From 7405565699d64a17c965e09ec7973a71fb56af57 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Sat, 23 May 2026 11:43:41 -0700 Subject: [PATCH] Use authorize-returned scope in Node resolver The Node resolver was manually constructing a scope from the object ID, both at the top of the function and again inside several closures. Since r.authorize already returns the resolved scope, pass it into the loadNode closures and drop the duplicate construction. Signed-off-by: Bryan Frimin --- pkg/server/api/console/v1/base_resolvers.go | 116 ++++++++------------ 1 file changed, 45 insertions(+), 71 deletions(-) diff --git a/pkg/server/api/console/v1/base_resolvers.go b/pkg/server/api/console/v1/base_resolvers.go index 3576c8e67..756186619 100644 --- a/pkg/server/api/console/v1/base_resolvers.go +++ b/pkg/server/api/console/v1/base_resolvers.go @@ -24,15 +24,14 @@ import ( // Node is the resolver for the node field. func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) { var ( - loadNode func(ctx context.Context, id gid.GID) (types.Node, error) + loadNode func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) action string - scope = coredata.NewScopeFromObjectID(id) ) switch id.EntityType() { case coredata.OrganizationEntityType: action = iam.ActionOrganizationGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { organization, err := r.probo.Organizations.Get(ctx, scope, id) if err != nil { return nil, err @@ -42,7 +41,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ThirdPartyEntityType: action = probo.ActionThirdPartyGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { thirdParty, err := r.probo.ThirdParties.Get(ctx, scope, id) if err != nil { return nil, err @@ -52,7 +51,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.FrameworkEntityType: action = probo.ActionFrameworkGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { framework, err := r.probo.Frameworks.Get(ctx, scope, id) if err != nil { return nil, err @@ -62,7 +61,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.MeasureEntityType: action = probo.ActionMeasureGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { measure, err := r.probo.Measures.Get(ctx, scope, id) if err != nil { return nil, err @@ -72,7 +71,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.TaskEntityType: action = probo.ActionTaskGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { task, err := r.probo.Tasks.Get(ctx, scope, id) if err != nil { return nil, err @@ -82,7 +81,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.EvidenceEntityType: action = probo.ActionEvidenceList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { evidence, err := r.probo.Evidences.Get(ctx, scope, id) if err != nil { return nil, err @@ -92,7 +91,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.DocumentEntityType: action = probo.ActionDocumentGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { document, err := r.probo.Documents.Get(ctx, scope, id) if err != nil { return nil, err @@ -102,7 +101,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ControlEntityType: action = probo.ActionControlList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { control, err := r.probo.Controls.Get(ctx, scope, id) if err != nil { return nil, err @@ -112,7 +111,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RiskEntityType: action = probo.ActionRiskGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { risk, err := r.probo.Risks.Get(ctx, scope, id) if err != nil { return nil, err @@ -122,9 +121,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RiskAssessmentEntityType: action = probo.ActionRiskAssessmentGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { ra, err := r.riskManagement.Get(ctx, scope, id) if err != nil { return nil, err @@ -134,9 +131,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RiskAssessmentNodeEntityType: action = probo.ActionRiskAssessmentNodeGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { n, err := r.riskManagement.GetNode(ctx, scope, id) if err != nil { return nil, err @@ -146,9 +141,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RiskAssessmentProcessEntityType: action = probo.ActionRiskAssessmentProcessGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { p, err := r.riskManagement.GetProcess(ctx, scope, id) if err != nil { return nil, err @@ -158,9 +151,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RiskAssessmentThreatEntityType: action = probo.ActionRiskAssessmentThreatGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { t, err := r.riskManagement.GetThreat(ctx, scope, id) if err != nil { return nil, err @@ -170,9 +161,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RiskAssessmentScopeEntityType: action = probo.ActionRiskAssessmentScopeGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { s, err := r.riskManagement.GetScope(ctx, scope, id) if err != nil { return nil, err @@ -182,9 +171,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RiskAssessmentScenarioEntityType: action = probo.ActionRiskAssessmentScenarioGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { s, err := r.riskManagement.GetScenario(ctx, scope, id) if err != nil { return nil, err @@ -194,7 +181,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ThirdPartyComplianceReportEntityType: action = probo.ActionThirdPartyComplianceReportGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { thirdPartyComplianceReport, err := r.probo.ThirdPartyComplianceReports.Get(ctx, scope, id) if err != nil { return nil, err @@ -204,7 +191,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ThirdPartyContactEntityType: action = probo.ActionThirdPartyContactGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { thirdPartyContact, err := r.probo.ThirdPartyContacts.Get(ctx, scope, id) if err != nil { return nil, err @@ -214,7 +201,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ThirdPartyServiceEntityType: action = probo.ActionThirdPartyServiceGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { thirdPartyService, err := r.probo.ThirdPartyServices.Get(ctx, scope, id) if err != nil { return nil, err @@ -224,7 +211,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.DocumentVersionEntityType: action = probo.ActionDocumentVersionList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { documentVersion, err := r.probo.Documents.GetVersion(ctx, scope, id) if err != nil { return nil, err @@ -234,7 +221,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.DocumentVersionSignatureEntityType: action = probo.ActionDocumentVersionSignatureList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { documentVersionSignature, err := r.probo.Documents.GetVersionSignature(ctx, scope, id) if err != nil { return nil, err @@ -244,7 +231,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.AssetEntityType: action = probo.ActionAssetList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { asset, err := r.probo.Assets.Get(ctx, scope, id) if err != nil { return nil, err @@ -254,7 +241,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.DatumEntityType: action = probo.ActionDatumList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { datum, err := r.probo.Data.Get(ctx, scope, id) if err != nil { return nil, err @@ -264,7 +251,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.AuditEntityType: action = probo.ActionAuditList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { audit, err := r.probo.Audits.Get(ctx, scope, id) if err != nil { return nil, err @@ -274,7 +261,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.FindingEntityType: action = probo.ActionFindingList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { finding, err := r.probo.Findings.Get(ctx, scope, id) if err != nil { return nil, err @@ -284,7 +271,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ObligationEntityType: action = probo.ActionObligationList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { obligation, err := r.probo.Obligations.Get(ctx, scope, id) if err != nil { return nil, err @@ -294,7 +281,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ReportEntityType: action = probo.ActionReportGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { report, err := r.probo.Reports.Get(ctx, scope, id) if err != nil { return nil, err @@ -304,7 +291,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.ProcessingActivityEntityType: action = probo.ActionProcessingActivityList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { processingActivity, err := r.probo.ProcessingActivities.Get(ctx, scope, id) if err != nil { return nil, err @@ -315,7 +302,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error case coredata.DataProtectionImpactAssessmentEntityType: // TODO: add action // action = probo.ActionDataProtectionImpactAssessmentGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { dpia, err := r.probo.DataProtectionImpactAssessments.Get(ctx, scope, id) if err != nil { return nil, err @@ -326,7 +313,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error case coredata.TransferImpactAssessmentEntityType: // TODO: add action //action = probo.ActionTransferImpactAssessmentGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { tia, err := r.probo.TransferImpactAssessments.Get(ctx, scope, id) if err != nil { return nil, err @@ -336,7 +323,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.TrustCenterEntityType: action = probo.ActionTrustCenterGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { trustCenter, err := r.probo.TrustCenters.Get(ctx, scope, id) if err != nil { return nil, err @@ -354,7 +341,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.TrustCenterAccessEntityType: action = probo.ActionTrustCenterAccessGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { trustCenterAccess, err := r.probo.TrustCenterAccesses.Get(ctx, scope, id) if err != nil { return nil, err @@ -364,7 +351,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.RightsRequestEntityType: action = probo.ActionRightsRequestGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { rightsRequest, err := r.probo.RightsRequests.Get(ctx, scope, id) if err != nil { return nil, err @@ -374,7 +361,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.StatementOfApplicabilityEntityType: action = probo.ActionStatementOfApplicabilityGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { statementOfApplicability, err := r.probo.StatementsOfApplicability.Get(ctx, scope, id) if err != nil { return nil, err @@ -384,7 +371,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.WebhookSubscriptionEntityType: action = probo.ActionWebhookSubscriptionGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { wc, err := r.probo.WebhookSubscriptions.Get(ctx, scope, id) if err != nil { return nil, err @@ -394,9 +381,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.AccessReviewCampaignEntityType: action = probo.ActionAccessReviewCampaignGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { campaign, err := r.accessReview.Campaigns(scope).Get(ctx, id) if err != nil { return nil, err @@ -406,9 +391,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.AccessSourceEntityType: action = probo.ActionAccessSourceGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { source, err := r.accessReview.Sources(scope).Get(ctx, id) if err != nil { return nil, err @@ -418,9 +401,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.AccessEntryEntityType: action = probo.ActionAccessEntryGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { entry, err := r.accessReview.Entries(scope).Get(ctx, id) if err != nil { return nil, err @@ -430,9 +411,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.CookieBannerEntityType: action = probo.ActionCookieBannerGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { banner, err := r.cookieBanner.GetCookieBanner(ctx, scope, id) if err != nil { return nil, err @@ -442,9 +421,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.CookieCategoryEntityType: action = probo.ActionCookieCategoryGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { category, err := r.cookieBanner.GetCookieCategory(ctx, scope, id) if err != nil { return nil, err @@ -454,9 +431,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.CookieConsentRecordEntityType: action = probo.ActionCookieConsentRecordList - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { record, err := r.cookieBanner.GetCookieConsentRecord(ctx, scope, id) if err != nil { return nil, err @@ -478,9 +453,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error } case coredata.CookieBannerVersionEntityType: action = probo.ActionCookieBannerVersionGet - loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) { - scope := coredata.NewScopeFromObjectID(id) - + loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) { version, err := r.cookieBanner.GetCookieBannerVersion(ctx, scope, id) if err != nil { return nil, err @@ -497,11 +470,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error default: } - if _, err := r.authorize(ctx, id, action); err != nil { + scope, err := r.authorize(ctx, id, action) + if err != nil { return nil, err } - node, err := loadNode(ctx, id) + node, err := loadNode(ctx, scope, id) if err != nil { if errors.Is(err, coredata.ErrResourceNotFound) { return nil, gqlutils.NotFound(ctx, err)