From f998a35357d47d99828a0838c9ef42cf5f963d22 Mon Sep 17 00:00:00 2001 From: Ludovic Vielle Date: Thu, 30 Jul 2026 17:17:58 +0200 Subject: [PATCH] Scope device enrollment token deletes Delete and DeleteExpired omitted Scoper, breaking the tenant-isolation pattern used elsewhere in coredata. Pass a tenant scope from ExchangeEnrollmentToken and NewNoScope from the ITAM GC so cross-tenant cleanup stays explicit. Signed-off-by: Ludovic Vielle --- pkg/coredata/device_enrollment_token.go | 18 +++++++++++++++--- pkg/itam/gc.go | 2 +- pkg/itam/service.go | 8 ++++---- 3 files changed, 20 insertions(+), 8 deletions(-) diff --git a/pkg/coredata/device_enrollment_token.go b/pkg/coredata/device_enrollment_token.go index c1eba6760..4b5346e6c 100644 --- a/pkg/coredata/device_enrollment_token.go +++ b/pkg/coredata/device_enrollment_token.go @@ -133,15 +133,22 @@ FOR UPDATE; func (t *DeviceEnrollmentToken) DeleteExpired( ctx context.Context, conn pg.Tx, + scope Scoper, now time.Time, ) (int64, error) { q := ` DELETE FROM device_enrollment_tokens WHERE - expires_at < @now + %s + AND expires_at < @now ` - result, err := conn.Exec(ctx, q, pgx.StrictNamedArgs{"now": now}) + q = fmt.Sprintf(q, scope.SQLFragment()) + + args := pgx.StrictNamedArgs{"now": now} + maps.Copy(args, scope.SQLArguments()) + + result, err := conn.Exec(ctx, q, args) if err != nil { return 0, fmt.Errorf("cannot delete expired device_enrollment_tokens: %w", err) } @@ -152,14 +159,19 @@ WHERE func (t *DeviceEnrollmentToken) Delete( ctx context.Context, conn pg.Tx, + scope Scoper, ) error { q := ` DELETE FROM device_enrollment_tokens WHERE - id = @id + %s + AND id = @id ` + q = fmt.Sprintf(q, scope.SQLFragment()) + args := pgx.StrictNamedArgs{"id": t.ID} + maps.Copy(args, scope.SQLArguments()) _, err := conn.Exec(ctx, q, args) if err != nil { diff --git a/pkg/itam/gc.go b/pkg/itam/gc.go index 8fdf94577..6c45d2db4 100644 --- a/pkg/itam/gc.go +++ b/pkg/itam/gc.go @@ -95,7 +95,7 @@ func (h *gcHandler) cleanup(ctx context.Context) error { func(ctx context.Context, tx pg.Tx) error { var token coredata.DeviceEnrollmentToken - tokensDeleted, err := token.DeleteExpired(ctx, tx, now) + tokensDeleted, err := token.DeleteExpired(ctx, tx, coredata.NewNoScope(), now) if err != nil { return fmt.Errorf("cannot delete expired device enrollment tokens: %w", err) } diff --git a/pkg/itam/service.go b/pkg/itam/service.go index e218bbcdc..aadcdcc38 100644 --- a/pkg/itam/service.go +++ b/pkg/itam/service.go @@ -324,16 +324,16 @@ func (s *Service) ExchangeEnrollmentToken( return fmt.Errorf("cannot load device enrollment token: %w", err) } + scope := coredata.NewScope(token.TenantID) + if now.After(token.ExpiresAt) { - if err := token.Delete(ctx, conn); err != nil { + if err := token.Delete(ctx, conn, scope); err != nil { return fmt.Errorf("cannot delete expired device enrollment token: %w", err) } return ErrEnrollmentTokenExpired } - scope := coredata.NewScope(token.TenantID) - device := &coredata.Device{} if err := device.LoadByIDForUpdate(ctx, conn, scope, token.DeviceID); err != nil { return fmt.Errorf("cannot load device: %w", err) @@ -361,7 +361,7 @@ func (s *Service) ExchangeEnrollmentToken( return fmt.Errorf("cannot set device api key hash: %w", err) } - if err := token.Delete(ctx, conn); err != nil { + if err := token.Delete(ctx, conn, scope); err != nil { return fmt.Errorf("cannot delete device enrollment token: %w", err) }