rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce owner-only member removal and ownership grants via policy

Browse Source 
An organization ADMIN could hard-remove members, including OWNERs, because
removeUser (connect and MCP) only checked the weaker iam:membership-profile:delete
gate. Authorize the owner-only iam:membership:delete instead, and expose the
source attribute on MembershipProfile so the owner grant's non-SCIM condition
can match.

Consolidate ownership-grant authorization into policy for both createUser and
updateMembership: each resolver passes the requested role as a target_role
attribute and ADMIN is denied granting ownership via deny-create-owner /
deny-promote-owner. target_role is distinct from resource.role, which is the
target's current role and guards editing existing owners. With no callers left,
the iam:membership-role:set-owner action (grant and OAuth2 scope) is removed.

Also pass the authorized scope through to the RemoveUser/CreateUser services,
gate the console Remove action on iam:membership:delete, and add regression
tests plus a changelog entry.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>
This commit is contained in:
Sacha Al Himdani
2026-07-06 16:21:51 +02:00
parent ddfabc5940
commit ff9cb881e8
13 changed files with 133 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/server/api/connect/v1/membership_resolvers.go
View File

@@ -10,7 +10,6 @@ import (
"errors"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/authz"
@@ -51,16 +50,15 @@ func (r *membershipResolver) Permission(ctx context.Context, obj *types.Membersh
// UpdateMembership is the resolver for the updateMembership field.
func (r *mutationResolver) UpdateMembership(ctx context.Context, input types.UpdateMembershipInput) (*types.UpdateMembershipPayload, error) {
if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil {
if _, err := r.authorize(
ctx,
input.MembershipID,
iam.ActionMembershipUpdate,
authz.WithAttr("target_role", input.Role.String()),
); err != nil {
return nil, err
}
if input.Role == coredata.MembershipRoleOwner {
if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil {
return nil, err
}
}
membership, err := r.iam.OrganizationService.UpdateMembership(ctx, input.OrganizationID, input.MembershipID, input.Role)
if err != nil {
if _, ok := errors.AsType[*iam.ErrLastActiveOwner](err); ok {

20
pkg/server/api/connect/v1/profile_resolvers.go
View File

@@ -22,18 +22,19 @@ import (
// CreateUser is the resolver for the createUser field.
func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUserInput) (*types.CreateUserPayload, error) {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil {
scope, err := r.authorize(
ctx,
input.OrganizationID,
iam.ActionMembershipProfileCreate,
authz.WithAttr("target_role", input.Role.String()),
)
if err != nil {
return nil, err
}
if input.Role == coredata.MembershipRoleOwner {
if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipRoleSetOwner); err != nil {
return nil, err
}
}
profile, err := r.iam.OrganizationService.CreateUser(
ctx,
scope,
&iam.CreateUserRequest{
OrganizationID: input.OrganizationID,
EmailAddress: input.EmailAddress,
@@ -137,11 +138,12 @@ func (r *mutationResolver) ArchiveUser(ctx context.Context, input types.ArchiveU
// RemoveUser is the resolver for the removeUser field.
func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUserInput) (*types.RemoveUserPayload, error) {
if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil {
scope, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipDelete)
if err != nil {
return nil, err
}
err := r.iam.OrganizationService.RemoveUser(ctx, input.OrganizationID, input.ProfileID)
err = r.iam.OrganizationService.RemoveUser(ctx, scope, input.OrganizationID, input.ProfileID)
if err != nil {
if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok {
return nil, gqlutils.Conflictf(ctx, "user is managed by SCIM and cannot be removed")