5e9ff656d3
Resolving a typical Console GraphQL query triggers many parallel authorize calls (one per resource per field resolver). This commit collapses them via a dataloader: parallel calls within the same request are gathered into a single iam.Authorizer.AuthorizeMulti pass, and only fall back to per-item Authorize when AuthorizeMulti rejects the whole batch (e.g. mixed organizations). The loader key encodes resource id, action, options, and a canonical JSON-encoded attribute map so logically identical calls share a key while differing ones do not. The loader is created without caching so repeated calls within a request still produce one audit log entry per call. dataloader.NewAuthorizeFunc preserves the existing authz.AuthorizeFunc signature and error mapping. Signed-off-by: Bryan Frimin <bryan@probo.com>
72 lines
2.4 KiB
Go
72 lines
2.4 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package console_v1
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"go.gearno.de/kit/log"
|
|
"go.probo.inc/probo/pkg/accessreview"
|
|
"go.probo.inc/probo/pkg/connector"
|
|
"go.probo.inc/probo/pkg/cookiebanner"
|
|
"go.probo.inc/probo/pkg/esign"
|
|
"go.probo.inc/probo/pkg/iam"
|
|
"go.probo.inc/probo/pkg/mailman"
|
|
"go.probo.inc/probo/pkg/probo"
|
|
"go.probo.inc/probo/pkg/riskmanagement"
|
|
"go.probo.inc/probo/pkg/server/api/authz"
|
|
"go.probo.inc/probo/pkg/server/api/console/v1/dataloader"
|
|
"go.probo.inc/probo/pkg/server/api/console/v1/schema"
|
|
"go.probo.inc/probo/pkg/server/gqlutils"
|
|
"go.probo.inc/probo/pkg/thirdparty"
|
|
)
|
|
|
|
func NewGraphQLHandler(
|
|
iamSvc *iam.Service,
|
|
proboSvc *probo.Service,
|
|
esignSvc *esign.Service,
|
|
accessReviewSvc *accessreview.Service,
|
|
mailmanSvc *mailman.Service,
|
|
cookieBannerSvc *cookiebanner.Service,
|
|
connectorRegistry *connector.ConnectorRegistry,
|
|
customDomainCname string,
|
|
logger *log.Logger,
|
|
thirdPartySvc *thirdparty.Service,
|
|
riskManagementSvc *riskmanagement.Service,
|
|
) http.Handler {
|
|
config := schema.Config{
|
|
Resolvers: &Resolver{
|
|
authorize: dataloader.NewAuthorizeFunc(logger),
|
|
batchAuthorize: authz.NewBatchAuthorizeFunc(iamSvc, logger),
|
|
probo: proboSvc,
|
|
iam: iamSvc,
|
|
esign: esignSvc,
|
|
accessReview: accessReviewSvc,
|
|
mailman: mailmanSvc,
|
|
cookieBanner: cookieBannerSvc,
|
|
connectorRegistry: connectorRegistry,
|
|
riskManagement: riskManagementSvc,
|
|
thirdParty: thirdPartySvc,
|
|
customDomainCname: customDomainCname,
|
|
logger: logger,
|
|
},
|
|
}
|
|
|
|
es := schema.NewExecutableSchema(config)
|
|
gqlh := gqlutils.NewHandler(es, logger)
|
|
|
|
return gqlh
|
|
}
|