From ca4ae96f315405232341cbb1a8ca55f1b1d0b417 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Fri, 16 Jan 2026 09:41:08 +0400 Subject: [PATCH] Rename authz.WithSesion to authz.WithSkipAssumptionCheck since we only used it with a nil arg MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Émile Ré --- pkg/iam/authorizer.go | 1 + pkg/server/api/authz/authorization.go | 6 ++++-- pkg/server/api/connect/v1/v1_resolver.go | 8 ++++---- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/pkg/iam/authorizer.go b/pkg/iam/authorizer.go index 1fd12383b..3eb7b3890 100644 --- a/pkg/iam/authorizer.go +++ b/pkg/iam/authorizer.go @@ -87,6 +87,7 @@ func (a *Authorizer) authorize(ctx context.Context, conn pg.Conn, params Authori } membership := findMembershipForOrg(memberships, resourceOrgID) + // Check whether the viewer is currently assuming the org of the accessed resource if membership != nil && params.Session != nil { if _, err := a.getActiveChildSessionForMembership( ctx, diff --git a/pkg/server/api/authz/authorization.go b/pkg/server/api/authz/authorization.go index 442dd73e1..eef15ff67 100644 --- a/pkg/server/api/authz/authorization.go +++ b/pkg/server/api/authz/authorization.go @@ -36,9 +36,11 @@ func WithAttr(key, value string) AuthorizeFuncOption { } } -func WithSession(sessionID *gid.GID) AuthorizeFuncOption { +// Use this option when it makes no sense to check whether the viewer is assuming the org of the accessed resource +// Example: on the viewer memberships page, we're accessing several organization names, but the viewer isn't assuming one yet. +func WithSkipAssumptionCheck() AuthorizeFuncOption { return func(params *iam.AuthorizeParams) { - params.Session = sessionID + params.Session = nil } } diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go index 1ec34a145..9d02bac74 100644 --- a/pkg/server/api/connect/v1/v1_resolver.go +++ b/pkg/server/api/connect/v1/v1_resolver.go @@ -272,7 +272,7 @@ func (r *membershipResolver) Profile(ctx context.Context, obj *types.Membership) // Organization is the resolver for the organization field. func (r *membershipResolver) Organization(ctx context.Context, obj *types.Membership) (*types.Organization, error) { - if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSession(nil)); err != nil { + if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -293,7 +293,7 @@ func (r *membershipResolver) Organization(ctx context.Context, obj *types.Member // LastSession is the resolver for the lastSession field. func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSession(nil)); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -1157,7 +1157,7 @@ func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types. // LogoURL is the resolver for the logoUrl field. func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSession(nil)); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err } @@ -1310,7 +1310,7 @@ func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types // ViewerMembership is the resolver for the viewerMembership field. func (r *organizationResolver) ViewerMembership(ctx context.Context, obj *types.Organization) (*types.Membership, error) { - if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSession(nil)); err != nil { + if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil { return nil, err }