rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Scope device enrollment token deletes

Browse Source 
Delete and DeleteExpired omitted Scoper, breaking the
tenant-isolation pattern used elsewhere in coredata. Pass a
tenant scope from ExchangeEnrollmentToken and NewNoScope from
the ITAM GC so cross-tenant cleanup stays explicit.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-07-30 17:17:58 +02:00
parent a26a4ad898
commit f998a35357
3 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/itam/gc.go
View File

@@ -95,7 +95,7 @@ func (h *gcHandler) cleanup(ctx context.Context) error {
func(ctx context.Context, tx pg.Tx) error {
var token coredata.DeviceEnrollmentToken
tokensDeleted, err := token.DeleteExpired(ctx, tx, now)
tokensDeleted, err := token.DeleteExpired(ctx, tx, coredata.NewNoScope(), now)
if err != nil {
return fmt.Errorf("cannot delete expired device enrollment tokens: %w", err)
}

8
pkg/itam/service.go
View File

@@ -324,16 +324,16 @@ func (s *Service) ExchangeEnrollmentToken(
return fmt.Errorf("cannot load device enrollment token: %w", err)
}
scope := coredata.NewScope(token.TenantID)
if now.After(token.ExpiresAt) {
if err := token.Delete(ctx, conn); err != nil {
if err := token.Delete(ctx, conn, scope); err != nil {
return fmt.Errorf("cannot delete expired device enrollment token: %w", err)
}
return ErrEnrollmentTokenExpired
}
scope := coredata.NewScope(token.TenantID)
device := &coredata.Device{}
if err := device.LoadByIDForUpdate(ctx, conn, scope, token.DeviceID); err != nil {
return fmt.Errorf("cannot load device: %w", err)
@@ -361,7 +361,7 @@ func (s *Service) ExchangeEnrollmentToken(
return fmt.Errorf("cannot set device api key hash: %w", err)
}
if err := token.Delete(ctx, conn); err != nil {
if err := token.Delete(ctx, conn, scope); err != nil {
return fmt.Errorf("cannot delete device enrollment token: %w", err)
}