From bdf079e6a8893909e73c6183c0e8a066ab368e45 Mon Sep 17 00:00:00 2001 From: Conrad Hoffmann Date: Thu, 21 Nov 2024 14:28:58 +0100 Subject: [PATCH] auth: grant scoped access to anon internal auth Internal auth is granted access to everything, whereas anonymous internal auth is pretty restricted. This is mostly to avoid accidentally hitting resolvers that require a logged-in user, however. Given that all anon internal use cases are hard-coded and tested, this seems like a pretty low risk. Allowing this will have the huge benefit of making much more information available to anon internal queries, which will unlock removing a bunch of awkward work-arounds we put in place. Note, however, that this is also a work-around. It saves us from adding yet more work-arounds to the GQL schema, and in the meantime a redesign of the schema (especially the directives) is being worked on. --- auth/middleware.go | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/auth/middleware.go b/auth/middleware.go index 9def293e462b1b55a7dc7369a327a49763f8ebab..4f1de80b46c95e43984c631c2a38d6dab89da36a 100644 --- a/auth/middleware.go +++ b/auth/middleware.go @@ -87,7 +87,7 @@ type AuthContext struct { func (authctx *AuthContext) Access(scope, kind string) error { switch authctx.AuthMethod { - case AUTH_INTERNAL, AUTH_COOKIE: + case AUTH_INTERNAL, AUTH_ANON_INTERNAL, AUTH_COOKIE: return nil case AUTH_OAUTH_LEGACY: if kind == RO { @@ -106,8 +106,6 @@ func (authctx *AuthContext) Access(scope, kind string) error { return fmt.Errorf("Access denied, missing %v:%v grant", scope, kind) } return nil - case AUTH_ANON_INTERNAL: - return fmt.Errorf("Access denied for internal anonymous auth") default: panic(fmt.Errorf("Unknown auth method %q for access check", authctx.AuthMethod)) }