go/golang-saas-starter-kit
1
0
Fork 0
mirror of https://github.com/raseels-repos/golang-saas-starter-kit.git synced 2025-08-08 22:36:41 +02:00
Code Issues Releases Activity

issue#7 fix applyClaimsSelect when empty conditions

Browse Source 
When audience and subject are both empty, don't apply a subquery
This commit is contained in:
Lee Brown
2019-07-15 16:05:02 -08:00
parent 4867b207f2
commit 72ef940eb1
4 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/account/account.go
View File

@ -143,10 +143,12 @@ func applyClaimsSelect(ctx context.Context, claims auth.Claims, query *sqlbuilde
if claims.Subject != "" { if claims.Subject != "" {
or = append(or, subQuery.Equal("user_id", claims.Subject)) or = append(or, subQuery.Equal("user_id", claims.Subject))
} }
subQuery.Where(subQuery.Or(or...))
// Append sub query // Append sub query
if len(or) > 0 {
subQuery.Where(subQuery.Or(or...))
query.Where(query.In("id", subQuery)) query.Where(query.In("id", subQuery))
}
return nil return nil
} }

2
internal/project/project.go
View File

@ -95,9 +95,7 @@ func CanModifyProject(ctx context.Context, claims auth.Claims, dbConn *sqlx.DB,
// applyClaimsSelect applies a sub-query to the provided query to enforce ACL based on the claims provided. // applyClaimsSelect applies a sub-query to the provided query to enforce ACL based on the claims provided.
// 1. No claims, request is internal, no ACL applied // 1. No claims, request is internal, no ACL applied
// 2. All role types can access their user ID // 2. All role types can access their user ID
func applyClaimsSelect(ctx context.Context, claims auth.Claims, query *sqlbuilder.SelectBuilder) error { func applyClaimsSelect(ctx context.Context, claims auth.Claims, query *sqlbuilder.SelectBuilder) error {
// Claims are empty, don't apply any ACL // Claims are empty, don't apply any ACL
if claims.Audience == "" { if claims.Audience == "" {

4
internal/user/user.go
View File

@ -160,10 +160,12 @@ func applyClaimsSelect(ctx context.Context, claims auth.Claims, query *sqlbuilde
if claims.Subject != "" { if claims.Subject != "" {
or = append(or, subQuery.Equal("user_id", claims.Subject)) or = append(or, subQuery.Equal("user_id", claims.Subject))
} }
subQuery.Where(subQuery.Or(or...))
// Append sub query // Append sub query
if len(or) > 0 {
subQuery.Where(subQuery.Or(or...))
query.Where(query.In("id", subQuery)) query.Where(query.In("id", subQuery))
}
return nil return nil
} }

4
internal/user_account/user_account.go
View File

@ -87,10 +87,12 @@ func applyClaimsSelect(ctx context.Context, claims auth.Claims, query *sqlbuilde
if claims.Subject != "" { if claims.Subject != "" {
or = append(or, subQuery.Equal("user_id", claims.Subject)) or = append(or, subQuery.Equal("user_id", claims.Subject))
} }
subQuery.Where(subQuery.Or(or...))
// Append sub query // Append sub query
if len(or) > 0 {
subQuery.Where(subQuery.Or(or...))
query.Where(query.In("id", subQuery)) query.Where(query.In("id", subQuery))
}
return nil return nil
} }