4 files changed, 12 insertions(+), 5 deletions(-)

M auth/bearer.go
M auth/middleware.go
M go.sum
M valid/valid.go

@@ 86,9 86,11 @@ const (
 )
 
 type Grants struct {
-	all     bool
-	grants  map[string]string
-	encoded string
+	ReadOnly bool
+
+	all      bool
+	grants   map[string]string
+	encoded  string
 }
 
 func DecodeGrants(ctx context.Context, grants string) Grants {


@@ 134,6 136,9 @@ func (g *Grants) Has(grant string, mode string) bool {
 	if mode != RO && mode != RW {
 		panic("Invalid access mode")
 	}
+	if g.ReadOnly && mode == RW {
+		return false
+	}
 
 	if g.all {
 		return true

@@ 667,6 667,7 @@ func WebhookAuth(ctx context.Context, auth *AuthContext,
 	whAuth.AuthMethod = AUTH_WEBHOOK
 	whAuth.TokenHash = tokenHash
 	whAuth.Grants = DecodeGrants(ctx, grants)
+	whAuth.Grants.ReadOnly = true
 	whAuth.BearerToken = &BearerToken{}
 	if clientID != nil {
 		whAuth.BearerToken.ClientID = *clientID

@@ 629,6 629,7 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4-0.20201021145329-22f1617af38e h1:0kyKOEC0chG7FKmnf/1uNwvDLc3NtNTRip2rXAN9nwI=
 golang.org/x/text v0.3.4-0.20201021145329-22f1617af38e/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

@@ 60,7 60,7 @@ func (valid *Validation) Error(msg string,
 	items ...interface{}) *ValidationError {
 	err := &gqlerror.Error{
 		Path:    graphql.GetPath(valid.ctx),
-		Message: fmt.Sprintf(msg, items),
+		Message: fmt.Sprintf(msg, items...),
 	}
 	graphql.AddError(valid.ctx, err)
 	return &ValidationError{


@@ 76,7 76,7 @@ func (valid *Validation) Expect(cond bool,
 	if cond {
 		return &ValidationError{valid: valid}
 	}
-	return valid.Error(msg, items)
+	return valid.Error(msg, items...)
 }
 
 // Associates a field name with an error.