rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch AuthorizationAttributes to batch and add AuthorizeBatch

Browse Source 
Change AuthorizationAttributer.AuthorizationAttributes to take a slice
of resource ids and return policy.AttributesByID, so a single SQL
round-trip can load condition attributes for a whole batch. All
coredata implementations are migrated to a single
`WHERE id = ANY(@resource_ids::text[])` query that returns only the
rows it finds.

Authorizer gains:
  - AuthorizeBatch — all-or-nothing across a homogeneous (same entity
    type, same organization) resource set; rejects mixed entity types,
    mixed organizations, and empty batches with structured errors.
  - AuthorizeMulti — heterogeneous evaluation that returns one error
    per item and writes audit log entries in a single bulk insert.

The single-resource Authorize is rewired to delegate to AuthorizeBatch
so all paths share the same condition evaluation and audit logging.
recordAuditLog is split into buildAuditLogEntry plus a batch insert.

Tests cover the new batch and multi paths, mixed/empty/unsupported
resource cases, audit log batching, and dry-run behaviour.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-23 11:26:24 -07:00
parent 2d08dfbe2f
commit b39d880c0f
82 changed files with 4942 additions and 986 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
pkg/coredata/oauth2_client.go
View File

@@ -25,6 +25,7 @@ import (
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam/policy"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/uri"
)
@@ -72,32 +73,55 @@ func (c *OAuth2Client) CursorKey(orderBy OAuth2ClientOrderField) page.CursorKey
panic(fmt.Sprintf("unsupported order by: %s", orderBy))
}
func (c *OAuth2Client) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
func (c *OAuth2Client) AuthorizationAttributes(
ctx context.Context,
conn pg.Querier,
resourceIDs []gid.GID,
) (policy.AttributesByID, error) {
q := `
SELECT
organization_id
id,
organization_id
FROM
iam_oauth2_clients
iam_oauth2_clients
WHERE
id = $1
LIMIT 1;
id = ANY(@resource_ids::text[])
`
var organizationID *gid.GID
if err := conn.QueryRow(ctx, q, c.ID).Scan(&organizationID); err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return nil, ErrResourceNotFound
}
args := pgx.StrictNamedArgs{
"resource_ids": resourceIDs,
}
rows, err := conn.Query(ctx, q, args)
if err != nil {
return nil, fmt.Errorf("cannot query oauth2 client authorization attributes: %w", err)
}
defer rows.Close()
attrs := make(map[string]string)
if organizationID != nil {
attrs["organization_id"] = organizationID.String()
attrsByID := make(policy.AttributesByID, len(resourceIDs))
for rows.Next() {
var (
id gid.GID
organizationID *gid.GID
)
err = rows.Scan(&id, &organizationID)
if err != nil {
return nil, fmt.Errorf("cannot scan oauth2 client authorization attributes: %w", err)
}
attrs := make(map[string]string)
if organizationID != nil {
attrs["organization_id"] = organizationID.String()
}
attrsByID[id] = attrs
}
return attrs, nil
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("cannot iterate oauth2 client authorization attributes: %w", err)
}
return attrsByID, nil
}
func (c *OAuth2Client) LoadByID(