88 lines
2.9 KiB
Go
88 lines
2.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/mlogger"
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/model"
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/mutil/mzap"
|
|
"go.mongodb.org/mongo-driver/v2/bson"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
type MembershipChecker interface {
|
|
IsMember(ctx context.Context, orgRef, callerRef bson.ObjectID) (bool, error)
|
|
}
|
|
|
|
type ScopedAuthorizer struct {
|
|
// Logger receives Debug/Warn messages from the enforcement path.
|
|
Logger mlogger.Logger
|
|
Membership MembershipChecker
|
|
Enforcer Enforcer
|
|
}
|
|
|
|
// NewScopedAuthorizer constructs a ScopedAuthorizer and validates required dependencies.
|
|
// Logger defaults to zap.NewNop() if nil.
|
|
func NewScopedAuthorizer(membership MembershipChecker, enforcer Enforcer, logger mlogger.Logger) *ScopedAuthorizer {
|
|
if membership == nil {
|
|
panic("auth.NewScopedAuthorizer: MembershipChecker must not be nil")
|
|
}
|
|
if enforcer == nil {
|
|
panic("auth.NewScopedAuthorizer: Enforcer must not be nil")
|
|
}
|
|
if logger == nil {
|
|
logger = zap.NewNop()
|
|
}
|
|
return &ScopedAuthorizer{
|
|
Logger: logger,
|
|
Membership: membership,
|
|
Enforcer: enforcer,
|
|
}
|
|
}
|
|
|
|
func (a *ScopedAuthorizer) Authorize(ctx context.Context, p ScopedAccessParams) error {
|
|
a.Logger.Debug("scoped access check started",
|
|
mzap.AccRef(p.CallerRef), mzap.ObjRef("object_ref", p.ObjectRef),
|
|
mzap.OrgRef(p.OrgRef), zap.String("action", string(p.Action)))
|
|
|
|
// Personal resources are guarded by ownership alone — membership is not consulted.
|
|
// Checking membership first would lock the owner out after org membership is revoked.
|
|
if p.OwnerKind == model.OwnerKindAccount {
|
|
err := enforceOwnershipAccess(ctx, a.Enforcer, p)
|
|
if err != nil && errors.Is(err, merrors.ErrAccessDenied) {
|
|
a.Logger.Debug("access denied: not the owner",
|
|
mzap.AccRef(p.CallerRef), mzap.ObjRef("object_ref", p.ObjectRef),
|
|
zap.String("action", string(p.Action)))
|
|
}
|
|
return err
|
|
}
|
|
|
|
ok, err := a.Membership.IsMember(ctx, p.OrgRef, p.CallerRef)
|
|
if err != nil {
|
|
a.Logger.Warn("membership check failed",
|
|
zap.Error(err), mzap.AccRef(p.CallerRef), mzap.OrgRef(p.OrgRef))
|
|
return err
|
|
}
|
|
if !ok {
|
|
a.Logger.Debug("access denied: caller is not a member of the organization",
|
|
mzap.AccRef(p.CallerRef), mzap.OrgRef(p.OrgRef), zap.String("action", string(p.Action)))
|
|
return merrors.AccessDenied(p.Service, string(p.Action), p.ObjectRef)
|
|
}
|
|
|
|
err = enforceOwnershipAccess(ctx, a.Enforcer, p)
|
|
if err != nil {
|
|
if errors.Is(err, merrors.ErrAccessDenied) {
|
|
a.Logger.Debug("access denied",
|
|
mzap.AccRef(p.CallerRef), mzap.ObjRef("object_ref", p.ObjectRef),
|
|
mzap.OrgRef(p.OrgRef), zap.String("action", string(p.Action)))
|
|
} else {
|
|
a.Logger.Warn("enforcer returned error during scoped access check",
|
|
zap.Error(err), mzap.AccRef(p.CallerRef), mzap.ObjRef("object_ref", p.ObjectRef),
|
|
zap.String("action", string(p.Action)))
|
|
}
|
|
}
|
|
return err
|
|
}
|