sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-21 09:09:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor: pass transaction to resolveResource

Browse Source
This commit is contained in:
Elias Schneider
2026-07-07 11:14:19 +02:00
parent 5e2cc6f40e
commit 7667377c98
7 changed files with 29 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/api/module.go
+2 -2
View File
@@ -34,8 +34,8 @@ func (m *Module) ClientAPIScopes(ctx context.Context, tx *gorm.DB, clientID stri
}
// AllowedScopesForAudience implements the OIDC module's APIAccessProvider interface
func (m *Module) AllowedScopesForAudience(ctx context.Context, clientID, audience string, subjectType oidc.SubjectType) (scopes []string, apiExists bool, err error) {
return m.service.AllowedScopesForAudience(ctx, clientID, audience, subjectType)
func (m *Module) AllowedScopesForAudience(ctx context.Context, tx *gorm.DB, clientID, audience string, subjectType oidc.SubjectType) (scopes []string, apiExists bool, err error) {
return m.service.AllowedScopesForAudience(ctx, tx, clientID, audience, subjectType)
}
// DescribePermissions implements the OIDC module's APIAccessProvider interface
backend/internal/api/service.go
+7 -3
View File
@@ -379,9 +379,13 @@ func (s *Service) ClientAPIScopesAndAudiences(ctx context.Context, tx *gorm.DB,
}
// AllowedScopesForAudience returns the permission keys the client is allowed for the API identified by the given audience and subject type, plus whether such an API exists
func (s *Service) AllowedScopesForAudience(ctx context.Context, clientID, audience string, subjectType oidc.SubjectType) (scopes []string, apiExists bool, err error) {
func (s *Service) AllowedScopesForAudience(ctx context.Context, tx *gorm.DB, clientID, audience string, subjectType oidc.SubjectType) (scopes []string, apiExists bool, err error) {
if tx == nil {
tx = s.db
}
var api API
err = s.db.WithContext(ctx).
err = tx.WithContext(ctx).
Select("id").
Where("audience = ?", audience).
First(&api).
@@ -393,7 +397,7 @@ func (s *Service) AllowedScopesForAudience(ctx context.Context, clientID, audien
return nil, false, err
}
err = s.db.WithContext(ctx).
err = tx.WithContext(ctx).
Table("api_permissions").
Select("api_permissions.key").
Joins("JOIN oidc_clients_allowed_api_permissions g ON g.api_permission_id = api_permissions.id AND g.oidc_client_id = ? AND g.subject_type = ?", clientID, subjectType).
backend/internal/api/service_test.go
+2 -2
View File
@@ -148,12 +148,12 @@ func TestAllowedScopesForAudienceFiltersBySubjectType(t *testing.T) {
})
require.NoError(t, err)
userScopes, exists, err := svc.AllowedScopesForAudience(t.Context(), "client-1", "https://api.orders.example.com", oidc.SubjectTypeUser)
userScopes, exists, err := svc.AllowedScopesForAudience(t.Context(), nil, "client-1", "https://api.orders.example.com", oidc.SubjectTypeUser)
require.NoError(t, err)
require.True(t, exists)
assert.ElementsMatch(t, []string{"read:orders"}, userScopes)
clientScopes, exists, err := svc.AllowedScopesForAudience(t.Context(), "client-1", "https://api.orders.example.com", oidc.SubjectTypeClient)
clientScopes, exists, err := svc.AllowedScopesForAudience(t.Context(), nil, "client-1", "https://api.orders.example.com", oidc.SubjectTypeClient)
require.NoError(t, err)
require.True(t, exists)
assert.ElementsMatch(t, []string{"write:orders"}, clientScopes)