From a17e5a58b203fbc6d4487bd2ec7f1dac723ab98d Mon Sep 17 00:00:00 2001 From: Pascal Fischer Date: Fri, 6 Jun 2025 19:01:20 +0200 Subject: [PATCH] proper permission validate wrapper --- internals/shared/permissions/manager.go | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/internals/shared/permissions/manager.go b/internals/shared/permissions/manager.go index 2b5e177..8a43956 100644 --- a/internals/shared/permissions/manager.go +++ b/internals/shared/permissions/manager.go @@ -116,36 +116,32 @@ type PermissionValidator interface { } // WithPermission wraps an HTTP handler with permission checking logic. -func WithPermission( +func (m *managerImpl) WithPermission( module modules.Module, operation operations.Operation, - authExtractor UserAuthExtractor, - validator PermissionValidator, handlerFunc func(w http.ResponseWriter, r *http.Request, auth *nbcontext.UserAuth), ) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { - ctx := r.Context() - - userAuth, err := authExtractor(ctx) + userAuth, err := nbcontext.GetUserAuthFromContext(r.Context()) if err != nil { - log.WithContext(ctx).Errorf("failed to get user auth from context: %v", err) - util.WriteError(ctx, err, w) + log.WithContext(r.Context()).Errorf("failed to get user auth from context: %v", err) + util.WriteError(r.Context(), err, w) return } - allowed, err := validator.ValidateUserPermissions(ctx, userAuth.AccountId, userAuth.UserId, module, operation) + allowed, err := m.ValidateUserPermissions(r.Context(), userAuth.AccountId, userAuth.UserId, module, operation) if err != nil { - log.WithContext(ctx).Errorf("failed to validate permissions for user %s on account %s: %v", userAuth.UserId, userAuth.AccountId, err) - util.WriteError(ctx, status.NewPermissionValidationError(err), w) + log.WithContext(r.Context()).Errorf("failed to validate permissions for user %s on account %s: %v", userAuth.UserId, userAuth.AccountId, err) + util.WriteError(r.Context(), status.NewPermissionValidationError(err), w) return } if !allowed { - log.WithContext(ctx).Tracef("user %s on account %s is not allowed to %s in %s", userAuth.UserId, userAuth.AccountId, operation, module) - util.WriteError(ctx, status.NewPermissionDeniedError(), w) + log.WithContext(r.Context()).Tracef("user %s on account %s is not allowed to %s in %s", userAuth.UserId, userAuth.AccountId, operation, module) + util.WriteError(r.Context(), status.NewPermissionDeniedError(), w) return } - handlerFunc(w, r, userAuth) + handlerFunc(w, r, &userAuth) } }