From c5355d172f2294af4dd172c2bba8f9d2b3418b35 Mon Sep 17 00:00:00 2001 From: Conrad Hoffmann Date: Tue, 25 Nov 2025 11:49:37 +0100 Subject: [PATCH] server: let AUTH_INTERNAL access @anoninternal Both methods enforce the internal aspect, but @anoninternal really just means the resolver does not require an "authenticated user" context, which means it's still perfectly safe if there is one. With this in place, any resolver that may have to be called from an anonymous context can be switched from @internal to @anoninternal without breaking existing users. Of course it can only be switched if it really does not require a user context. --- auth/middleware.go | 5 +++-- server/directives.go | 8 ++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/auth/middleware.go b/auth/middleware.go index b3f7c4832cddd4e8f757d1c5b947f3eb946b2484..e6afa7bea545800fba53741c3dbff57dc320ba81 100644 --- a/auth/middleware.go +++ b/auth/middleware.go @@ -279,8 +279,9 @@ func internalAuth(payload []byte, w http.ResponseWriter, r *http.Request, next h auth.AuthMethod = AUTH_INTERNAL } } else { - // Using anonymous internal auth. This is only used in one specific - // situation: registering for a new account. + // Using anonymous internal auth. This is used in situations where a + // user context can not (yet) be established: registering an account, + // looking up SSH keys, etc. auth = &AuthContext{} auth.AuthMethod = AUTH_ANON_INTERNAL } diff --git a/server/directives.go b/server/directives.go index 87fca799dfe2297676bdd7311693c8cf6471b720..acdc670146d3f5b331eb6904929b208d10dec3fc 100644 --- a/server/directives.go +++ b/server/directives.go @@ -22,11 +22,11 @@ func Admin(ctx context.Context, obj any, func AnonInternal(ctx context.Context, obj any, next graphql.Resolver) (any, error) { - if auth.ForContext(ctx).AuthMethod != auth.AUTH_ANON_INTERNAL { - return nil, fmt.Errorf("anonymous internal auth access denied") + switch auth.ForContext(ctx).AuthMethod { + case auth.AUTH_ANON_INTERNAL, auth.AUTH_INTERNAL: + return next(ctx) } - - return next(ctx) + return nil, fmt.Errorf("anonymous internal auth access denied") } func Internal(ctx context.Context, obj any,