From ae61e2431576d08e3878fd1cc9d8e449314c96b1 Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Wed, 25 Aug 2021 11:47:45 +0200
Subject: [PATCH] auth: force webhooks to read-only

---
 auth/bearer.go     | 11 ++++++++---
 auth/middleware.go |  1 +
 go.sum             |  1 +
 valid/valid.go     |  4 ++--
 4 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/auth/bearer.go b/auth/bearer.go
index 5cb0b6d04f3ec77031e4859cf87ec3047bfddbe7..27773fac4ae2a6059d4c3903d362fd4130a29210 100644
--- a/auth/bearer.go
+++ b/auth/bearer.go
@@ -86,9 +86,11 @@ const (
 )
 
 type Grants struct {
-	all     bool
-	grants  map[string]string
-	encoded string
+	ReadOnly bool
+
+	all      bool
+	grants   map[string]string
+	encoded  string
 }
 
 func DecodeGrants(ctx context.Context, grants string) Grants {
@@ -134,6 +136,9 @@ func (g *Grants) Has(grant string, mode string) bool {
 	if mode != RO && mode != RW {
 		panic("Invalid access mode")
 	}
+	if g.ReadOnly && mode == RW {
+		return false
+	}
 
 	if g.all {
 		return true
diff --git a/auth/middleware.go b/auth/middleware.go
index b794aaaed768e04c073b35d69986989910ab3499..63a477ef6846331ce169dfa32bd9c1129c34e270 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -667,6 +667,7 @@ func WebhookAuth(ctx context.Context, auth *AuthContext,
 	whAuth.AuthMethod = AUTH_WEBHOOK
 	whAuth.TokenHash = tokenHash
 	whAuth.Grants = DecodeGrants(ctx, grants)
+	whAuth.Grants.ReadOnly = true
 	whAuth.BearerToken = &BearerToken{}
 	if clientID != nil {
 		whAuth.BearerToken.ClientID = *clientID
diff --git a/go.sum b/go.sum
index 6834d28304f553647d1cd5d9acb775722bea6bcb..38d5e7d5db84c8095d4a09a9bcc2e7046f4348b8 100644
--- a/go.sum
+++ b/go.sum
@@ -629,6 +629,7 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4-0.20201021145329-22f1617af38e h1:0kyKOEC0chG7FKmnf/1uNwvDLc3NtNTRip2rXAN9nwI=
 golang.org/x/text v0.3.4-0.20201021145329-22f1617af38e/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
diff --git a/valid/valid.go b/valid/valid.go
index 66383d6a53cfed3cf26399475e1890662d59729e..991cd77fd90ff7d72cc1174e91eb7cc8af51fe8d 100644
--- a/valid/valid.go
+++ b/valid/valid.go
@@ -60,7 +60,7 @@ func (valid *Validation) Error(msg string,
 	items ...interface{}) *ValidationError {
 	err := &gqlerror.Error{
 		Path:    graphql.GetPath(valid.ctx),
-		Message: fmt.Sprintf(msg, items),
+		Message: fmt.Sprintf(msg, items...),
 	}
 	graphql.AddError(valid.ctx, err)
 	return &ValidationError{
@@ -76,7 +76,7 @@ func (valid *Validation) Expect(cond bool,
 	if cond {
 		return &ValidationError{valid: valid}
 	}
-	return valid.Error(msg, items)
+	return valid.Error(msg, items...)
 }
 
 // Associates a field name with an error.