From 60a1b1c661c3fe6dd5ff25dbe2ab30f8cf487782 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Tue, 9 Jun 2026 13:10:19 +0200 Subject: [PATCH] Gate cookie banner policy regeneration on its own action MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RegenerateCookieBannerTrackerPolicy authorized against the generic cookie-banner update action, conflating policy regeneration with banner edits. Add a dedicated regenerate-policy action and authorize both the console and MCP resolvers against it so the capability can be granted independently. Signed-off-by: Émile Ré --- pkg/probo/actions.go | 2 ++ pkg/server/api/console/v1/cookie_banner_resolvers.go | 2 +- pkg/server/api/mcp/v1/schema.resolvers.go | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/probo/actions.go b/pkg/probo/actions.go index f9ceefdb8..b6119ae37 100644 --- a/pkg/probo/actions.go +++ b/pkg/probo/actions.go @@ -391,6 +391,8 @@ const ( ActionCookieBannerActivate = "core:cookie-banner:activate" ActionCookieBannerDeactivate = "core:cookie-banner:deactivate" + ActionCookieBannerRegeneratePolicy = "core:cookie-banner:regenerate-policy" + // CookieBannerVersion actions ActionCookieBannerVersionGet = "core:cookie-banner-version:get" ActionCookieBannerVersionList = "core:cookie-banner-version:list" diff --git a/pkg/server/api/console/v1/cookie_banner_resolvers.go b/pkg/server/api/console/v1/cookie_banner_resolvers.go index 3eb06a62b..b35c6dc87 100644 --- a/pkg/server/api/console/v1/cookie_banner_resolvers.go +++ b/pkg/server/api/console/v1/cookie_banner_resolvers.go @@ -779,7 +779,7 @@ func (r *mutationResolver) PublishCookieBannerVersion(ctx context.Context, input // RegenerateCookieBannerTrackerPolicy is the resolver for the regenerateCookieBannerTrackerPolicy field. func (r *mutationResolver) RegenerateCookieBannerTrackerPolicy(ctx context.Context, input types.RegenerateCookieBannerTrackerPolicyInput) (*types.RegenerateCookieBannerTrackerPolicyPayload, error) { - scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate) + scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerRegeneratePolicy) if err != nil { return nil, err } diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go index c779105c2..61379d735 100644 --- a/pkg/server/api/mcp/v1/schema.resolvers.go +++ b/pkg/server/api/mcp/v1/schema.resolvers.go @@ -5826,7 +5826,7 @@ func (r *Resolver) PublishCookieBannerVersionTool(ctx context.Context, req *mcp. } func (r *Resolver) RegenerateCookieBannerTrackerPolicyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RegenerateCookieBannerTrackerPolicyInput) (*mcp.CallToolResult, types.RegenerateCookieBannerTrackerPolicyOutput, error) { - scope, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate) + scope, err := r.Authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerRegeneratePolicy) if err != nil { return nil, types.RegenerateCookieBannerTrackerPolicyOutput{}, err }