tech/sxchnge
1
0 Fork 0
Code Issues 6 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

Remove platform tenancy from SXCHNGE customer BFF (#34)

Browse Source
This commit is contained in:
Stephan D committed 2026-09-12 14:00:14 +02:00
1 parent 7062672a87
commit 981e84a4b4
244 files changed
+651 -17130
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/pkg/mutil/db/auth/accountbound.go
-89
View File
@@ -1,89 +0,0 @@
// Package mutil provides utility functions for working with account-bound objects
// with permission enforcement.
//
// Example usage:
//
// // Using the low-level repository approach
// objects, err := mutil.GetAccountBoundObjects[model.ProjectFilter](
// ctx, logger, accountRef, orgRef, model.ActionRead,
// repository.Query(), &model.ViewCursor{Limit: &limit, Offset: &offset, IsArchived: &isArchived},
// enforcer, repo)
//
// // Using the AccountBoundDB interface approach
// objects, err := mutil.GetAccountBoundObjectsFromDB[model.ProjectFilter](
// ctx, logger, accountRef, orgRef,
// repository.Query(), &model.ViewCursor{Limit: &limit, Offset: &offset, IsArchived: &isArchived},
// accountBoundDB)
package mutil
import (
"context"
"errors"
"git.sendico.io/tech/sxchnge/bff/pkg/auth"
"git.sendico.io/tech/sxchnge/bff/pkg/db/repository"
"git.sendico.io/tech/sxchnge/bff/pkg/db/repository/builder"
"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
"git.sendico.io/tech/sxchnge/bff/pkg/mlogger"
"git.sendico.io/tech/sxchnge/bff/pkg/model"
mutil "git.sendico.io/tech/sxchnge/bff/pkg/mutil/db"
"git.sendico.io/tech/sxchnge/bff/pkg/mutil/mzap"
"go.mongodb.org/mongo-driver/v2/bson"
"go.uber.org/zap"
)
// GetAccountBoundObjects retrieves account-bound objects with permission enforcement.
// This function handles the complex logic of:
// 1. Finding objects where accountRef matches OR is null/absent
// 2. Checking organization-level permissions for each object
// 3. Filtering to only objects the account has permission to read
func GetAccountBoundObjects[T any](
ctx context.Context,
logger mlogger.Logger,
accountRef, organizationRef bson.ObjectID,
filter builder.Query,
cursor *model.ViewCursor,
enforcer auth.Enforcer,
repo repository.Repository,
) ([]T, error) {
// Build query to find objects where accountRef matches OR is null/absent
accountQuery := repository.WithOrg(accountRef, organizationRef)
// Get all account-bound objects that match the criteria
allObjects, err := repo.ListAccountBound(ctx, repository.ApplyCursor(accountQuery, cursor))
if err != nil {
if !errors.Is(err, merrors.ErrNoData) {
logger.Warn("Failed to fetch account bound objects", zap.Error(err),
mzap.AccRef(accountRef),
mzap.OrgRef(organizationRef),
)
} else {
logger.Debug("No matching account bound objects found", zap.Error(err),
mzap.AccRef(accountRef),
mzap.OrgRef(organizationRef),
)
}
return nil, err
}
if len(allObjects) == 0 {
return nil, merrors.NoData("no_account_bound_objects_found")
}
allowed := make([]bson.ObjectID, 0, len(allObjects))
for _, ref := range allObjects {
allowed = append(allowed, *ref.GetID())
}
if len(allowed) == 0 {
return nil, merrors.NoData("no_data_found_or_allowed")
}
logger.Debug("Successfully retrieved account bound objects",
zap.Int("total_count", len(allObjects)),
mzap.AccRef(accountRef),
mzap.OrgRef(organizationRef),
zap.Any("objs", allObjects),
)
return mutil.GetObjects[T](ctx, logger, repository.Query().In(repository.IDField(), allowed), cursor, repo)
}
backend/pkg/mutil/db/auth/protected.go
-58
View File
@@ -1,58 +0,0 @@
package mutil
import (
"context"
"errors"
"git.sendico.io/tech/sxchnge/bff/pkg/auth"
"git.sendico.io/tech/sxchnge/bff/pkg/db/repository"
"git.sendico.io/tech/sxchnge/bff/pkg/db/repository/builder"
"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
"git.sendico.io/tech/sxchnge/bff/pkg/mlogger"
"git.sendico.io/tech/sxchnge/bff/pkg/model"
mutil "git.sendico.io/tech/sxchnge/bff/pkg/mutil/db"
"git.sendico.io/tech/sxchnge/bff/pkg/mutil/mzap"
"go.mongodb.org/mongo-driver/v2/bson"
"go.uber.org/zap"
)
func GetProtectedObjects[T any](
ctx context.Context,
logger mlogger.Logger,
accountRef, organizationRef bson.ObjectID,
action model.Action,
filter builder.Query,
cursor *model.ViewCursor,
enforcer auth.Enforcer,
repo repository.Repository,
) ([]T, error) {
refs, err := repo.ListPermissionBound(ctx, repository.ApplyCursor(filter, cursor))
if err != nil {
if !errors.Is(err, merrors.ErrNoData) {
logger.Warn("Failed to fetch object IDs", zap.Error(err), mzap.AccRef(accountRef),
mzap.OrgRef(organizationRef), zap.String("action", string(action)))
} else {
logger.Debug("No matching IDs found", zap.Error(err), mzap.AccRef(accountRef),
mzap.OrgRef(organizationRef), zap.String("action", string(action)))
}
return nil, err
}
res, err := enforcer.EnforceBatch(ctx, refs, accountRef, action)
if err != nil {
logger.Warn("Failed to enforce object IDs", zap.Error(err), mzap.AccRef(accountRef),
mzap.OrgRef(organizationRef), zap.String("action", string(action)))
return nil, err
}
allowed := make([]bson.ObjectID, 0, len(res))
for _, ref := range refs {
if ok := res[*ref.GetID()]; ok {
allowed = append(allowed, *ref.GetID())
}
}
if len(allowed) == 0 {
return nil, merrors.NoData("no_data_found_or_allowed")
}
return mutil.GetObjects[T](ctx, logger, repository.Query().In(repository.IDField(), allowed), cursor, repo)
}
backend/pkg/mutil/mzap/object.go
-13
View File
@@ -2,7 +2,6 @@ package mzap
import (
"git.sendico.io/tech/sxchnge/bff/pkg/db/storable"
"git.sendico.io/tech/sxchnge/bff/pkg/model"
"go.mongodb.org/mongo-driver/v2/bson"
"go.uber.org/zap"
)
@@ -14,15 +13,3 @@ func ObjRef(name string, objRef bson.ObjectID) zap.Field {
func StorableRef(obj storable.Storable) zap.Field {
return ObjRef(obj.Collection()+"_ref", *obj.GetID())
}
func OrgRef(orgRef bson.ObjectID) zap.Field {
return ObjRef("organization_ref", orgRef)
}
func OrganizationRef(obj model.OrganizationBound) zap.Field {
return OrgRef(obj.GetOrganizationRef())
}
func PermissionRef(permissionRef bson.ObjectID) zap.Field {
return ObjRef("permission_ref", permissionRef)
}