~bigbes/core-go: auth: grant scoped access to anon internal auth

bdf079e6a8893909e73c6183c0e8a066ab368e45 — Conrad Hoffmann 1 year, 8 months ago b57564a

auth: grant scoped access to anon internal auth

Internal auth is granted access to everything, whereas anonymous
internal auth is pretty restricted. This is mostly to avoid accidentally
hitting resolvers that require a logged-in user, however. Given that all
anon internal use cases are hard-coded and tested, this seems like a
pretty low risk. Allowing this will have the huge benefit of making much
more information available to anon internal queries, which will unlock
removing a bunch of awkward work-arounds we put in place.

Note, however, that this is also a work-around. It saves us from adding
yet more work-arounds to the GQL schema, and in the meantime a redesign
of the schema (especially the directives) is being worked on.

patch browse .tar.gz .zip

1 files changed, 1 insertions(+), 3 deletions(-)

M auth/middleware.go

M auth/middleware.go => auth/middleware.go +1 -3

@@ 87,7 87,7 @@ type AuthContext struct {
 
 func (authctx *AuthContext) Access(scope, kind string) error {
 	switch authctx.AuthMethod {
-	case AUTH_INTERNAL, AUTH_COOKIE:
+	case AUTH_INTERNAL, AUTH_ANON_INTERNAL, AUTH_COOKIE:
 		return nil
 	case AUTH_OAUTH_LEGACY:
 		if kind == RO {


@@ 106,8 106,6 @@ func (authctx *AuthContext) Access(scope, kind string) error {
 			return fmt.Errorf("Access denied, missing %v:%v grant", scope, kind)
 		}
 		return nil
-	case AUTH_ANON_INTERNAL:
-		return fmt.Errorf("Access denied for internal anonymous auth")
 	default:
 		panic(fmt.Errorf("Unknown auth method %q for access check", authctx.AuthMethod))
 	}