Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

backend/pkg/auth/patchguard.go

@@ -0,0 +1,30 @@
+package auth
+
+import (
+	"strings"
+
+	"git.sendico.io/tech/sxchnge/bff/pkg/db/repository/builder"
+	"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// denyImmutablePatch returns ErrInvalidArg if patch touches any field whose
+// mutation would silently undermine future access decisions.
+func denyImmutablePatch(patch builder.Patch) error {
+	if patch == nil {
+		return nil
+	}
+	for _, op := range patch.Build() {
+		fields, ok := op.Value.(bson.D)
+		if !ok {
+			continue
+		}
+		for _, f := range fields {
+			if f.Key == "owner" || strings.HasPrefix(f.Key, "owner.") ||
+				f.Key == "organizationRef" || f.Key == "permissionRef" {
+				return merrors.InvalidArgumentf("patch field %q is immutable", f.Key)
+			}
+		}
+	}
+	return nil
+}