rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create scope in Authorize

Browse Source 
Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-20 18:11:25 -07:00
parent 7f59a0d2ee
commit 4d1a98ffdb
45 changed files with 1480 additions and 1754 deletions
Download Patch File Download Diff File Expand all files Collapse all files

144
pkg/server/api/console/v1/access_review_campaign_resolvers.go
View File

@@ -23,12 +23,11 @@ import (
// Campaign is the resolver for the campaign field.
func (r *accessEntryResolver) Campaign(ctx context.Context, obj *types.AccessEntry) (*types.AccessReviewCampaign, error) {
if err := r.authorize(ctx, obj.Campaign.ID, probo.ActionAccessReviewCampaignGet); err != nil {
scope, err := r.authorize(ctx, obj.Campaign.ID, probo.ActionAccessReviewCampaignGet)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.Campaign.ID)
campaign, err := r.accessReview.Campaigns(scope).Get(ctx, obj.Campaign.ID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -43,12 +42,11 @@ func (r *accessEntryResolver) Campaign(ctx context.Context, obj *types.AccessEnt
// AccessSource is the resolver for the accessSource field.
func (r *accessEntryResolver) AccessSource(ctx context.Context, obj *types.AccessEntry) (*types.AccessSource, error) {
if err := r.authorize(ctx, obj.AccessSource.ID, probo.ActionAccessSourceGet); err != nil {
scope, err := r.authorize(ctx, obj.AccessSource.ID, probo.ActionAccessSourceGet)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.AccessSource.ID)
source, err := r.accessReview.Sources(scope).Get(ctx, obj.AccessSource.ID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -63,12 +61,11 @@ func (r *accessEntryResolver) AccessSource(ctx context.Context, obj *types.Acces
// DecisionHistory is the resolver for the decisionHistory field.
func (r *accessEntryResolver) DecisionHistory(ctx context.Context, obj *types.AccessEntry) ([]*types.AccessEntryDecisionHistoryEntry, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryGet); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryGet)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.ID)
histories, err := r.accessReview.Entries(scope).DecisionHistory(ctx, obj.ID)
if err != nil {
panic(fmt.Errorf("cannot get decision history: %w", err))
@@ -125,12 +122,11 @@ func (r *accessReviewResolver) IdentitySource(ctx context.Context, obj *types.Ac
// AccessSources is the resolver for the accessSources field.
func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessSourceOrder) (*types.AccessSourceConnection, error) {
if err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList); err != nil {
scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.Organization.ID)
pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{
Field: coredata.AccessSourceOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
@@ -154,12 +150,11 @@ func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.Acc
// Campaigns is the resolver for the campaigns field.
func (r *accessReviewResolver) Campaigns(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessReviewCampaignOrder) (*types.AccessReviewCampaignConnection, error) {
if err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList); err != nil {
scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.Organization.ID)
pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{
Field: coredata.AccessReviewCampaignOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
@@ -193,12 +188,11 @@ func (r *accessReviewCampaignResolver) Organization(ctx context.Context, obj *ty
// ScopeSources is the resolver for the scopeSources field.
func (r *accessReviewCampaignResolver) ScopeSources(ctx context.Context, obj *types.AccessReviewCampaign) ([]*types.AccessReviewCampaignScopeSource, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.ID)
sources, err := r.accessReview.Sources(scope).ListScopeSourcesForCampaignID(ctx, obj.ID)
if err != nil {
panic(fmt.Errorf("cannot list scope sources: %w", err))
@@ -224,12 +218,11 @@ func (r *accessReviewCampaignResolver) ScopeSources(ctx context.Context, obj *ty
// Entries is the resolver for the entries field.
func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.AccessReviewCampaign, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessEntryOrder, accessSourceID *gid.GID, filter *coredata.AccessEntryFilter) (*types.AccessEntryConnection, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.ID)
pageOrderBy := page.OrderBy[coredata.AccessEntryOrderField]{
Field: coredata.AccessEntryOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
@@ -244,8 +237,7 @@ func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.A
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
var (
p *page.Page[*coredata.AccessEntry, coredata.AccessEntryOrderField]
err error
p *page.Page[*coredata.AccessEntry, coredata.AccessEntryOrderField]
)
if accessSourceID != nil {
@@ -263,12 +255,11 @@ func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.A
// PendingEntryCount is the resolver for the pendingEntryCount field.
func (r *accessReviewCampaignResolver) PendingEntryCount(ctx context.Context, obj *types.AccessReviewCampaign) (int, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList)
if err != nil {
return 0, err
}
scope := coredata.NewScopeFromObjectID(obj.ID)
count, err := r.accessReview.Entries(scope).CountPendingForCampaignID(ctx, obj.ID)
if err != nil {
panic(fmt.Errorf("cannot count pending access entries: %w", err))
@@ -279,12 +270,11 @@ func (r *accessReviewCampaignResolver) PendingEntryCount(ctx context.Context, ob
// Statistics is the resolver for the statistics field.
func (r *accessReviewCampaignResolver) Statistics(ctx context.Context, obj *types.AccessReviewCampaign) (*types.AccessReviewCampaignStatistics, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.ID)
stats, err := r.accessReview.Entries(scope).Statistics(ctx, obj.ID)
if err != nil {
panic(fmt.Errorf("cannot get campaign statistics: %w", err))
@@ -317,12 +307,11 @@ func (r *accessReviewCampaignConnectionResolver) TotalCount(ctx context.Context,
// Entries is the resolver for the entries field.
func (r *accessReviewCampaignScopeSourceResolver) Entries(ctx context.Context, obj *types.AccessReviewCampaignScopeSource, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessEntryOrder, filter *coredata.AccessEntryFilter) (*types.AccessEntryConnection, error) {
if err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList); err != nil {
scope, err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.CampaignID)
pageOrderBy := page.OrderBy[coredata.AccessEntryOrderField]{
Field: coredata.AccessEntryOrderFieldCreatedAt,
Direction: page.OrderDirectionDesc,
@@ -348,12 +337,11 @@ func (r *accessReviewCampaignScopeSourceResolver) Entries(ctx context.Context, o
// Statistics is the resolver for the statistics field.
func (r *accessReviewCampaignScopeSourceResolver) Statistics(ctx context.Context, obj *types.AccessReviewCampaignScopeSource) (*types.AccessReviewCampaignStatistics, error) {
if err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList); err != nil {
scope, err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(obj.CampaignID)
stats, err := r.accessReview.Entries(scope).StatisticsForSource(ctx, obj.CampaignID, obj.ID)
if err != nil {
panic(fmt.Errorf("cannot get source statistics: %w", err))
@@ -390,7 +378,8 @@ func (r *accessSourceResolver) Connector(ctx context.Context, obj *types.AccessS
// ProviderOrganizations is the resolver for the providerOrganizations field.
func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *types.AccessSource) ([]*types.ProviderOrganization, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
if err != nil {
return nil, err
}
@@ -398,8 +387,6 @@ func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *t
return []*types.ProviderOrganization{}, nil
}
scope := coredata.NewScopeFromObjectID(obj.ID)
httpClient, dbConnector, err := r.accessReview.Sources(scope).ConnectorHTTPClient(ctx, *obj.ConnectorID)
if err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -434,7 +421,8 @@ func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *t
// return false: the identifier is captured during the OAuth callback,
// not via a follow-up configure mutation.
func (r *accessSourceResolver) NeedsConfiguration(ctx context.Context, obj *types.AccessSource) (bool, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
if err != nil {
return false, err
}
@@ -442,7 +430,6 @@ func (r *accessSourceResolver) NeedsConfiguration(ctx context.Context, obj *type
return false, nil
}
scope := coredata.NewScopeFromObjectID(obj.ID)
prb := r.probo
dbConnector, err := prb.Connectors.Get(ctx, scope, *obj.ConnectorID)
@@ -496,7 +483,8 @@ func (r *accessSourceResolver) ConnectionStatus(ctx context.Context, obj *types.
// SelectedOrganization is the resolver for the selectedOrganization field.
func (r *accessSourceResolver) SelectedOrganization(ctx context.Context, obj *types.AccessSource) (*string, error) {
if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil {
scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
if err != nil {
return nil, err
}
@@ -504,7 +492,6 @@ func (r *accessSourceResolver) SelectedOrganization(ctx context.Context, obj *ty
return nil, nil
}
scope := coredata.NewScopeFromObjectID(obj.ID)
prb := r.probo
dbConnector, err := prb.Connectors.Get(ctx, scope, *obj.ConnectorID)
@@ -553,12 +540,11 @@ func (r *accessSourceConnectionResolver) TotalCount(ctx context.Context, obj *ty
// CreateAccessSource is the resolver for the createAccessSource field.
func (r *mutationResolver) CreateAccessSource(ctx context.Context, input types.CreateAccessSourceInput) (*types.CreateAccessSourcePayload, error) {
if err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate); err != nil {
scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.OrganizationID)
source, err := r.accessReview.Sources(scope).Create(ctx, accessreview.CreateAccessSourceRequest{
OrganizationID: input.OrganizationID,
ConnectorID: input.ConnectorID,
@@ -577,12 +563,11 @@ func (r *mutationResolver) CreateAccessSource(ctx context.Context, input types.C
// UpdateAccessSource is the resolver for the updateAccessSource field.
func (r *mutationResolver) UpdateAccessSource(ctx context.Context, input types.UpdateAccessSourceInput) (*types.UpdateAccessSourcePayload, error) {
if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate); err != nil {
scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessSourceID)
req := accessreview.UpdateAccessSourceRequest{
AccessSourceID: input.AccessSourceID,
}
@@ -614,12 +599,11 @@ func (r *mutationResolver) UpdateAccessSource(ctx context.Context, input types.U
// DeleteAccessSource is the resolver for the deleteAccessSource field.
func (r *mutationResolver) DeleteAccessSource(ctx context.Context, input types.DeleteAccessSourceInput) (*types.DeleteAccessSourcePayload, error) {
if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete); err != nil {
scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessSourceID)
if err := r.accessReview.Sources(scope).Delete(ctx, input.AccessSourceID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil, gqlutils.NotFound(ctx, err)
@@ -635,12 +619,11 @@ func (r *mutationResolver) DeleteAccessSource(ctx context.Context, input types.D
// ConfigureAccessSource is the resolver for the configureAccessSource field.
func (r *mutationResolver) ConfigureAccessSource(ctx context.Context, input types.ConfigureAccessSourceInput) (*types.ConfigureAccessSourcePayload, error) {
if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate); err != nil {
scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessSourceID)
source, err := r.accessReview.Sources(scope).ConfigureAccessSource(
ctx,
accessreview.ConfigureAccessSourceRequest{
@@ -663,12 +646,11 @@ func (r *mutationResolver) ConfigureAccessSource(ctx context.Context, input type
// CreateAccessReviewCampaign is the resolver for the createAccessReviewCampaign field.
func (r *mutationResolver) CreateAccessReviewCampaign(ctx context.Context, input types.CreateAccessReviewCampaignInput) (*types.CreateAccessReviewCampaignPayload, error) {
if err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate); err != nil {
scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.OrganizationID)
var description string
if input.Description != nil {
description = *input.Description
@@ -692,12 +674,11 @@ func (r *mutationResolver) CreateAccessReviewCampaign(ctx context.Context, input
// UpdateAccessReviewCampaign is the resolver for the updateAccessReviewCampaign field.
func (r *mutationResolver) UpdateAccessReviewCampaign(ctx context.Context, input types.UpdateAccessReviewCampaignInput) (*types.UpdateAccessReviewCampaignPayload, error) {
if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignUpdate); err != nil {
scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignUpdate)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
req := accessreview.UpdateAccessReviewCampaignRequest{
CampaignID: input.AccessReviewCampaignID,
}
@@ -730,12 +711,11 @@ func (r *mutationResolver) UpdateAccessReviewCampaign(ctx context.Context, input
// DeleteAccessReviewCampaign is the resolver for the deleteAccessReviewCampaign field.
func (r *mutationResolver) DeleteAccessReviewCampaign(ctx context.Context, input types.DeleteAccessReviewCampaignInput) (*types.DeleteAccessReviewCampaignPayload, error) {
if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignDelete); err != nil {
scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignDelete)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
if err := r.accessReview.Campaigns(scope).Delete(ctx, input.AccessReviewCampaignID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil, gqlutils.NotFound(ctx, err)
@@ -751,12 +731,11 @@ func (r *mutationResolver) DeleteAccessReviewCampaign(ctx context.Context, input
// StartAccessReviewCampaign is the resolver for the startAccessReviewCampaign field.
func (r *mutationResolver) StartAccessReviewCampaign(ctx context.Context, input types.StartAccessReviewCampaignInput) (*types.StartAccessReviewCampaignPayload, error) {
if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignStart); err != nil {
scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignStart)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
campaign, err := r.accessReview.Campaigns(scope).Start(ctx, input.AccessReviewCampaignID)
if err != nil {
panic(fmt.Errorf("cannot start access review campaign: %w", err))
@@ -769,12 +748,11 @@ func (r *mutationResolver) StartAccessReviewCampaign(ctx context.Context, input
// CloseAccessReviewCampaign is the resolver for the closeAccessReviewCampaign field.
func (r *mutationResolver) CloseAccessReviewCampaign(ctx context.Context, input types.CloseAccessReviewCampaignInput) (*types.CloseAccessReviewCampaignPayload, error) {
if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignClose); err != nil {
scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignClose)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
campaign, err := r.accessReview.Campaigns(scope).Close(ctx, input.AccessReviewCampaignID)
if err != nil {
panic(fmt.Errorf("cannot close access review campaign: %w", err))
@@ -787,12 +765,11 @@ func (r *mutationResolver) CloseAccessReviewCampaign(ctx context.Context, input
// CancelAccessReviewCampaign is the resolver for the cancelAccessReviewCampaign field.
func (r *mutationResolver) CancelAccessReviewCampaign(ctx context.Context, input types.CancelAccessReviewCampaignInput) (*types.CancelAccessReviewCampaignPayload, error) {
if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignCancel); err != nil {
scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignCancel)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
campaign, err := r.accessReview.Campaigns(scope).Cancel(ctx, input.AccessReviewCampaignID)
if err != nil {
panic(fmt.Errorf("cannot cancel access review campaign: %w", err))
@@ -805,12 +782,11 @@ func (r *mutationResolver) CancelAccessReviewCampaign(ctx context.Context, input
// AddAccessReviewCampaignScopeSource is the resolver for the addAccessReviewCampaignScopeSource field.
func (r *mutationResolver) AddAccessReviewCampaignScopeSource(ctx context.Context, input types.AddAccessReviewCampaignScopeSourceInput) (*types.AddAccessReviewCampaignScopeSourcePayload, error) {
if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignAddScopeSource); err != nil {
scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignAddScopeSource)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
campaign, err := r.accessReview.Campaigns(scope).AddScopeSource(ctx, accessreview.AddCampaignScopeSourceRequest{
CampaignID: input.AccessReviewCampaignID,
AccessSourceID: input.AccessSourceID,
@@ -826,12 +802,11 @@ func (r *mutationResolver) AddAccessReviewCampaignScopeSource(ctx context.Contex
// RemoveAccessReviewCampaignScopeSource is the resolver for the removeAccessReviewCampaignScopeSource field.
func (r *mutationResolver) RemoveAccessReviewCampaignScopeSource(ctx context.Context, input types.RemoveAccessReviewCampaignScopeSourceInput) (*types.RemoveAccessReviewCampaignScopeSourcePayload, error) {
if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource); err != nil {
scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
campaign, err := r.accessReview.Campaigns(scope).RemoveScopeSource(ctx, accessreview.RemoveCampaignScopeSourceRequest{
CampaignID: input.AccessReviewCampaignID,
AccessSourceID: input.AccessSourceID,
@@ -847,12 +822,11 @@ func (r *mutationResolver) RemoveAccessReviewCampaignScopeSource(ctx context.Con
// RecordAccessEntryDecision is the resolver for the recordAccessEntryDecision field.
func (r *mutationResolver) RecordAccessEntryDecision(ctx context.Context, input types.RecordAccessEntryDecisionInput) (*types.RecordAccessEntryDecisionPayload, error) {
if err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide); err != nil {
scope, err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessEntryID)
// Resolve the profile ID from the session's identity.
// The profile may not exist for every identity, in which
// case decided_by will be left nil.
@@ -904,7 +878,8 @@ func (r *mutationResolver) RecordAccessEntryDecisions(ctx context.Context, input
// Authorize each entry individually to prevent cross-org bypass.
for _, d := range input.Decisions {
if err := r.authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide); err != nil {
_, err := r.authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide)
if err != nil {
return nil, err
}
}
@@ -968,12 +943,11 @@ func (r *mutationResolver) RecordAccessEntryDecisions(ctx context.Context, input
// FlagAccessEntry is the resolver for the flagAccessEntry field.
func (r *mutationResolver) FlagAccessEntry(ctx context.Context, input types.FlagAccessEntryInput) (*types.FlagAccessEntryPayload, error) {
if err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag); err != nil {
scope, err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag)
if err != nil {
return nil, err
}
scope := coredata.NewScopeFromObjectID(input.AccessEntryID)
entry, err := r.accessReview.Entries(scope).FlagEntry(ctx, accessreview.FlagAccessEntryRequest{
EntryID: input.AccessEntryID,
Flags: input.Flags,