~bigbes/core-go: server: let AUTH_INTERNAL access @anoninternal

c5355d172f2294af4dd172c2bba8f9d2b3418b35 — Conrad Hoffmann 8 months ago 50a876e

server: let AUTH_INTERNAL access @anoninternal

Both methods enforce the internal aspect, but @anoninternal really just
means the resolver does not require an "authenticated user" context,
which means it's still perfectly safe if there is one.

With this in place, any resolver that may have to be called from an
anonymous context can be switched from @internal to @anoninternal
without breaking existing users. Of course it can only be switched if it
really does not require a user context.

patch browse .tar.gz .zip

2 files changed, 7 insertions(+), 6 deletions(-)

M auth/middleware.go
M server/directives.go

M auth/middleware.go => auth/middleware.go +3 -2

@@ 279,8 279,9 @@ func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next h
 			auth.AuthMethod = AUTH_INTERNAL
 		}
 	} else {
-		// Using anonymous internal auth. This is only used in one specific
-		// situation: registering for a new account.
+		// Using anonymous internal auth. This is used in situations where a
+		// user context can not (yet) be established: registering an account,
+		// looking up SSH keys, etc.
 		auth = &AuthContext{}
 		auth.AuthMethod = AUTH_ANON_INTERNAL
 	}

M server/directives.go => server/directives.go +4 -4

@@ 22,11 22,11 @@ func Admin(ctx context.Context, obj any,
 func AnonInternal(ctx context.Context, obj any,
 	next graphql.Resolver) (any, error) {
 
-	if auth.ForContext(ctx).AuthMethod != auth.AUTH_ANON_INTERNAL {
-		return nil, fmt.Errorf("anonymous internal auth access denied")
+	switch auth.ForContext(ctx).AuthMethod {
+	case auth.AUTH_ANON_INTERNAL, auth.AUTH_INTERNAL:
+		return next(ctx)
 	}
-
-	return next(ctx)
+	return nil, fmt.Errorf("anonymous internal auth access denied")
 }
 
 func Internal(ctx context.Context, obj any,