Check owner permissions in resolvers (#291)

* check permissions against ownerID, rather than resource Signed-off-by: Matt Siwiec <[email protected]> * establish permissions auth-relationship in ports Signed-off-by: Matt Siwiec <[email protected]> --------- Signed-off-by: Matt Siwiec <[email protected]>
infratographer · Dec 18, 2023 · 6bb9a56 · 6bb9a56
1 parent 627379f
commit 6bb9a56
Show file tree

Hide file tree

Showing 6 changed files with 47 additions and 34 deletions.
diff --git a/internal/ent/schema/port.go b/internal/ent/schema/port.go
@@ -58,6 +58,7 @@ func (Port) Fields() []ent.Field {
 			Annotations(
 				entgql.Type("ID"),
 				entgql.Skip(entgql.SkipWhereInput, entgql.SkipMutationUpdateInput),
+				pubsubinfo.EventsHookAdditionalSubject("loadbalancer"),
 			),
 	}
 }

diff --git a/internal/graphapi/loadbalancer.resolvers.go b/internal/graphapi/loadbalancer.resolvers.go
diff --git a/internal/graphapi/origin.resolvers.go b/internal/graphapi/origin.resolvers.go
diff --git a/internal/graphapi/pool.resolvers.go b/internal/graphapi/pool.resolvers.go
diff --git a/internal/graphapi/port.resolvers.go b/internal/graphapi/port.resolvers.go
diff --git a/internal/manualhooks/hooks.go b/internal/manualhooks/hooks.go
@@ -1002,6 +1002,11 @@ func PortHooks() []ent.Hook {
 						})
 					}
 
+					relationships = append(relationships, events.AuthRelationshipRelation{
+						Relation:  "loadbalancer",
+						SubjectID: load_balancer_id,
+					})
+
 					msg := events.ChangeMessage{
 						EventType:            eventType(m.Op()),
 						SubjectID:            objID,
@@ -1089,6 +1094,11 @@ func PortHooks() []ent.Hook {
 					additionalSubjects = append(additionalSubjects, dbObj.Edges.LoadBalancer.OwnerID)
 					additionalSubjects = append(additionalSubjects, dbObj.Edges.LoadBalancer.ProviderID)
 
+					relationships = append(relationships, events.AuthRelationshipRelation{
+						Relation:  "loadbalancer",
+						SubjectID: dbObj.LoadBalancerID,
+					})
+
 					// we have all the info we need, now complete the mutation before we process the event
 					retValue, err := next.Mutate(ctx, m)
 					if err != nil {