rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch AuthorizationAttributes to batch and add AuthorizeBatch

Browse Source 
Change AuthorizationAttributer.AuthorizationAttributes to take a slice
of resource ids and return policy.AttributesByID, so a single SQL
round-trip can load condition attributes for a whole batch. All
coredata implementations are migrated to a single
`WHERE id = ANY(@resource_ids::text[])` query that returns only the
rows it finds.

Authorizer gains:
  - AuthorizeBatch — all-or-nothing across a homogeneous (same entity
    type, same organization) resource set; rejects mixed entity types,
    mixed organizations, and empty batches with structured errors.
  - AuthorizeMulti — heterogeneous evaluation that returns one error
    per item and writes audit log entries in a single bulk insert.

The single-resource Authorize is rewired to delegate to AuthorizeBatch
so all paths share the same condition evaluation and audit logging.
recordAuditLog is split into buildAuditLogEntry plus a batch insert.

Tests cover the new batch and multi paths, mixed/empty/unsupported
resource cases, audit log batching, and dry-run behaviour.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-23 11:26:24 -07:00
parent 2d08dfbe2f
commit b39d880c0f
82 changed files with 4942 additions and 986 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
pkg/coredata/oauth2_consent.go
View File

@@ -24,6 +24,7 @@ import (
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam/policy"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/uri"
)
@@ -58,31 +59,56 @@ func (c *OAuth2Consent) CursorKey(orderBy OAuth2ConsentOrderField) page.CursorKe
panic(fmt.Sprintf("unsupported order by: %s", orderBy))
}
func (c *OAuth2Consent) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
func (c *OAuth2Consent) AuthorizationAttributes(
ctx context.Context,
conn pg.Querier,
resourceIDs []gid.GID,
) (policy.AttributesByID, error) {
q := `
SELECT
identity_id,
session_id
id,
identity_id,
session_id
FROM
iam_oauth2_consents
iam_oauth2_consents
WHERE
id = $1
LIMIT 1;
id = ANY(@resource_ids::text[])
`
var identityID, sessionID gid.GID
if err := conn.QueryRow(ctx, q, c.ID).Scan(&identityID, &sessionID); err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return nil, ErrResourceNotFound
}
return nil, fmt.Errorf("cannot query oauth2_consent authorization attributes: %w", err)
args := pgx.StrictNamedArgs{
"resource_ids": resourceIDs,
}
return map[string]string{
"identity_id": identityID.String(),
"session_id": sessionID.String(),
}, nil
rows, err := conn.Query(ctx, q, args)
if err != nil {
return nil, fmt.Errorf("cannot query oauth2 consent authorization attributes: %w", err)
}
defer rows.Close()
attrsByID := make(policy.AttributesByID, len(resourceIDs))
for rows.Next() {
var (
id gid.GID
identityID gid.GID
sessionID gid.GID
)
err = rows.Scan(&id, &identityID, &sessionID)
if err != nil {
return nil, fmt.Errorf("cannot scan oauth2 consent authorization attributes: %w", err)
}
attrsByID[id] = policy.Attributes{
"identity_id": identityID.String(),
"session_id": sessionID.String(),
}
}
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("cannot iterate oauth2 consent authorization attributes: %w", err)
}
return attrsByID, nil
}
func (c *OAuth2Consent) LoadByID(