TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-12-07 06:52:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: permission check for actions v1 post creation user grants (#10638)

Browse Source 
# Which Problems Are Solved

Unnecessary default permission check in creating an authorization fails
even if the functionality was called internally.

# How the Problems Are Solved

Move permission check to the proper implementation, so that necessary
permission checks are provided by the responsible API.

# Additional Changes

None

# Additional Context

Closes #10624

Co-authored-by: Livio Spring <livio.a@gmail.com>
(cherry picked from commit bdefd9147f)
This commit is contained in:
Stefan Benz
2025-09-03 16:39:18 +02:00
committed by Livio Spring
parent d5066237f9
commit 2dba5fa7fc
4 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
internal/api/grpc/management/auth_checks.go
View File

@@ -4,22 +4,27 @@ import (
"context"
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/command"
"github.com/zitadel/zitadel/internal/zerrors"
)
func checkExplicitProjectPermission(ctx context.Context, grantID, projectID string) error {
func checkExplicitProjectPermission(ctx context.Context) command.UserGrantPermissionCheck {
permissions := authz.GetRequestPermissionsFromCtx(ctx)
if authz.HasGlobalPermission(permissions) {
return nil
}
ids := authz.GetAllPermissionCtxIDs(permissions)
if grantID != "" && listContainsID(ids, grantID) {
return nil
return func(projectID, grantID string) command.PermissionCheck {
return func(resourceOwner, aggregateID string) error {
if grantID != "" && listContainsID(ids, grantID) {
return nil
}
if listContainsID(ids, projectID) {
return nil
}
return zerrors.ThrowPermissionDenied(nil, "EVENT-Shu7e", "Errors.UserGrant.NoPermissionForProject")
}
}
if listContainsID(ids, projectID) {
return nil
}
return zerrors.ThrowPermissionDenied(nil, "EVENT-Shu7e", "Errors.UserGrant.NoPermissionForProject")
}
func listContainsID(ids []string, id string) bool {