31 lines
763 B
Go
31 lines
763 B
Go
package auth
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/db/repository/builder"
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
|
|
"go.mongodb.org/mongo-driver/v2/bson"
|
|
)
|
|
|
|
// denyImmutablePatch returns ErrInvalidArg if patch touches any field whose
|
|
// mutation would silently undermine future access decisions.
|
|
func denyImmutablePatch(patch builder.Patch) error {
|
|
if patch == nil {
|
|
return nil
|
|
}
|
|
for _, op := range patch.Build() {
|
|
fields, ok := op.Value.(bson.D)
|
|
if !ok {
|
|
continue
|
|
}
|
|
for _, f := range fields {
|
|
if f.Key == "owner" || strings.HasPrefix(f.Key, "owner.") ||
|
|
f.Key == "organizationRef" || f.Key == "permissionRef" {
|
|
return merrors.InvalidArgumentf("patch field %q is immutable", f.Key)
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
}
|