessionInput) (*types.RevokeSessionPayload, error) {
if err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil {
if _, err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil {
return nil, err
}
@@ -438,7 +438,7 @@ func (r *mutationResolver) RevokeSession(ctx context.Context, input types.Revoke
// RevokeAllSessions is the resolver for the revokeAllSessions field.
func (r *mutationResolver) RevokeAllSessions(ctx context.Context) (*types.RevokeAllSessionsPayload, error) {
if err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil {
if _, err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil {
return nil, err
}