rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename authz.WithSesion to authz.WithSkipAssumptionCheck since we only used it with a nil arg

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-16 09:41:08 +04:00
committed by Bryan Frimin
parent 5beceb58d2
commit ca4ae96f31
3 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/iam/authorizer.go
View File

@@ -87,6 +87,7 @@ func (a *Authorizer) authorize(ctx context.Context, conn pg.Conn, params Authori
} }
membership := findMembershipForOrg(memberships, resourceOrgID) membership := findMembershipForOrg(memberships, resourceOrgID)
// Check whether the viewer is currently assuming the org of the accessed resource
if membership != nil && params.Session != nil { if membership != nil && params.Session != nil {
if _, err := a.getActiveChildSessionForMembership( if _, err := a.getActiveChildSessionForMembership(
ctx, ctx,

6
pkg/server/api/authz/authorization.go
View File

@@ -36,9 +36,11 @@ func WithAttr(key, value string) AuthorizeFuncOption {
} }
} }
func WithSession(sessionID *gid.GID) AuthorizeFuncOption { // Use this option when it makes no sense to check whether the viewer is assuming the org of the accessed resource
// Example: on the viewer memberships page, we're accessing several organization names, but the viewer isn't assuming one yet.
func WithSkipAssumptionCheck() AuthorizeFuncOption {
return func(params *iam.AuthorizeParams) { return func(params *iam.AuthorizeParams) {
params.Session = sessionID params.Session = nil
} }
} }

8
pkg/server/api/connect/v1/v1_resolver.go
View File

@@ -272,7 +272,7 @@ func (r *membershipResolver) Profile(ctx context.Context, obj *types.Membership)
// Organization is the resolver for the organization field. // Organization is the resolver for the organization field.
func (r *membershipResolver) Organization(ctx context.Context, obj *types.Membership) (*types.Organization, error) { func (r *membershipResolver) Organization(ctx context.Context, obj *types.Membership) (*types.Organization, error) {
if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSession(nil)); err != nil { if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err return nil, err
} }
@@ -293,7 +293,7 @@ func (r *membershipResolver) Organization(ctx context.Context, obj *types.Member
// LastSession is the resolver for the lastSession field. // LastSession is the resolver for the lastSession field.
func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error) { func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSession(nil)); err != nil { if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err return nil, err
} }
@@ -1157,7 +1157,7 @@ func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types.
// LogoURL is the resolver for the logoUrl field. // LogoURL is the resolver for the logoUrl field.
func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) { func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSession(nil)); err != nil { if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err return nil, err
} }
@@ -1310,7 +1310,7 @@ func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types
// ViewerMembership is the resolver for the viewerMembership field. // ViewerMembership is the resolver for the viewerMembership field.
func (r *organizationResolver) ViewerMembership(ctx context.Context, obj *types.Organization) (*types.Membership, error) { func (r *organizationResolver) ViewerMembership(ctx context.Context, obj *types.Organization) (*types.Membership, error) {
if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSession(nil)); err != nil { if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
return nil, err return nil, err
} }